Privacy policy

panankAI is a product and service operated by Tamiliam AS, a Norwegian limited company (org. no. 937 718 772, Biskop Gunnerus' gate 14A, 0185 OSLO, Norway). “We” and “us” in this policy mean Tamiliam AS. panankAI gives businesses an AI assistant that answers their customers on channels such as Instagram, Facebook Messenger, WhatsApp, website chat and phone.

• Business customers' conversations: the business you are messaging is the data controller. Tamiliam AS acts as their data processor and processes your data only on their instructions, under a data processing agreement.
• Our own customers and website visitors: Tamiliam AS is the data controller for account data of businesses that use panankAI, and for this website.

• Messages and conversation history you send to a business through a connected channel, and the replies.
• Identifiers from the channel: e.g. Instagram/Messenger user id, name, username and profile picture as provided by Meta; WhatsApp or phone number.
• Voice calls and SMS (if the business uses AI phone answering): call audio is converted to text in real time; transcripts and text messages are stored with the conversation. If the business records calls (you are told at the start of the call), the call audio is stored encrypted with the business's own key and deleted after the period the business chose (30, 90 or 365 days); only the business's owners and admins can play it. A member of the business's staff may listen to a call while it runs and take it over.
• Customer lists the business imports (names, e-mail addresses, phone numbers, customer groups) so the assistant recognises its customers.
• Marketing and loyalty (if the business uses them): your birthday as day and month (never the year), loyalty points, a referral code, which e-mail campaigns were sent to you, and whether you unsubscribed. Marketing e-mails come from the business's own mailbox, each with an unsubscribe link.
• Job applications (if a business recruits with panankAI): your name, contact details and CV, which the business's AI assistant compares with the job's requirements (it is told to ignore age, gender, origin, religion, health and family status; people decide), the business's notes and e-mails to you. Stored encrypted and deleted at the latest 180 days after the job is closed.
• Blocked numbers and addresses: phone numbers, e-mail addresses or accounts that a business, or panankAI for every business, has blocked as spam, and a log of rejected calls.
• Consent records: whether you agreed to chat with the AI assistant, when, on which channel and which notice you saw.
• Business account data: names, emails and roles of staff users; business details and documents the business uploads as knowledge; public pages of the business website it asks us to read.
• Free website test: the website address you enter, what we read from its public pages, the questions you ask the test assistant, a hashed (not stored in plain text) IP address for abuse limits, your company name and company e-mail (we e-mail a link to confirm it before the test starts) and — if you ask the AI to call you — your mobile number, the WhatsApp code we send to confirm it, and the test call itself (handled like the business calls above, in panankAI's own workspace); and — if you choose to leave them — your name, email, phone and business name so we can contact you.
• Tutorial use (staff users of business accounts and our own team): which panankAI tutorials you open, time spent, how far you watched, whether you completed them, quiz answers and scores, checklist ticks and any training certificate issued to you (name, email, date, verification code) — used to support training and improve the material, never sold or used for advertising.
• Screen sharing with our support (business staff, only when they start it): who shared, which of our staff joined, and when. The screen picture and voices go directly between the two browsers and are not recorded or stored by us.
• Billing of business customers: in Europe businesses pay panankAI by card through Stripe — the card details are entered on Stripe's page and never reach us; we keep the payment status and Stripe's invoice numbers.
• Technical data: logs needed for security, reliability and fraud prevention.

On panankai.com we use Google Analytics 4 and Microsoft Clarity only if you click Accept in the cookie banner. They tell us which pages are visited and how (Clarity also records how the page is scrolled and clicked, with text you type masked), so we can improve the website; IP addresses are shortened, and nothing is used for advertising. Without your consent no analytics script is loaded. You can change your choice at any time under Cookie settings at the bottom of the page. The panankAI dashboard and apps use no analytics cookies — only what is needed to keep you signed in.

• To answer your questions and provide the business's customer service (on behalf of the business; its legal basis is typically your consent or its legitimate interest in answering enquiries).
• To hand conversations over to the business's staff when needed.
• To provide, secure and improve the service for our business customers (contract and legitimate interests).
• To meet legal obligations (e.g. bookkeeping, responding to authorities).

• The AI assistant always says it is an AI. Depending on the business's settings it asks for your permission first (reply YES) or tells you in its first reply.
• Write HUMAN at any time to be passed to a person, or STOP AI to switch the AI assistant off for you. Your choice is recorded.
• The AI answers from information the business has provided. It may make mistakes; important matters are handed to staff.
• We do not use your conversations to train our own AI models. AI providers we use process data under data processing terms.

Only service providers needed to run panankAI, under data processing agreements:

• Cloud hosting and database: Google Cloud
• Network security and delivery: Cloudflare (also relays screen-sharing connections that can't go directly between two browsers, without storing them)
• Card payments of business customers to panankAI (Europe): Stripe
• Website analytics (only with your consent): Google (Analytics) and Microsoft (Clarity)
• Push notifications to the panankAI apps of business staff: Google (Firebase Cloud Messaging) — a short notice and a link inside the app, never message content
• Messaging channels: Meta Platforms (Instagram, Messenger, WhatsApp)
• AI language models: OpenAI and Anthropic; OpenAI also draws images for a business's posts when it asks for one, creates the search index of the business's own knowledge (embeddings) and transcribes the audio of our own tutorial videos when we generate subtitles
• Speech recognition and AI voices: Sarvam AI (India) and ElevenLabs
• Telephony and SMS: Vobiz (India) and Tismi / LINK Mobility (Europe) — always the business's own number with the provider
• E-mail: the business's own mailbox provider, when the business connects its e-mail

Where data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Where data is stored. Each business chooses a data region when it signs up. Businesses in India are hosted in Google Cloud in Mumbai (asia-south1), with backup copies in Delhi (asia-south2); all others in Google Cloud in Finland (europe-north1), with backup copies in the Netherlands (europe-west4). Stored data stays in that region. To deliver and answer messages, they pass through our network provider and are processed by the service providers listed above, which may be in other countries.

Conversation data is kept for as long as the business keeps its panankAI account or until the business deletes it or you ask the business to delete it. Access tokens for connected channels are deleted immediately when a channel is disconnected or the app is removed. Free website tests stop working after 72 hours; contact details you leave are kept until you ask us to delete them or we no longer need them for sales follow-up. Tutorial use data is kept for 24 months. Logs are kept for a limited time for security purposes.

When a business removes its account, its data is locked at once and permanently destroyed after 90 days (its encryption keys are deleted, which makes the data unreadable). Backups taken before that still hold the keys until the backups themselves expire — they are kept for up to 30 days and are only ever used to restore our service — so the data is gone everywhere at most 30 days after the deletion. Copies of incoming messages kept for technical reliability are deleted after 30 days.

Each business's data is strictly separated at database level. Message content, customer names and contact details, and channel identifiers are encrypted with a key that belongs to the business, protected by Google Cloud Key Management in the business's region; channel access tokens are encrypted too. Connections use TLS. Webhooks from Meta are verified with signatures. Only the business's own staff, by their role, and authorised panankAI staff who support that business can access its data; access is role-based and logged.

You have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent at any time. For conversations with a business, contact that business — or us at [email protected] and we will forward and assist. You can complain to the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.

To remove the data we hold because you connected a Facebook Page or Instagram account, see Data deletion.

panankAI is not intended for children under 13, and businesses must not use it to target children.

We will update this policy when our processing changes and show the new effective date above. Questions: [email protected].