Privacy Policy

Our Commitment to Privacy

At PAMKIT, a product of Kollitech Corp., we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered personal asset management platform, including management of real estate, appliances, warranties, documents, insurance, and finances. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the application.

This policy applies to all users of pamkit.net and associated services. PAMKIT uses artificial intelligence services, including Google (Gemini), xAI (Grok), OpenAI, and Anthropic (Claude), accessed only through PAMKIT's server-side proxy, to provide intelligent asset management features. Your data is never sent directly from your browser to third-party AI providers.

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last updated" date of this Privacy Policy. For material changes we will give at least 30 days' notice by email or in-app notification before they take effect. You are encouraged to periodically review this Privacy Policy to stay informed of updates.

Information We Collect

Personal Data

Personally identifiable information, such as your name, email address, telephone number, and demographic information that you voluntarily give to us when you register with the application or when you choose to participate in various activities related to the application. You are under no obligation to provide us with personal information of any kind, however your refusal to do so may prevent you from using certain features of the application.

Asset Information

Information about your assets, including but not limited to real estate properties, appliances, warranties, financial accounts, documents, and insurance policies. This information is stored securely in our Supabase-hosted database and is used solely for the purpose of providing you with asset management services.

Derivative Data

Information our servers automatically collect when you access the application, such as your IP address, browser type, operating system, access times, and the pages you have viewed directly before and after accessing the application. When you sign in, we also derive an approximate location (city and region, never precise coordinates) from your IP address and keep it with your sign-in history, so that you can see where your account is signed in and we can alert you to a sign-in from a new place or device. The lookup uses a copy of the DB-IP database held on our own servers (IP Geolocation by DB-IP, db-ip.com), so your IP address is not sent to a third party for this.

Financial Data

Financial information, such as data related to your payment method (e.g., valid credit card number, card brand, expiration date) that we may collect when you purchase, order, return, exchange, or request information about our services from the application. We do not store card numbers or the CVV — Stripe, Inc. holds those. Where you link a bank account through Stripe Financial Connections, we retrieve and store the institution name, masked account number, account type, balances, and imported transaction records in order to power your finance dashboard and subscription detection. All payment processing is handled by our payment processor, Stripe, Inc. You are encouraged to review Stripe's privacy policy at stripe.com/privacy and contact them directly for responses to your questions.

PAMKIT is not a bank, lender, money transmitter, or financial institution, and we do not offer financial products or services. We are therefore not subject to the Gramm-Leach-Bliley Act (GLBA) and do not issue a GLBA privacy notice. When you link a bank account, Stripe Financial Connections acts as the regulated intermediary and your bank's own privacy notice continues to govern that account. You may unlink an account at any time in Settings, which stops further transaction imports.

AI-Processed Data

When you use AI-powered features such as document scanning, bill analysis, or asset categorization, your data is processed by Google (Gemini), xAI (Grok), OpenAI, and Anthropic (Claude), accessed only through PAMKIT's server-side proxy. We do not use your data to train our own models, and we access AI providers under API terms that, by default, do not use customer inputs to train their models. AI inputs are not retained by these providers beyond what their zero-retention terms permit; PAMKIT does store the outputs we generate for you — such as extracted document fields and Pamela conversation history — for as long as your account is active.

Mobile Device Data

Device information, such as your mobile device ID, model, and manufacturer, and information about the location of your device, if you access the application from a mobile device.

We do not collect, store, or process biometric identifiers or biometric information. Where you unlock the PAMKIT mobile app with Face ID, Touch ID, or an Android biometric, that check happens entirely on your device through your operating system. Your fingerprint or face data never leaves your device and is never sent to or stored by PAMKIT; the app receives only a yes-or-no result. If you prefer not to use biometric unlock, turn it off in your device settings and use your password.

