Privacy

1. Our role: controller and processor

Pamweni serves two kinds of people, and our responsibilities differ for each.

For account holders — the secretaries, coordinators, and administrators who sign in and use Pamweni — we are the “controller” of the account information described below.

For members — the people whose details an organizer enters so the group can run its events — the group or organization is the controller of that information. Pamweni acts as a “processor” (or “service provider”), handling member data only on the group’s instructions to provide the service. The group is responsible for having a lawful basis and any required consent to add a member and to message them. If you are a member and want to access, correct, or delete your information, please contact your group; we will help the group respond.

2. Information we collect

We collect only what the product needs to work:

• Account and identity. When you sign in, we collect your email address (authentication is handled by Supabase Auth using a magic link — we do not store passwords), your name, and your role within a group.
• Member and contact details. Organizers enter information about their members: name and display name, phone number, email address, group role, membership dates, and — only if an organizer chooses to add them — birthdays and wedding anniversaries (month and day). Organizers may also record when a member is unavailable, including a free-text reason that can touch on sensitive matters (for example, “illness”). Please only record what your group genuinely needs.
• Messaging consent. For members who will receive event messages, we record whether and when they consented to receive them on WhatsApp or SMS, and the record of that consent (see Section 5).
• External participants. Names, a category, and optional notes for non-member participants an organizer references in an event (for example, a guest speaker).
• Content you create. Templates, events, schedules, and bulletins you build in Pamweni.
• Billing information. If you subscribe to a paid plan, our payment processor (Stripe) collects your name, email, billing address, and payment-card details directly. We do not receive or store your full card number — we keep only a Stripe customer identifier and your subscription status.
• Messaging records. Delivery logs for event messages we send on your group’s behalf (recipient, event, channel, status, and the provider’s message identifier).
• Technical and usage data. When you use Pamweni we automatically receive your IP address, basic device and browser information, and server logs. We use a strictly necessary session cookie to keep you signed in.
• Audit log. For security and accountability, Pamweni automatically records changes to data within a group — who changed what and when, including before-and-after snapshots of the changed record.

3. How we use information, and our legal bases

We use personal information to:

• provide, operate, and maintain the service (legal basis: performance of our contract with you);
• send the event invitations and reminders your group requests, to members who have consented (legal basis: consent of the recipient, obtained by the group, and our legitimate interest in operating the service for the group);
• process subscriptions and payments (legal basis: performance of a contract);
• secure the service, prevent abuse, and maintain the audit log (legal basis: our legitimate interests and, where applicable, legal obligations);
• communicate with you about the service (legal basis: legitimate interests and performance of a contract); and
• comply with applicable law (legal basis: legal obligation).

We do not use your information for advertising, we do not run third-party analytics or trackers, and we never sell your personal information.

4. WhatsApp and SMS messaging consent

Pamweni sends event invitations and reminders on a group’s behalf, over WhatsApp and (where available) SMS, only to members who have given verified consent. A member consents in one of two ways: by sending us a message themselves (for example, by tapping a click-to-chat link or scanning a code their organizer shares), or by replying to confirm a one-time opt-in request. We record that consent together with the time it was given. Members can withdraw consent at any time — by replying STOP (SMS), by replying to opt out or blocking the number (WhatsApp), or by asking their organizer to remove them — and we stop sending.

Your mobile phone number and your messaging opt-in consent are not shared, sold, or rented to any third party or affiliate for marketing or promotional purposes. Phone numbers are shared only with our messaging provider (Twilio), solely to deliver the messages you have asked to receive. Message frequency varies with your group’s event activity, and message and data rates may apply. See our Messaging Terms for the full program details. Groups using Pamweni to send messages are responsible for complying with Canada’s Anti-Spam Legislation (CASL) and other applicable messaging laws.

5. How we share information

We do not sell personal information. We share it only with service providers who process it on our behalf to run Pamweni, each under agreements that limit their use of the data:

• Supabase — database hosting and authentication (data stored in the United States).
• Resend — delivery of sign-in and service emails.
• Twilio — delivery of WhatsApp and SMS event messages.
• Stripe — subscription billing and payment processing.
• Cloudflare — application hosting, content delivery, and domain services.
• Slack — internal technical error alerts, which may incidentally include identifiers contained in an error.

