Privacy Policy

1. Scope and our role

This Policy covers the Pakki website, accounts, application, Buyer Intelligence functions, and related support. Pakki is built for business users and B2B research, not consumer profiling.

The Pakki service operator generally acts as controller for account, product, security, support, and website data. For prospect, exhibitor, or other business data a customer submits and directs us to process, we may act as its processor or service provider. Roles vary by activity and applicable law.

When a self-serve purchase is processed through Waffo Pancake, Waffo.com Limited acts as merchant of record and as an independent controller for the payment, billing, tax, fraud, refund, chargeback, and merchant-of-record transaction data it processes. Waffo’s own buyer terms and privacy policy apply to that processing.

2. Data we collect and sources

• Account and identity data: email, identity subject, role, tenant, session and verification status.
• Legal-acceptance evidence: document versions, locale, acceptance time, IP address, and device/user-agent data.
• Workspace and service data: target criteria, domains, companies, business contacts, tags, scores, notes, pipeline history, exports, generated drafts, preferences, and action history.
• Prospect data: business names, job titles, work contact details, professional profiles, company facts, public evidence, and inferred business fit.
• Buyer Intelligence evidence: requested and final website URLs, response and freshness status, scan times, normalized packaging claims, source and evidence references, content and source hashes, confirmed or pending-removal snapshots, append-only snapshot history, change records, and customer corrections.
• Supplier and match data: customer-declared equipment, formats, materials, processes, certifications and verification status, markets, industries, quantities, lead times, notes, capability-match reasons, gaps, unknown facts, and timing signals.
• Relationship and inference data: business nodes and links, claim type, confidence, supporting evidence, validity dates, customer confirmation or dispute status, and archive history.
• Trade-show data: event details and customer-imported exhibitor names, websites, listing URLs, locations, roles, categories, descriptions and notes; import source, list date, file hash, mapping results, rights attestation, qualification, match, status, route, and briefing data.
• Regulation-opportunity data: selected official source identifiers and URLs, normalized milestones and source hashes, last-check and review dates, market evidence, match reasons, unresolved facts, relevance, and customer action status.
• Usage and technical data: actions, timestamps, IP, device/browser data, security events, diagnostics, and error types. We do not intentionally log request bodies, tokens, cookies, or full query strings.
• Subscription data: plan, status, quota, transaction references, and, where applicable, merchant-of-record customer identifiers. For Waffo-processed purchases, Waffo Pancake and its payment providers process payment-card details; Pakki does not intend to store full card numbers.
• Sources include you and your organization, websites and public business sources, customer-authorized trade-show imports, official regulator publications, permitted third-party search/extraction/enrichment providers, generated inferences, and operational service providers.

3. Why we process data

Depending on location and context, legal bases may include performing a contract, legitimate interests in operating and securing a B2B service, consent where required, and compliance with law. Customers are responsible for establishing their own basis for prospecting and outreach.

• Provide, personalize, maintain, and support the service and its AI-assisted workflows.
• Authenticate users, provision tenants, enforce plans and quotas, administer subscription entitlements, exchange necessary subscription records with the merchant of record where applicable, and keep acceptance/audit records.
• Find and qualify B2B companies and contacts, generate requested content, deduplicate data, and improve data quality.
• Build evidence-backed packaging-demand fingerprints, compare supplier capabilities, detect supported website-evidence changes, map procurement relationships, find similar buyers, and prioritize dated opportunity signals.
• Validate and process authorized trade-show imports, record rights attestations, rank and brief exhibitors, and match company-market evidence against reviewed official regulation sources.
• Protect accounts, detect abuse, debug failures, monitor reliability, back up data, and recover from incidents.
• Maintain evidence and status history, respond to corrections and objections, communicate about the service, comply with legal obligations, and enforce agreements.

4. AI, extraction, and automated inferences

Selected URLs, customer instructions, imported business data, and public evidence may be sent to AI, search, website-extraction, and enrichment providers to retrieve content and produce normalized claims, classifications, scores, relationships, summaries, and drafts. We seek to minimize the data sent and do not intend the service for sensitive personal data.

Some outputs are deterministic comparisons or rules, while others are inferred. The product labels evidence status and unresolved facts where supported, but providers and source websites can still be incomplete, stale, unavailable, or wrong.

All output requires human review. Pakki does not use Buyer Intelligence output to make legal or similarly significant decisions about individuals and does not represent a match or timing score as a purchase probability. We do not use customer or prospect data to train a public general-purpose model unless we first provide a separate notice and obtain any required permission.