Finding your things with your phone

When you ask Pamkit to look for devices on your Wi-Fi or nearby over Bluetooth, the search runs on your phone and the results stay there until you choose what to add. We do not keep network addresses, Bluetooth identifiers or a list of what was found; only the items you add are saved to your account, with the details you approved.

When you scan a room with the camera or let Pamkit look through your photos, the photos are first sorted on your phone; only the pictures you choose to add are sent to our AI providers through Pamkit's own server, under the same terms as the other AI features above, and the photo is kept with the item you added. You can turn each of these off at any time in your phone's Settings. Pamkit never scans over Bluetooth or through your photos in the background.

Rental Applicant Information

If you submit a rental application to a landlord through PAMKIT, we collect the information you enter in that application on the landlord's behalf, even if you do not have a PAMKIT account. Depending on what the landlord asks for, this can include your name, email address and phone number; your date of birth; your employment details (employer, position, length of employment, monthly income, and your supervisor's name and phone number); your current address, how long you have lived there, your current rent, your reason for leaving, and your current landlord's name and phone number; your desired move-in date, lease term and maximum rent; details of any pets and vehicles; your emergency contact; personal and professional references; any additional occupants; and any eviction history or other disclosures you choose to make.

We use this information only to deliver your application to the landlord you applied to and to generate the Application Summary described in the Automated Decision-Making section. We do not sell or share it, we do not use it for advertising, and we do not make it available to any other landlord. You may contact us at support@pamkit.net to access, correct or delete it, or to request a copy of and human review of any Application Summary generated about you, and we will notify the landlord of any correction or deletion.

Solar monitoring data

If you connect a solar system, we collect the readings your solar monitoring gateway reports: how much your panels produce, how much your home uses, and how much power goes to and comes from the grid, plus per-panel readings and the system details the gateway lists. Readings arrive about once a minute. Minute-level energy data can show when you are home, so we treat it as sensitive.

We use it only to show you your own system: the live view, history, alerts and estimated savings based on the utility rate you choose. We keep the gateway's serial number only as a salted, one-way hash, so we can tell which system a reading belongs to without storing the serial. We never store the network address of your gateway; it stays on your phone or your home hub, and Pamkit reaches the gateway only over your own home network: an address on the public internet is refused. Readings are read-only: Pamkit cannot control your inverters, batteries or gateway.

We keep minute-level readings for 90 days, then delete them. Daily totals and monthly summaries are kept while your account is active, so your history stays useful. You can ask us to delete your solar data at any time, and deleting your account or removing the home deletes it too. We do not sell or share your solar data, and we do not use it for advertising.

Push Notifications

With your consent, we may send push notifications to your device to alert you about important events such as warranty expirations, maintenance reminders, payment due dates, trusted user invitations, and other account activity. You can manage or disable push notifications at any time through your device settings or your PAMKIT notification preferences. We use web push technology and do not share your push subscription data with third parties.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our platform, analyze usage patterns, and provide personalized content. This section explains how we use these technologies and your choices regarding them.

What Are Cookies?

Cookies are small text files that are placed on your device when you visit our website. They help us provide you with a better experience by remembering your preferences and understanding how you use our platform.

Types of Cookies We Use

1. Necessary Cookies (Always Active)

These cookies are essential for the website to function properly and cannot be disabled. They include:

Authentication cookies: Keep you logged in and secure your session (powered by Supabase Auth)

Authentication cookies:

Security cookies: Protect against fraud and unauthorized access
Functional cookies: Remember your basic preferences and settings
Load balancing cookies: Ensure the website loads quickly and efficiently

Load balancing cookies:

2. Analytics Cookies (Optional)

These cookies help us understand how visitors interact with our website by collecting anonymous information. They include:

Google Analytics: Tracks page views, user interactions, and performance metrics
Usage statistics: Helps us understand which features are most popular
Performance monitoring: Identifies technical issues and areas to improve

Performance monitoring:

Data collected: Page views, time spent on pages, click patterns, device information, and general location (country/region level).

