Privacy Policy & Cookies

Last updated: October 6, 2026 AXM MATRIX SRL - Str. Mehedinți nr. 61-63, Cluj-Napoca, Romania Tax ID (CUI) 45890022 • Trade Register No. J2022001670127 • Special VAT ID RO47586632 (Art. 317 Romanian Fiscal Code)

Privacy Policy

This Privacy Policy explains how AXM MATRIX SRL ("we," "us," "our") collects, uses, and protects personal data when you visit or use Project Pana, including our website, the app, and related services (the "Service"). It applies to visitors, registered users, and subscribers ("you").

Who Is Responsible for Your Data

The data controller is AXM MATRIX SRL, Str. Mehedinți nr. 61-63, Cluj-Napoca, Romania, Tax ID (CUI) 45890022, Trade Register No. J2022001670127. For any privacy question or request, contact us at contact@projectpana.com. We have not appointed a Data Protection Officer, as we are not required to; all privacy requests are handled at the address above.

What Data We Collect

Account data. When you create an account, with Google sign-in or with email and password, we receive your email address and name. You can also add a display name and an avatar image. If you sign in with Google, Google shares your basic profile information with us under its own privacy policy; we use only your name and email.

Billing data. To subscribe, you provide a billing name and address (street, city, county, postal code, country). If you subscribe as a company, you also provide the company name, tax ID, and, optionally, the trade register number. We do not collect phone numbers.

Subscription data. Your plan, trial and subscription dates, subscription status, any promotional offer applied to your account (for example, Founding Writer status), cancellation and withdrawal details, refund status, and the identifiers our payment provider assigns to you.

Consent records. The date you accepted our Terms and this Privacy Policy, the consent you give at checkout to start your subscription immediately, and your cookie choices.

User Content. The stories, projects, characters, locations, timelines, notes, images, and any other material you create or upload in the Service.

Messages you send us. If you use the feedback form or email us, we receive your name, email address, and message.

Technical data. When you use the Service, our hosting provider processes technical data such as your IP address, browser type, and server logs, to deliver the Service and keep it secure. If you allow analytics cookies, we also collect usage data, such as the pages you visit and how long you stay on them.

Providing your email address is necessary to create an account, and billing data is necessary to subscribe, because we need it to issue invoices. Everything else is optional.

Your Creative Content

Project Pana is a workspace for your stories and worlds, and your work may be unpublished, personal, or commercially valuable. This is how we treat it:

You own all User Content. We claim no rights over it, beyond the limited license needed to host and display it to you, as described in our Terms and Conditions.
We do not read, sell, or license your User Content, and we do not use it for any purpose other than providing the Service to you.
We do not use your User Content to train artificial intelligence models, and we do not send it to any AI service.
Your projects are private and visible only to you. They are not public and not indexed by search engines.
Images you upload (including your avatar) are stored at long, hard-to-guess web addresses. They are not listed or indexed anywhere, but anyone who has the exact address of an image can open it. Please keep this in mind before uploading images you consider sensitive.

Why We Use Your Data and Our Legal Basis

| Purpose | Data used | Legal basis (GDPR) | |---|---|---| | Creating and running your account and providing the Service | Account data, User Content | Performance of our contract with you (Art. 6(1)(b)) | | Free trial, subscription, payments, promotional offers, cancellations, withdrawals and refunds | Account, billing and subscription data | Performance of our contract with you (Art. 6(1)(b)) | | Issuing invoices and keeping accounting and tax records | Billing and subscription data | Legal obligation (Art. 6(1)(c)) | | Service emails (confirmations, billing notices, trial and deletion reminders, changes to our Terms) | Email address, name | Performance of our contract with you (Art. 6(1)(b)) | | Answering your messages and support requests | Messages you send us | Our legitimate interest in helping you (Art. 6(1)(f)) | | Keeping the Service secure, preventing fraud and abuse, fixing errors | Technical data | Our legitimate interest in a safe, working Service (Art. 6(1)(f)) | | Showing the consumer-protection information required in Romania | Approximate country (from your IP address) | Legal obligation (Art. 6(1)(c)) | | Keeping proof of the consents and acceptances you give | Consent records | Legal obligation and our legitimate interest in proving compliance (Art. 6(1)(c) and (f)) | | Usage analytics | Usage data | Your consent (Art. 6(1)(a)), through analytics cookies | | Measuring our advertising | Advertising cookie data | Your consent (Art. 6(1)(a)), through marketing cookies | | Marketing emails, such as offers and news | Email address, name | Your consent (Art. 6(1)(a)), which you can withdraw at any time |

Where we rely on our legitimate interest, you have the right to object, as described below. We do not use automated decision-making, including profiling, that produces legal or similarly significant effects for you.