5. When we disclose data

We disclose only what is reasonably needed to operate the service, follow your instructions, complete a transaction, protect rights and safety, comply with law, or complete a disclosed corporate transaction.

• Cloud hosting, database, storage, backup, and content-delivery providers.
• Identity, security, observability, support, and transactional-email providers.
• AI/model, search, website-extraction, business-data enrichment, contact verification, and geocoding providers.
• Waffo.com Limited, Waffo Pancake, and payment or subscription providers when used for merchant-of-record transactions and entitlement administration. Waffo acts independently for its payment-related purposes.
• Professional advisers, authorities, or transaction counterparties where legally necessary and appropriately protected.

6. Sale, sharing, and advertising

As of this Policy’s effective date, Pakki does not sell personal information for money and does not share personal information for cross-context behavioral advertising. We use only service-essential storage and do not run advertising cookies. If this changes, we will update this Policy and provide legally required notices and choices before activating the new use.

7. International transfers

Pakki and its providers may process data in the United States and other countries, which may have different privacy laws. Where law requires a transfer mechanism, the operator will use an applicable adequacy decision, contractual safeguard such as approved standard contractual clauses, or another lawful mechanism, together with supplementary measures when appropriate.

8. Retention and deletion

We do not apply one fixed retention period to every category. We assess retention using the purpose of processing, whether the account or customer relationship remains active, source freshness and re-check needs, customer configuration, contractual duties, security and fraud risk, dispute and claim periods, legal obligations, and whether the record is needed to preserve an accurate audit trail.

Active account, workspace, Buyer Intelligence, supplier-capability, relationship, trade-show, and regulation-match data is generally retained while needed to provide the service. Append-only evidence snapshots, content hashes, import attestations, acceptance evidence, billing references, security records, and status or action history may be kept longer where needed to explain changes, prevent abuse, prove authorization, establish compliance, or resolve disputes.

After an authorized deletion request or account closure, eligible data is deleted or de-identified subject to customer instructions, legal exceptions, dependencies, and ordinary backup rotation. Data remaining only in backups is not restored to active use except for disaster recovery and expires through the applicable backup cycle. Suppression data may be retained to honor objections and prevent re-contact. Contact us for the criteria applicable to a category or to request deletion.

9. Security

We use measures designed to protect data, including access controls, encryption in transit, tenant scoping, secret isolation, least-privilege database access, restricted container networking, monitoring, backups, and tested recovery procedures. No system is completely secure. Please report suspected security issues without including sensitive data in ordinary email.

10. Cookies and local storage

The website and application use cookies or similar local storage that are necessary for authentication, fraud prevention, session continuity, language, theme, and other user-requested preferences. Blocking essential storage may prevent sign-in or core features.

As of this Policy’s effective date, we do not use advertising cookies. Before adding non-essential analytics or advertising storage, we will update this Policy and deploy consent controls where required.

11. Your privacy rights

Depending on where you live and whether an exemption applies, you may have rights to know or access data, correct it, delete it, obtain a portable copy, restrict or object to processing, withdraw consent, opt out of sale/sharing or targeted advertising, limit certain sensitive-data uses, and appeal a denied request. You may also complain to a competent regulator.

California residents may have rights to know, delete, correct, opt out of sale/sharing, limit certain sensitive-data uses, and receive equal service when exercising rights. Pakki does not sell or share data for behavioral advertising as of this Policy’s effective date. EEA/UK residents may also have rights to restriction, portability, objection, and safeguards for automated decisions.

Submit an access, correction, deletion, restriction, portability, or objection request to [email protected]. We will verify identity and authority, respond within the period required by applicable law, and explain any lawful exception. Authorized agents may be asked for proof of authority. Customers should handle requests concerning data for which they are the controller; we will assist as required by contract and law.

If a company fact, packaging claim, relationship, trade-show record, or regulation match is inaccurate, identify the record and supporting correction in your request. We may correct, dispute, archive, suppress, or delete it as appropriate while preserving the minimum history needed to show what changed and why.

12. Children

Pakki is a business service for adults and is not directed to children. Do not submit children’s data for prospecting. If you believe a child provided personal data, contact us so it can be investigated and deleted where required.

13. Changes and contact

We may update this Policy as the service, providers, or law changes. The effective date and version are shown above, and material changes will receive additional notice when required.

Privacy questions, rights requests, corrections, and objections should be sent to [email protected].