3. Marketing Cookies (Optional)

These cookies are used to deliver relevant advertisements and track the effectiveness of marketing campaigns. They include:

Advertising networks: Display relevant ads based on your interests

Advertising networks:

Conversion tracking: Measure the effectiveness of our marketing efforts

Conversion tracking:

Retargeting: Show you relevant content based on your previous visits

4. Preference Cookies (Optional)

These cookies remember your choices and preferences to provide a more personalized experience:

Language settings: Remember your preferred language
Theme preferences: Remember your light/dark mode choice
Dashboard layouts: Remember your customized dashboard settings
Notification preferences: Remember your communication preferences

Notification preferences:

Managing Your Cookie Preferences

You have full control over your cookie preferences. You can:

Accept all cookies: Allow all types of cookies for the best experience
Reject all cookies: Only allow necessary cookies (some features may not work properly)
Customize preferences: Choose which types of cookies to allow

Customize preferences:

Change anytime: Update your preferences in your account settings

Third-Party Services

We use the following third-party services that may set their own cookies:

Google Analytics: For website analytics and performance monitoring
Supabase: For authentication and database services
Stripe: For secure payment processing

Browser Settings

You can also control cookies through your browser settings. Most browsers allow you to:

View and delete cookies
Block cookies from specific websites
Block all third-party cookies
Receive notifications when cookies are set

Note: Disabling cookies may affect the functionality of our website and your user experience.

Cookie Data Retention

Cookie data is retained for different periods depending on the type:

Session cookies: Deleted when you close your browser
Persistent cookies: Remain for a set period (typically 30 days to 2 years)
Analytics data: Aggregated and anonymized, retained for up to 26 months

How We Use Your Information

Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via the application to:

Create and manage your account
Provide and manage the asset management services you request
Process AI-powered document categorization, warranty tracking, and financial insights
Email you regarding your account or order
Fulfill and manage purchases, orders, payments, and other transactions related to the application
Generate a personal profile about you to make future visits to the application more personalized
Increase the efficiency and operation of the application
Monitor and analyze usage and trends to improve your experience with the application
Notify you of updates to the application
Offer new products, services, mobile applications, and/or recommendations to you
Perform other business activities as needed
Prevent fraudulent transactions, monitor against theft, and protect against criminal activity
Process payments and refunds via Stripe
Request feedback and contact you about your use of the application
Resolve disputes and troubleshoot problems
Respond to product and customer service requests
Send you a newsletter (with opt-out available)
Provide predictive maintenance alerts for your tracked assets

Legal Bases for Processing (GDPR)

We process your personal data on the following legal bases:

Contract performance: To provide you with our asset management services

Contract performance:

Legitimate interests: To improve our services, prevent fraud, and ensure security

Legitimate interests:

Consent: For marketing communications and optional analytics
Legal obligation: To comply with tax, accounting, and regulatory requirements

Information Sharing

We may share information we have collected about you in certain situations. Your information may be disclosed as follows:

By Law or to Protect Rights

If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation. This includes exchanging information with other entities for fraud protection and credit risk reduction.

Third-Party Service Providers (Sub-Processors)

We share your information with third parties that perform services for us or on our behalf, including payment processing (Stripe), database and authentication services (Supabase), hosting (AWS), and AI processing (Google, xAI, OpenAI). All sub-processors are bound by data processing agreements. See the Sub-Processors section below for a complete list.

Outside AI Assistants You Connect

You may choose to connect an outside AI assistant to your PAMKIT account; your PAMKIT data is shared with that assistant only after you approve the connection, and you can disconnect it at any time in Settings.

We Do Not Sell Your Personal Information

PAMKIT does not sell, rent, or trade your personal information to third parties for monetary or other valuable consideration. This applies to all users, including California residents under CCPA/CPRA.

Marketing Communications

With your consent, or with an opportunity for you to withdraw consent, we may share your information with third parties for marketing purposes, as permitted by law.

