Legal
Privacy Policy
This policy explains what personal data PACOD collects, why we collect it, and the rights you have over it under the EU General Data Protection Regulation (GDPR).
1. Who we are
Xpacore Ltd (Експакор ЕООД), registered at Sofia, Bulgaria, ЕИК 208932439 ("we", "us"), is the data controller responsible for your personal data in connection with PACOD. This policy applies to PACOD (www.pacod.io). For any privacy question, or to exercise your rights, contact us at office@pacod.io.
2. Data we collect
- Account data — your name, email address, and password (stored hashed); or, if you use Sign in with Google, your Google account identifier, email address and name (see section 5).
- Content you provide — the messages, questions, and files you submit to your assistants.
- Usage data — pages visited, features used, approximate token usage, and timestamps, used to operate and improve the service. For signed-in users we keep per-account records of requests and AI usage (for quotas, billing and abuse prevention). Which pages you view and how long they stay on screen is measured by our own first-party tool only if you allow analytics cookies; it sets no cookie and shares nothing with third parties.
- Technical data — IP address, browser type, and device information collected in server logs for security and diagnostics.
- Account activity and IP addresses — for signed-in users we keep a log of account activity (sign-ins and sign-outs, password changes, the chats you use and when, with the IP address each action came from) and a list of the IP addresses your account has used, with how often and when each was last used. We use it to keep your account secure and to detect and investigate abuse; it is visible only to our administrators.
- Cookies — see our Cookie Policy for the full list.
3. How and why we use your data (legal bases)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing your account and delivering assistant responses | Performance of a contract |
| Keeping the service secure and preventing abuse | Legitimate interests |
| Improving features and quality | Legitimate interests |
| Sending the newsletter you subscribed to | Consent |
| Meeting legal and accounting obligations | Legal obligation |
4. Sharing and processors
We do not sell your personal data. We share it only with service providers ("processors") who help us run PACOD, under contracts that require them to protect it and to act only on our instructions. By category, these are:
- a cloud hosting and infrastructure provider;
- an AI/LLM model provider used to generate responses;
- an email-delivery provider used to send the newsletter.
Depending on configuration, the AI-model and web-search providers may include Google (Gemini API, Programmable Search Engine). They receive the content of your request — your messages, any images or files you attach, and the relevant conversation context — and search queries derived from it, but never the Google account data described in section 5.
Analytics and advertising providers — Google, Yandex, Microsoft, Meta, TikTok, X, Pinterest and LinkedIn — receive data only if you allow the corresponding optional cookie category; until then their scripts are never loaded. See the Cookie Policy for exactly what each one sets. We use no third-party error-monitoring provider. How Google uses the data its analytics and advertising tags collect is explained in How Google uses information from sites or apps that use our services.
5. Sign in with Google (Google user data)
You can create an account and sign in to PACOD (www.pacod.io) with your Google account ("Sign in with Google"). This section explains exactly what we receive from Google, what we do with it, and how you can remove it.
- What we request — only Google's basic sign-in permissions:
openid,emailandprofile. We do not request access to Gmail, Google Drive, Calendar, Contacts, Photos or any other Google service or data. - What we receive and keep — your Google account identifier, your email address and whether Google has verified it, and your name. We store the identifier and email address to recognise you when you sign in again, and your name as your display name. We do not store your Google profile picture.
- Google tokens — the short-lived access token Google issues during sign-in is used once, to read the details above, and is then discarded. We keep no Google access or refresh token, so we cannot access your Google account afterwards.
- How we use it — only to create your account, sign you in, keep your account secure (for example, we link Google to an existing account with the same email address only when Google has verified that address), and send you messages about your account.
- What we never do with it — we do not sell Google user data; do not use or transfer it for advertising, retargeting or personalised ads; do not use it to determine creditworthiness or for lending; and do not use it to develop, improve or train artificial-intelligence or machine-learning models. Google account data is never sent to our AI-model providers.
- Who can see it — Google user data is shared only with the hosting and email-delivery providers that store it or send your account emails on our behalf (under data-processing agreements), where required by law, or as part of a merger or acquisition, with notice to you. Our staff do not read it except with your consent, where necessary for security or to comply with the law, or for internal operations in aggregated and anonymised form.
- How we protect it — it is transmitted only over encrypted connections (TLS), stored on access-controlled servers, and accessible only to authorised personnel who need it to operate the service.
- Retention and deletion — we keep it for as long as your account exists and delete it together with your account data (see section 7). You can stop our access at any time at myaccount.google.com/permissions — this ends Sign in with Google but does not delete your account. To delete your account and all associated data (including Google data), email office@pacod.io from the address registered to your account with the subject "Delete my account"; we act on your request and confirm it within one month.
6. International transfers
Where a processor is located outside the European Economic Area, we ensure an adequate level of protection through mechanisms such as the European Commission's Standard Contractual Clauses or an adequacy decision.
7. How long we keep it
We keep personal data only as long as necessary for the purposes above. Account data is retained while your account is active and for 90 days after you close it; server logs are kept for 12 months; the account activity log and IP-address history for 6 months; detailed usage-analytics records (requests, page views, AI errors) are kept for 180 days; newsletter data is kept until you unsubscribe.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- request correction of inaccurate data;
- request erasure of your data ("right to be forgotten");
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting processing carried out before withdrawal;
- lodge a complaint with your supervisory authority — in Bulgaria, the Commission for Personal Data Protection (CPDP / КЗЛД).
To exercise any of these rights, email office@pacod.io. We respond within one month.
9. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, and access controls. No system is perfectly secure, but we work continuously to reduce risk.
10. Children
PACOD is not intended for children under 16, and we do not knowingly collect their data.
11. Changes to this policy
We may update this policy from time to time. We'll post the new version here and update the "Last updated" date; significant changes will be communicated directly where appropriate.