निजता नीति

Effective date: 31 October 2026

Who we are

PanPull, the website at panpull.com ("we", "us"), is the controller of the personal data described in this policy: we decide how and why it is used.

Privacy contact: [email protected]

This policy covers the PanPull website and service: visiting the site, checking a share link, creating an account, placing an order, downloading files and contacting us.

Data we collect

Account

Your name and email address.
Your password, stored only as a hash and never in readable form.
Your sign-in sessions.

Share links and orders

The share links and extraction codes you submit, encrypted in our database.
Quotes and orders: the files they cover (names, paths and sizes), the total size, the price, the status, the service period, the email address the download is sent to and the language for that email.
Whether a quote used the share bonus and which share button you clicked.
Delivery records for each order, such as the preparation status and the prepared download.
Records of the download email: the address, when it was sent and whether the email service accepted it.

Payments

PayPal order and capture IDs, amounts, the currency and the payment state, including refunds.
We never receive your full card number or your PayPal password. PayPal processes your payment details.

Problem reports

When you use the Report a problem form: your email address, your message, the site language and, if you are signed in, your account. The email address and message are encrypted, and only administrators can read them.

Security and technical data

Your IP address, which is needed to deliver the website and to limit spam and abuse. For rate limits we keep only keyed hashes of IP addresses, and only for a short time.
A log of our calls to the download service: time, result, error codes and order references. It contains no credentials or extraction codes, and share links in it are masked.
An audit log of administrator actions, which can include your account or order ID.

Browser storage and cookies are described below.

How we use data and our legal bases

If you are in the European Economic Area (EEA) or the UK, the GDPR or the UK GDPR applies, and we rely on these legal bases:

Providing PanPull (checking share links, quotes, your account, orders, preparing and delivering downloads, the download email): performance of our contract with you.
Payments, refunds and disputes: performance of our contract with you and our legal obligations.
Accounting and tax records: our legal obligations.
Answering problem reports and requests: performance of our contract when it concerns an order; otherwise our legitimate interest in helping visitors.
Security and abuse prevention (rate limits, spam protection, logs, disabling accounts): our legitimate interests in protecting PanPull, its users and others.
The share bonus: performance of our contract when we apply the bonus, and our legitimate interest in knowing which share buttons are used.
Google Analytics: your consent, which you can withdraw at any time.
Legal compliance and legal claims: our legal obligations and our legitimate interest in establishing, exercising or defending legal claims.

Where we rely on legitimate interests, you can object (see "Your rights"). We do not use your data for advertising, and we do not make decisions about you by automated means that have legal or similarly significant effects on you.

Who receives data

We share data only with the providers PanPull needs, and only what each needs for its task:

PayPal processes payments, refunds and disputes. It receives the amount, the order number and a short description, plus what you enter at PayPal, and, in a dispute, the order and delivery information we provide to respond. PayPal's privacy statement applies to the data you give PayPal.
The download service operated for PanPull fetches your files from Baidu and stores them temporarily. It receives the share link, the extraction code and the files in your order.
Baidu Netdisk, based in China, is the source of the files. To fetch them, the download service sends the share link and extraction code to Baidu.
Cloudflare hosts the website and delivers it through its network, and Cloudflare R2 may store prepared files temporarily. Cloudflare processes IP addresses and request data to do this.
Resend sends the download email. It receives your email address and the email itself, which contains the private link to your download page.
Google provides Google Analytics, only if you accept analytics cookies.
The notification service we use sends our team alerts about paid orders, new problem reports and service failures. These alerts contain references such as order numbers, amounts and PayPal transaction IDs, but not your email address, share link or message.

When you download, PanPull checks your access and then sends your browser to the stored file at the download service or Cloudflare R2, which therefore also sees your IP address.

We may also disclose data when the law requires it, or where needed to protect rights, safety and the service. We do not sell personal data.

Cookies, browser storage and analytics

Browser storage

PanPull stores a few items in your browser so that the site works and remembers your choices:

Theme and language (local storage): your display settings. They stay until you clear your browser data.
Sign-in session (session storage): keeps you signed in. Your browser clears it when you close the tab, and signing out also ends the session on our server.
Quote and order access (session storage): lets you return to a quote or order you have just created.
Cookie choice: remembers whether you accepted or declined analytics cookies.

We do not use these items for analytics or advertising.

Cloudflare, which delivers the website, may set a strictly necessary security cookie such as __cf_bm to tell people from bots and protect the site from abuse.

Google Analytics

We use Google Analytics 4 to understand how the website is used, but only if you accept analytics cookies in the cookie banner. Until you do, Google Analytics is not loaded and sets no cookies.