Affiliates

We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include our parent company Kollitech Corp. and any subsidiaries, joint venture partners or other companies that we control or that are under common control with us.

Business Partners

We may share your information with our business partners to offer you certain products, services or promotions.

Sale or Bankruptcy

If we reorganize or sell all or a portion of our assets, undergo a merger, or are acquired by another entity, we may transfer your information to the successor entity. If we go out of business or enter bankruptcy, your information would be an asset transferred or acquired by a third party. You acknowledge that such transfers may occur and that the transferee may decline to honor commitments we made in this Privacy Policy. We will notify affected users of any such transfer in advance where required by applicable law.

We are not responsible for the actions of third parties with whom you share personal or sensitive data, and we have no authority to manage or control third-party solicitations. If you no longer wish to receive correspondence, emails or other communications from third parties, you are responsible for contacting the third party directly.

Data Security

We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse. Any information disclosed online is vulnerable to interception and misuse by unauthorized parties. Therefore, we cannot guarantee complete security if you provide personal information.

Data is encrypted in transit with TLS 1.2+ (TLS 1.3 where supported) and at rest with AES-256. PAMKIT is not a zero-knowledge system: features such as OCR, search, and the Pamela assistant process your content on our servers under strict access controls.

Our security measures include:

Hosted on AWS infrastructure, which maintains its own SOC 2 Type II certification
Server-side AI proxy preventing direct client-to-AI-provider communication
Regular security audits and penetration testing as part of our SOC 2 program
Two-factor authentication (2FA) for account access
Strict access controls for our staff
Regular security training for all employees
Continuous monitoring for suspicious activities
Rate limiting on API endpoints (20 AI calls per 5-minute window)
Row-level security on database tables (Supabase RLS)

Data Retention

We retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. Specific retention periods are as follows:

Data category

Retained for

Notes

Account / profile data

Life of account + 30 days

Documents & assets

User-deleted items are held in Trash for 90 days before permanent removal

Financial / billing records

7 years

Legal requirement (tax and accounting)

Bank-linked balances & transactions

Life of the link + 30 days

Via Stripe Financial Connections

Solar readings (minute-level)

90 days

Deleted automatically each week

Solar daily totals and summaries

Deleted with the account or the home

Messages & notifications

Support tickets

3 years

From date of resolution

Security / audit logs

1 year

Backups

Rolling 90-day purge

Purged automatically

Analytics data

26 months

Aggregated and anonymized

A legal hold, investigation, or legal obligation can extend any of these periods. AI-derived outputs we store for you — such as extracted document fields and Pamela conversation history — follow the retention of the record they belong to.

If you wish to request that we delete your data, you can do so by visiting our Data Subject Rights Portal or contacting us at privacy@pamkit.net. Please note that some information may be retained as required by law (e.g., financial records for 7 years) even after an account deletion request.

Your Rights (CCPA/CPRA - California)

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), California residents have the following rights:

Right to Know

You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months, including:

Categories of personal information collected
Categories of sources from which information was collected
Business or commercial purpose for collecting or selling personal information
Categories of third parties with whom we share personal information
Specific pieces of personal information collected about you

Right to Delete

You have the right to request that we delete any personal information about you that we have collected, subject to certain exceptions (e.g., legal compliance, completing transactions).

Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

Right to Opt-Out of Sale or Sharing

You have the right to opt out of the sale or sharing of your personal information. PAMKIT does not sell your personal information. We do not share your personal information for cross-context behavioral advertising. Because we do not sell or share personal information for cross-context behavioral advertising, we do not offer a "Do Not Sell or Share My Personal Information" link; if that ever changes, we will add one before the change takes effect.

Right to Limit Use of Sensitive Personal Information

You have the right to limit the use and disclosure of sensitive personal information to only what is necessary to perform the services you request. Sensitive personal information we collect is limited to financial account information you link or enter, precise geolocation if you enable it on our mobile app, and government identification numbers contained in documents you upload. We use it only to provide the features you asked for, to secure your account, to prevent fraud, and to meet legal obligations. We do not use or disclose sensitive personal information to infer characteristics about you or for any purpose that would trigger the CPRA Right to Limit.