We do not sell your personal data. We share it only with the service providers below, each for a specific purpose:

Base44 (hosting, database, file storage, sign-in, and email sending). Project Pana is built and hosted on Base44 (Base44, Inc., part of Wix.com Ltd.). All account data, billing data, and User Content are stored in Base44's infrastructure, and our service emails are sent through it. Base44 acts as our data processor under its Data Processing Agreement (base44.com/dpa) and uses its own sub-processors for storage, email delivery, server hosting, and logging, listed at base44.com/dpa/exhibitc. Base44 reports SOC 2 Type II compliance and ISO 27001 certification.

Stripe (payments). Stripe processes subscription payments. We send Stripe your email address, billing name and address and, for companies, the company name, tax ID, and trade register number. Stripe processes your payment details directly; we never see or store your full card number. Stripe acts as our processor for payment processing and as an independent controller for its own purposes, such as fraud prevention and legal compliance, under its privacy policy at stripe.com/privacy.

Oblio (invoicing). We use Oblio to issue invoices compliant with Romanian tax law, which requires your billing data.

Google (sign-in and fonts). If you sign in with Google, Google authenticates you. Some fonts may be loaded from Google Fonts, in which case your browser connects to Google's servers and Google receives your IP address. Google Fonts does not set cookies. See policies.google.com/privacy.

ipapi.co (country detection). Once per browser session, your IP address is sent to ipapi.co to determine your approximate country, so we can show the consumer-protection information required in Romania. Only the country code is kept, in your browser.

Analytics and advertising providers. Only if you allow analytics or marketing cookies, we may use Google Analytics, the analytics tools provided by Base44, and the Meta Pixel (Meta Platforms). These tools never access the content of your projects.

Authorities and advisers. We may disclose data when required by law, for example to tax authorities, or when necessary to establish, exercise, or defend legal claims. Our accountant receives billing records as needed for bookkeeping.

International Data Transfers

Our hosting provider stores data on servers in the United States, so your data is transferred outside the European Economic Area. Stripe, Google, and Meta may also process data in the United States. These transfers are protected by the EU-U.S. Data Privacy Framework, where the provider is certified, and by the European Commission's Standard Contractual Clauses, as set out in each provider's data processing terms. Wix.com Ltd., Base44's parent company, is located in Israel, a country recognized by the European Commission as providing adequate protection.

How Long We Keep Your Data

Active accounts. We keep your account data and User Content for as long as your account is active.
Inactive accounts. If your free trial ends without a subscription, or your paid subscription ends, we keep your account and User Content for 120 days, so you can subscribe again and continue where you left off. We email you 30, 15, and 7 days before deletion. After 120 days, your account and User Content are permanently deleted.
Account deletion at your request. When you delete your account, it is scheduled for permanent deletion 30 days later, and you can cancel the deletion during this period by signing in. After 30 days, your account and User Content are permanently deleted, and any active subscription is canceled.
Uploaded images. When an account is deleted, its images are immediately removed from the account and no longer linked anywhere in the Service. Our hosting provider does not currently allow us to delete stored files directly, so we ask it to delete them from its storage; this may take additional time, during which the files can be opened only by someone who already has their exact address.
Billing records. Invoices and the related billing and payment records are kept for the period required by Romanian accounting and tax law, even after your account is deleted. Stripe keeps its own payment records under its legal obligations.
Messages you send us. Kept for as long as needed to handle your request, and no longer than 2 years.
Cookie choices. Kept for 12 months, after which we ask again.
Server logs and backups. Technical logs and backup copies held by our hosting provider are deleted or overwritten in its normal cycles.

How We Protect Your Data

All connections to the Service are encrypted (HTTPS). Access to your projects is restricted at the server level to your own account, and administrative functions are limited to authorized accounts. Our hosting provider applies its own certified security program. No system is completely secure, but we take reasonable technical and organizational measures to protect your data and will notify you and the authorities of a personal data breach where the law requires it.