If you accept, Google Analytics sets first-party cookies named _ga and _ga_<ID> on our domain to tell visits apart; we set them to expire after 13 months. It collects information such as the pages you view, the site that referred you, your device and browser, and your approximate location, which Google derives from your IP address. Google signals and ad personalization are always off.
We send Google only cleaned page addresses. Share links, extraction codes, order IDs, access tokens and email addresses are never sent: private pages, such as the sign-in, quote, order and download pages, and the admin area are not tracked, and query strings other than campaign tags (utm_*) are removed.
Google keeps Analytics data for the retention period set in our Google Analytics account: 2 months.
Google may process this data in the United States and other countries. See Google's privacy policy and how Google uses information from sites that use its services.

You can change or withdraw your consent at any time with the "Cookie settings" link in the site footer. If you withdraw it, we stop Google Analytics in your browser and delete its _ga cookies; data already collected is kept for the retention period above. Your choice is stored in your browser, and we ask again after 13 months.

PayPal and share buttons

On the order page, the PayPal buttons are loaded from PayPal. PayPal may use cookies and collect device information under its own privacy statement, for example to prevent fraud.

The share buttons load no code from social networks, and nothing is sent to a platform until you click its button. The platform then opens in a new window, or your device's share menu opens, and the platform's own privacy policy applies. The shared link points to the PanPull home page and carries only tags that say which share button was used, nothing about you or your order.

International transfers

PanPull's API server and database are located in the United States. The download service runs outside mainland China and stores prepared files in its own storage or in Cloudflare R2, and Cloudflare delivers the website through its worldwide network. Our providers may process data in other countries, including the United States, and the download service sends share links to Baidu in China to fetch your files.

When personal data is transferred out of the EEA or the UK, we use the safeguards that the law requires: an adequacy decision where one applies, such as the EU-U.S. Data Privacy Framework for certified providers, or otherwise the European Commission's Standard Contractual Clauses, with the UK Addendum for data from the UK, as included in our providers' data processing terms. Sending your share link to Baidu is necessary to fetch the files that you ask us to download.

How long we keep data

Prepared files: deleted from storage when the order's service period ends (currently 72 hours after the download is ready).
Account details: while your account exists. If you ask us to delete your account, we delete or anonymize your account details, except data we must keep for the reasons below.
Orders and payment records, including each order's share link, extraction code and file list, PayPal identifiers, refunds, and delivery and email records: up to 10 years after the order, as accounting and tax rules require.
Quotes that did not become orders, including their share links and extraction codes: deleted automatically 30 days after the quote expires (a quote is valid for 30 minutes).
Problem reports: deleted automatically 2 years after we receive them.
Sign-in sessions: deleted when you sign out; otherwise they stop working when they expire.
Hashed IP addresses for rate limits: short-term; expired entries are removed automatically.
Download service call log: only the most recent entries are kept, and older ones are deleted automatically.
Administrator audit log: entries are deleted automatically after 2 years.
Google Analytics data: 2 months, as set in Google Analytics.

Security

Passwords are stored only as hashes.
Share links, extraction codes and problem reports are encrypted in our database. Administrators can see share links and extraction codes when they need to fulfil an order or help with a problem.
Sign-in sessions and download access tokens are stored as hashes.
Download links are checked every time they are used.
The download service log contains no credentials or extraction codes and masks share links.

No system is completely secure. If you find a security problem, please tell us at [email protected].

Your rights

If you are in the EEA or the UK, you have the right to:

access your personal data and get a copy of it;
have inaccurate data corrected;
have your data deleted;
restrict how we use your data;
object to our use of your data based on legitimate interests;
receive the data you gave us in a portable format;
withdraw your consent at any time, without affecting earlier use (for analytics, use "Cookie settings");
complain to a data protection authority, in particular in the country where you live or work. In the UK this is the Information Commissioner's Office (ICO).

Some rights have limits. For example, we must keep accounting records even if you ask us to delete your account.

If you live in California, you have the right to know what personal information we collect, use and disclose, and to ask us to delete or correct it. We will not treat you differently for using these rights. We currently do not sell personal information and do not share it for cross-context behavioral advertising.

Wherever you live, you can ask us for a copy of your data or to correct or delete it. Write to [email protected] or use the Report a problem form. We may ask you to confirm the request from the email address on your account. We answer within the time the law requires.

Children

PanPull is not meant for children below the age of digital consent in their country, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy when PanPull or the law changes. We will publish the new version on this page with a new effective date. If a change requires your consent, we will ask for it.

Contact

PanPull (panpull.com)

Privacy questions and requests: [email protected]

For help with an order, use the Report a problem form. Please do not send passwords, extraction codes or card details.