Right to Opt Out of Automated Decision-Making

You have the right to opt out of automated decision-making technology, including profiling. See the Automated Decision-Making section below for details on how AI is used in our platform.

No Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge you different prices, provide a different level or quality of service, or offer financial incentives conditioned on the collection, sale, or deletion of your personal information.

12-Month Lookback Categories

In the preceding 12 months, we have collected the following categories of personal information:

Identifiers: Name, email address, phone number, IP address, account ID
Financial information: Payment card details (processed by Stripe), transaction history

Financial information:

Internet/electronic activity: Browsing history, search history, interaction data

Internet/electronic activity:

Geolocation data: Approximate location from your IP address; precise device location only if you enable location services on our mobile app
Professional/employment information: Only if voluntarily provided

Professional/employment information:

Inferences: Preferences, characteristics, and behavior patterns derived from usage

How to Exercise Your Rights

To exercise any of these rights, you may submit a verifiable consumer request through our Data Subject Rights Portal or contact us at privacy@pamkit.net. We will respond to verifiable requests within 45 days. If we need additional time, we will inform you of the reason and extension period (up to an additional 45 days).

Multi-State Privacy Law Compliance

In addition to California's CCPA/CPRA, PAMKIT complies with the following state privacy laws. If you are a resident of any of these states, you may have additional rights as described below:

Virginia Consumer Data Protection Act (VCDPA)

Virginia residents have the right to access, correct, delete, and obtain a copy of their personal data, as well as the right to opt out of targeted advertising, sale of personal data, and profiling. You may appeal a decision regarding your request by contacting privacy@pamkit.net.

Colorado Privacy Act (CPA)

Colorado residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, sale of personal data, and profiling that produces legal or significant effects. We honor Colorado's universal opt-out mechanism.

Connecticut Data Privacy Act (CTDPA)

Connecticut residents have the right to access, correct, delete, and obtain a copy of their personal data. You may also opt out of the sale of personal data, targeted advertising, and profiling.

Utah Consumer Privacy Act (UCPA)

Utah residents have the right to access and delete their personal data, and to opt out of the sale of personal data and targeted advertising.

Texas Data Privacy and Security Act (TDPSA)

Texas residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, sale of personal data, and profiling. Small business exemptions may apply.

Oregon Consumer Privacy Act (OCPA)

Oregon residents have the right to access, correct, delete, and obtain a copy of their personal data. You may also opt out of targeted advertising, sale of personal data, and profiling.

Universal Opt-Out Mechanism

We recognize and honor Global Privacy Control (GPC) signals and other universal opt-out mechanisms as valid opt-out requests under applicable state privacy laws. You can enable GPC in your browser settings or through supported browser extensions. You may also manage your privacy preferences through your account settings.

GDPR Data Protection Rights

If you are a resident of the European Economic Area (EEA), the United Kingdom, or Switzerland, you have certain data protection rights under the General Data Protection Regulation (GDPR) and equivalent legislation. We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your personal information.

You have the following data protection rights:

Right of access (Art. 15): The right to request copies of the personal data we hold about you.

Right of access (Art. 15):

Right to rectification (Art. 16): The right to request that we correct any information you believe is inaccurate or complete any information you believe is incomplete.

Right to rectification (Art. 16):

Right to erasure (Art. 17): The right to request that we erase your personal data, under certain conditions.

Right to erasure (Art. 17):

Right to restrict processing (Art. 18): The right to request that we restrict the processing of your personal data, under certain conditions.

Right to restrict processing (Art. 18):

Right to data portability (Art. 20): The right to request that we transfer the data we have collected to another organization, or directly to you, in a structured, commonly used, and machine-readable format.