We may also disclose information if required to comply with the law, to enforce our Terms, to protect the rights, safety, or property of Pamweni or others, or in connection with a merger, acquisition, or sale of assets (in which case we will require the recipient to honour this Policy).

6. AI integration (optional)

A group administrator may choose to connect a third-party AI assistant — such as Anthropic’s Claude or OpenAI’s ChatGPT — to a group, so that the assistant can read and manage the group on the administrator’s instructions. This is entirely optional.

Opt-in and off by default.No group’s data is made available to any AI assistant unless an administrator explicitly turns AI integration on in the group’s settings. It can be turned off at any time, and doing so takes effect immediately — a connected assistant loses access at once.

Data minimisation.When AI integration is enabled, an assistant receives only the group’s events, member roles, and a per-member “AI alias” — a display label that defaults to an anonymised value. An assistant does notreceive members’ legal names, phone numbers, email addresses, birthdays, or anniversaries.

Third-party processing.When enabled, the connected AI provider processes the disclosed data under that provider’s own privacy terms, at the direction of the administrator who enabled the integration. We are not responsible for an AI provider’s handling of data once it has been shared at the administrator’s direction, and we encourage administrators to review the provider’s terms before connecting.

Accountability.Every change an AI assistant makes is recorded in the group’s audit history and attributed to the AI channel, so administrators can see what was done and through which channel.

7. International data transfers

Pamweni is operated from Canada, and your information is stored and processed in the United States and other countries where our service providers operate. These countries may have data-protection laws different from those in your country. Where we transfer personal information of people in the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, or on an applicable adequacy decision.

8. How long we keep information

We keep personal information for as long as your account or group is active, and as needed to provide the service. When you delete an item in Pamweni — including a member’s roster entry or a whole group — it is first soft-deleted and can be recovered for about 30 days, after which an automatic daily process permanently removes it. Raw copies of text messages sent to our numbers (for example “JOIN” or “STOP” texts) are permanently deleted after 90 days. Audit-log entries and billing records are retained longer where needed for security, accountability, or to meet legal and tax obligations. When you ask us to delete your account or group data, we will delete or anonymize it within 30 days, except where we are required to retain it by law.

What deletion leaves behind.When personal information is erased, we redact it from historical audit records rather than deleting the records themselves, so the group’s change history stays intact without your details in it. We keep the record of messaging consent (opt-ins and opt-outs, including the phone number they relate to) because anti-spam laws require us to be able to prove that past messages were authorized. Erased data may also persist in encrypted database backups for a limited period before those backups are rotated out.

9. How we protect information

We protect data with row-level security that keeps each group’s data isolated, encryption in transit, encryption at rest provided by our database hosting provider, least-privilege access controls, and passwordless magic-link sign-in. Error notifications sent to our operations channel are automatically stripped of email addresses and phone numbers. No method of transmission or storage is completely secure, but we work to protect your information and to review our safeguards.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to restrict or object to certain processing, and to withdraw consent. To make a request, email privacy@pamweni.com. If you are a member of a group, contact your group first — they control your information — and we will assist them.

European Economic Area and United Kingdom. If the GDPR or UK GDPR applies to you, you have the rights above and the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office).

Canada. Under PIPEDA you may access and correct your personal information and may complain to the Office of the Privacy Commissioner of Canada.

California. If you are a California resident, you may request to know, delete, or correct your personal information, and you have the right not to be discriminated against for exercising these rights. We do not sell or “share” personal information as those terms are defined under California law.

11. Age requirement

Pamweni is intended for adults. The service is not directed to anyone under 18, and we do not knowingly collect personal information from people under 18. Organizers must not add anyone under 18 as a member. If you believe we hold information about someone under 18, contact us and we will delete it.

12. Cookies

We use a single strictly necessary cookie to keep you signed in. We do not use advertising, analytics, or third-party tracking cookies.

13. Changes to this Policy

We may update this Policy from time to time. We will revise the date at the top, and for material changes we will provide a more prominent notice. Your continued use of Pamweni after a change takes effect means you accept the updated Policy.

14. Contact us

For privacy questions or requests, email privacy@pamweni.com or write to NC Digital Pods Inc., 1338 Wellington Street West, Unit 10, Ottawa, Ontario, Canada, K1Y 3B7.