Your Rights

Under the GDPR, you have the right to:

access your personal data and receive a copy of it;
rectify inaccurate or incomplete data (you can also edit most of it directly in your account);
erase your data (you can also delete your account from the Profile and Subscription section);
restrict the processing of your data in certain cases;
data portability, meaning to receive the data you provided to us in a structured, commonly used, machine-readable format;
object to processing based on our legitimate interest;
withdraw your consent at any time, without affecting processing done before the withdrawal (for cookies, use Cookie Settings; for marketing emails, use the unsubscribe link or contact us).

To exercise any of these rights, email contact@projectpana.com. We may ask you to confirm your identity, usually by writing to us from the email address of your account. We will reply within one month; for complex or numerous requests, this period may be extended by up to two more months, and we will tell you if that happens.

You also have the right to lodge a complaint with a data protection supervisory authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro. If you live in another EU country, you can also contact the authority in your country.

Age Requirement

The Service is intended only for people aged 18 or over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we will delete it.

Links to Other Websites

The Service may contain links to websites we do not operate. Their own privacy policies apply, and we are not responsible for their practices.

Changes to This Privacy Policy

We may update this Privacy Policy when our Service, our providers, or the law change. We will notify you of material changes by email or in-app notice before they take effect. The "Last updated" date at the top of this page shows the latest revision.

Contact Us

For any question about this Privacy Policy or your data:

AXM MATRIX SRL Str. Mehedinți nr. 61-63, Cluj-Napoca, Romania Email: contact@projectpana.com

Approved by the management of AXM MATRIX SRL on October 6, 2026.

Cookies

This Cookie Policy explains how Project Pana uses cookies and similar technologies, and the choices available to you.

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. We also use similar technologies, such as your browser's local storage and session storage. In this Cookie Policy, "cookies" refers to all of them.

Strictly Necessary Cookies

These keep the Service working. They cannot be turned off and do not require your consent.

Sign-in (platform session cookie, token, base44_access_token) - keeps you signed in. Kept until you sign out.
App connection (base44_app_id, base44_app_base_url, base44_functions_version) - connects the app to its own servers. Persistent.
Your preferences (pana-theme, animus_active_project) - remember your light/dark theme and the last project you opened. Persistent, until you change them or clear your browser data.
Unsaved edits (pana-draft-character-, pana-draft-location-) - protect your unsaved changes if the browser tab closes. Kept until you save or discard them.
Cookie choice (pana_cookie_consent) - remembers your cookie preferences. 12 months.
Country (user_country_code) - remembers your approximate country so we can show the consumer-protection information required in Romania. Kept until you close the browser tab.

Analytics Cookies

These help us understand how the Service is used (for example, which pages are visited and for how long), so we can improve it. They are only set if you allow them. Depending on the tools active at any given time, we may use:

Google Analytics (_ga, ga*) - Google. Distinguishes visitors and sessions to produce usage statistics. Up to 2 years.
Base44 analytics - Base44, our hosting platform. Measures how the features of the app are used. Duration set by the platform.

Marketing Cookies

These help us measure the results of our advertising. They are only set if you allow them. Depending on the campaigns active at any given time, we may use:

Meta Pixel (_fbp) - Meta. Measures the results of our ads on Facebook and Instagram. 90 days.

Third-Party Services

ipapi.co - once per browser session, we send your IP address to ipapi.co to determine your approximate country. ipapi.co does not store anything on your device.
Google Fonts - some fonts may be loaded from Google's servers, which receive your IP address when the page loads. Google Fonts does not set cookies.
Stripe - when you subscribe, you are redirected to Stripe's secure checkout page. Stripe's own cookie and privacy policies apply there.
Example content - some example projects include images loaded from Unsplash and Picsum Photos. These providers receive your IP address when the images load.

Your Choices

When you first visit the Service, we ask for your consent before using any analytics or marketing cookies. You can accept all, reject all, or choose by category. You can change your choice at any time from Cookie Settings, available in the website footer and in your account Settings.

How to Delete or Block Cookies

You can delete or block cookies from your browser settings, usually under "Privacy" or "Cookies and site data". If you block strictly necessary cookies, some parts of the Service, such as signing in, may not work.

We may update this Cookie Policy when the cookies we use change, or for operational, legal, or regulatory reasons. The "Last updated" date at the top of this page shows when it was last changed.

Contact

If you have questions about this Cookie Policy, please contact us at contact@projectpana.com.