Right to data portability (Art. 20):

Right to object (Art. 21): The right to object to our processing of your personal data, under certain conditions.

Right to object (Art. 21):

Right to withdraw consent (Art. 7): Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time.

Right to withdraw consent (Art. 7):

Right not to be subject to automated decision-making (Art. 22): The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. See the Automated Decision-Making section below.

Right not to be subject to automated decision-making (Art. 22):

To exercise these rights, please contact us at privacy@pamkit.net or submit a request via our Data Subject Rights Portal. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

Automated Decision-Making

PAMKIT uses artificial intelligence and automated processing to enhance your asset management experience. In accordance with GDPR Article 22 and applicable state privacy laws, we disclose the following:

How We Use AI and Automated Processing

Document categorization: AI automatically classifies uploaded documents (warranties, insurance policies, receipts) into appropriate categories.

Document categorization:

Predictive maintenance alerts: AI analyzes appliance data to predict when maintenance may be needed and generates proactive alerts.

Predictive maintenance alerts:

Financial insights and recommendations: AI processes your financial data to provide spending analysis, budget recommendations, and asset valuation insights.

Financial insights and recommendations:

Bill analysis: AI extracts and organizes information from uploaded bills and invoices.
Estate health scoring: AI evaluates the overall health and completeness of your home and belongings.

Estate health scoring:

Tenant screening: AI computes a score and recommendation from information the applicant supplies, for use in the Rental Center.

Important Safeguards

Tenant screening is advisory, not a consumer report. Any score or recommendation shown is calculated from information the applicant supplied and is not a consumer report under the Fair Credit Reporting Act. Landlords make the final tenancy decision and remain responsible for complying with the Fair Housing Act and applicable landlord-tenant law. An applicant may ask us for a copy of any Application Summary generated about them, and for human review of it, by emailing support@pamkit.net; we describe this in the Rental Applicant Information section above so applicants can find it.

Tenant screening is advisory, not a consumer report.

Other AI outputs are informational and advisory. No decision affecting your legal rights is made by automated processing alone.

Other AI outputs are informational and advisory.

Human review available: You have the right to request human review of any AI-generated categorization, recommendation, or alert by contacting support@pamkit.net.

Human review available:

Opt-out: You may opt out of automated decision-making features through your account settings or by contacting us.
Transparency: AI-generated content is labeled as such within the application.

Do Not Track

Most web browsers and some mobile operating systems include a Do Not Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected.

At this time, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. However, we do recognize and honor Global Privacy Control (GPC) signals as described in the Multi-State Privacy Law Compliance section.

You can manage your tracking preferences through your account settings at any time. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Policy.

Data Breach Notification

In the event of a data breach that compromises the security, confidentiality, or integrity of your personal information, PAMKIT will:

Notification to Authorities

GDPR (EU/UK): Notify the relevant supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals.
California: Submit a sample breach notice to the California Attorney General when a single breach requires notice to more than 500 California residents.
Other US states: Comply with applicable state breach notification laws, which generally require notification without unreasonable delay (typically 30-60 days depending on the state).

Notification to Affected Users

We will notify affected users without undue delay via email and in-app notification.
The notification will describe the nature of the breach, the types of data affected, the likely consequences, and the measures taken or proposed to address the breach.
We will provide specific steps you can take to protect yourself.

Our Breach Response Process

Immediate containment and assessment of the breach
Investigation to determine scope and impact
Notification to affected parties and authorities as required
Remediation and implementation of additional safeguards
Post-incident review and documentation

Sub-Processors

We use the following third-party sub-processors to deliver our services. Each sub-processor is bound by data processing agreements and is required to maintain appropriate security measures. We keep this list current and review it each time we add a material service provider.

Sub-processor

Purpose

Location

Supabase, Inc.

