Privacy Policy

This Privacy Policy explains how Paddi ("we," "us," or "our") collects, uses, stores, and protects your information when you use our website at paddi.app, the Paddi web and desktop apps, the Paddi CLI, and the Paddi Slack app (collectively, the "Service"). Paddi is an AI PM Agent that turns user feedback into prioritized requests and specifications ready for code agents.

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

Information We Collect

Account Information

You sign in with Google or GitHub. From that provider we receive your name, email address, and profile picture as authorized by you. We do not store passwords. We also keep records of your sign-in sessions, including IP address, device and browser details, and when each session was last used.

If you create or join a workspace, we store your membership and role. When you invite someone, we store their email address and send them an invitation email.

Content You Provide

In the course of using Paddi, you may input or submit the following types of content:

Feedback and requests: Text, feedback, and other product requirements you enter manually, through chat with the Agent, or through the CLI.
Project information: Project descriptions, briefs, spec templates, and other settings that guide the Agent's analysis.
Files and attachments: Documents, PDFs, and images you upload to the Agent or as feedback.
Feedback about Paddi: Bug reports and suggestions you send us from within the Service.

Third-Party Integration Data

Paddi connects to external services you authorize. Data from these integrations is accessed only within the scope of permissions you grant, and only to provide the Service:

Code repositories (GitHub, GitLab): The Agent reads the repositories you authorize — including source code, file structures, and dependency information — to give code-aware analysis. Repositories are cloned into an isolated, temporary environment and are not modified. When you connect a GitHub repository as a feedback source, we also receive newly opened issues.
Error monitoring (Sentry): Error events your Sentry project sends us.
Chat (Slack): Messages in the channels you connect, and messages sent to or mentioning the Paddi app. The Paddi app can also look up channels and users, and post messages and reactions in your workspace.
Email: Messages sent to a feedback address you set up.
Meetings (Google Meet, Microsoft Teams, Zoom): Transcripts and summaries of meetings recorded by the account you connect, including participant names and what they said. We check for new transcripts periodically.
Documents and issue trackers (Notion, Jira, Confluence, Google Drive): Pages, issues, and files within the database, project, space, or folder you choose. When you export a specification, we create a page or issue in the destination you choose.

Personal Data of Others

Content from your integrations — such as customer feedback, emails, Slack messages, error reports, and meeting transcripts — may contain personal data of people other than you, including your customers, colleagues, and meeting participants. We process this data on your behalf and following your instructions. You are responsible for having the right to share it with us, including any notice or consent required by law.

Usage Data

We collect technical data when you use the Service, including your IP address, browser and device information, pages visited, timestamps, product events, error reports, and AI usage (such as the amount of model usage per workspace for billing). This data helps us maintain, secure, and improve the Service.

Cookies and Similar Technologies

We use cookies and browser storage for:

Authentication: Keeping you signed in to the app, and protecting the sign-in flow.
Preferences: Remembering settings such as your theme.
Analytics: Measuring page views and clicks on our website, using PostHog.

You can configure your browser to refuse cookies, though you will not be able to sign in without them.

How We Use Your Information

We use the information we collect to:

Provide and operate the Service: Collect and analyze your feedback, prioritize requests, and generate specifications.
Improve the Service: Analyze usage patterns, diagnose technical issues, and develop new features.
Bill you: Manage subscriptions and track usage against your plan's limits.
Communicate with you: Send service-related notifications, respond to your inquiries, and share product updates (which you can opt out of at any time).
Ensure security: Detect and prevent fraud, abuse, and unauthorized access, and keep audit records.
Comply with legal obligations: Meet applicable legal requirements and enforce our terms.

AI Processing

Paddi uses AI models from OpenAI and Anthropic to analyze feedback, prioritize requests, and generate specifications. When the Agent processes your data:

Your content, attachments, and authorized integration data are sent to these providers for processing.
We use these providers' APIs under terms that do not allow them to train their models on your data.
When the Agent searches the web, its search queries are sent to our search provider.
The Agent's reasoning process — including which data sources it referenced and how it reached its conclusions — is made transparent and traceable to you within the Service.

Google User Data

Paddi's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Drive and Google Meet data only to provide the features you connected them for, we do not use it to train AI models, and we do not allow humans to read it except with your consent, for security purposes, or as required by law.

We do not sell your personal information. We may share your data in the following circumstances:

Workspace members: Content in a workspace is visible to its members.

Service providers: We use the following providers to run the Service. They process data on our behalf and only as needed to provide their service to us.

Provider	Purpose	Location
Railway	Hosting, database, and file storage	Japan
Cloudflare	Network and app downloads	Global
OpenAI, Anthropic	AI model processing	United States
Serper	Web search for the Agent	United States
Stripe	Payments	United States
Sentry	Error monitoring	United States
PostHog	Product and website analytics	United States
Google	Sending email	United States

Third-party integrations you authorize: When you connect GitHub or other supported services, data flows between Paddi and those platforms as necessary to deliver the functionality you requested. These services are governed by their own privacy policies.
Legal requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.
Business transfers: In the event of a merger, acquisition, or asset sale, your information may be transferred. We will notify you before your data becomes subject to a different privacy policy.
With your consent: We may share your information for other purposes with your explicit consent.

Data Storage and Security

Your data is stored on servers in Japan. Some of our service providers, listed above, process data in other countries, including the United States. We take reasonable technical and organizational measures to protect your data, including encryption in transit, encryption of third-party access tokens, workspace-level access controls, and tamper-evident audit logs.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

Data Retention

We retain your personal data and content for as long as your account is active or as needed to provide the Service.

Deleted items: Deleted feedback and requests stay in the trash for 30 days so they can be restored, then are permanently deleted.
Account deletion: When you ask us to delete your account, we will delete or anonymize your data within a reasonable timeframe, except where retention is required by law or necessary to resolve disputes.
Backups and logs: Database backups are kept for up to 1 year, and system and audit logs for up to 5 years, for security and recovery. Deleted data is removed from backups as they expire.

Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Request deletion of your data
Object to or restrict certain processing
Request a portable copy of your data
Withdraw consent where processing is based on consent

You can disconnect integrations and delete content, projects, and workspaces within the Service at any time. To delete your account or exercise any of these rights, contact us at hello@paddi.app. We will respond within a reasonable timeframe in accordance with applicable law.

Children's Privacy

Paddi is designed for professional use and is not intended for anyone under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected such information, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us.

Email: hello@paddi.app
Website: https://paddi.app