Database hosting, user authentication, and real-time data services

Amazon Web Services (AWS)

Application hosting and content delivery (AWS Amplify)

AWS — Simple Notification Service (SNS)

SMS delivery for one-time passcodes and phone verification

Google LLC (Gemini)

AI-powered document analysis, categorization, and insights via server-side proxy

xAI Corp. (Grok)

AI-powered analysis and insights via server-side proxy

OpenAI, Inc.

AI-powered analysis, document processing, and conversational AI features via server-side proxy

Anthropic PBC (Claude)

AI-powered analysis and conversational AI features via server-side proxy

Stripe, Inc.

Payment processing, subscription management, billing, and bank-account linking via Stripe Financial Connections

Apple Inc.

In-app purchase processing and receipt validation for the iOS app

Resend

Transactional email delivery (account, security, and notification emails)

Google LLC (Maps/Places Platform)

Service-provider search and address lookup

Google LLC (Analytics)

Website analytics and performance monitoring

All AI sub-processors receive data only through our secure server-side proxy. No user data is sent directly from your browser to AI providers. We do not use your data to train our own models, and we access AI providers under API terms that, by default, do not use customer inputs to train their models.

Where we add a sub-processor that will process your personal data for a new purpose, we will update this page. For material changes we will give at least 30 days' notice by email or in-app notification before they take effect. A change in the AI provider that serves a given request, among the providers already listed, is not a material change.

International Transfers

Your information, including personal data, is stored and processed primarily in the United States through our hosting provider AWS and database provider Supabase.

Transfer Mechanisms

If you are located outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. We ensure appropriate safeguards are in place for international data transfers, including:

EU-US Data Privacy Framework (DPF): We rely on sub-processors that participate in the EU-US Data Privacy Framework, the UK Extension to the EU-US DPF, and the Swiss-US Data Privacy Framework where applicable.

EU-US Data Privacy Framework (DPF):

Standard Contractual Clauses (SCCs): Where the Data Privacy Framework does not apply, we use European Commission-approved Standard Contractual Clauses as the legal basis for transferring data from the EEA, UK, and Switzerland to the US.

Standard Contractual Clauses (SCCs):

Data processing agreements: All sub-processors that handle personal data are bound by data processing agreements that require them to protect your data in accordance with applicable privacy laws.

Data processing agreements:

Data Storage Location

Primary data is stored in US-based data centers operated by AWS and Supabase. We do not intentionally transfer your data outside the United States except as necessary to provide services to you based on your location.

Children's Privacy (COPPA)

PAMKIT requires all users to be at least 18 years old, and our Service is not directed at children. We separately comply with the Children's Online Privacy Protection Act (COPPA), which covers children under 13, and do not knowingly collect personal information from anyone under 13.

Our Commitments

No knowing collection: We do not knowingly collect, use, or disclose personal information from children under 13 years of age.

No knowing collection:

Deletion upon discovery: If we discover that we have collected personal information from a child under 13, we will delete that information as quickly as reasonably possible.

Deletion upon discovery:

Parental rights: Parents or legal guardians who believe their child has provided us with personal information may contact us at privacy@pamkit.net to request access, correction, or deletion of that information.

Privacy Contact

We have designated a Privacy Contact who is responsible for overseeing our data protection practices and ensuring compliance with applicable privacy laws.

Contact Us

Email: privacy@pamkit.net

Mail: Privacy Contact, PAMKIT c/o Kollitech Corp., 1160 Battery Street East, Suite #100, San Francisco, CA 94111, USA

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For material changes we will give at least 30 days' notice by email or in-app notification before they take effect.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page. Your continued use of PAMKIT after the effective date of changes constitutes your acceptance of those changes.

If you have questions or comments about this Privacy Policy, please contact us at:

Privacy Inquiries: privacy@pamkit.net

General Support: support@pamkit.net

PAMKIT c/o Kollitech Corp. 1160 Battery Street East, Suite #100 San Francisco, CA 94111

Data Rights Portal: Submit a Data Subject Request

Submit a Data Subject Request