PandaDoc
Legal Bases for AI
The policy does not explicitly use terms like 'AI', 'machine learning', or 'generative AI'. However, it mentions 'automated means' for content review and processing 'Usage Data' to 'improve and further develop the Services', which strongly implies the use of algorithmic or AI-like systems. It also mentions 'tailored services' and 'understanding your preferences and interests' which often involve predictive algorithms.
PandaDoc may review, either by manual or automated means, all Customer Content and reject, not post, remove, deny access to, or delete any Customer Content which breaches this Agreement.
PandaDoc owns and may process aggregated, anonymized data that cannot identify any person and is derived from or created through the use of the Services by Customer or its Users (“ Usage Data”) as it sees fit, including to improve and further develop the Services.
We have a legitimate interest in understanding our users and providing tailored services.
Automated review of customer content to detect breaches of the agreement and to reject, not post, remove, deny access to, or delete content.
PandaDoc may review, either by manual or automated means, all Customer Content and reject, not post, remove, deny access to, or delete any Customer Content which breaches this Agreement.
Understanding user preferences and interests to provide tailored services and select useful offerings.
We have a legitimate interest in understanding our users and providing tailored services.
Understanding user preferences and interests to select offerings that users might find most useful.
We have a legitimate interest in understanding your opinions, and collecting information relevant to our organization.
Processing aggregated, anonymized usage data to improve and further develop the services.
PandaDoc owns and may process aggregated, anonymized data that cannot identify any person and is derived from or created through the use of the Services by Customer or its Users (“ Usage Data”) as it sees fit, including to improve and further develop the Services.
The automated review of customer content could lead to content being rejected or removed, which is a direct impact on user-generated content. Personalization and tailored services also impact user experience. While not explicitly 'automated decision-making' with legal effects, these uses go beyond low-level background processing.
The privacy notice explicitly names Google Analytics and Looker Analytics, both provided by Google LLC, as third-party services used for collecting information about user interaction and website analytics. These services commonly employ machine learning algorithms.
The Master Services Agreement explicitly states that 'Usage Data' used to 'improve and further develop the Services' (which would include training any underlying AI/ML models) 'does not include Personal Data'. This indicates personal data is not used for this specific training purpose.
PandaDoc owns and may process aggregated, anonymized data that cannot identify any person and is derived from or created through the use of the Services by Customer or its Users (“ Usage Data”) as it sees fit, including to improve and further develop the Services. Usage Data does not include Personal Data.
The policy states that 'Usage Data' derived from the 'use of the Services by Customer or its Users' is processed to 'improve and further develop the Services'. This 'Usage Data' includes user interactions, albeit in an aggregated and anonymized form.
PandaDoc owns and may process aggregated, anonymized data that cannot identify any person and is derived from or created through the use of the Services by Customer or its Users (“ Usage Data”) as it sees fit, including to improve and further develop the Services.
The policy does not explicitly mention the use of public content for training or improving services.
The policy does not mention sharing data with third parties specifically for AI training purposes. While service providers are used, the policy states they are 'contractually obligated to use your personal information only at our direction and in accordance with our Privacy Notice; to handle your personal information in confidence; and to not disclose your personal information to unauthorized third parties.' The 'Usage Data' used for service improvement is also stated to be processed by PandaDoc itself.
Except as otherwise stated in this Privacy Notice, we do not sell, trade, rent or otherwise share for marketing purposes your personal information with third-parties without your consent.
PandaDoc demonstrates strong commitment to user rights by supporting GDPR/CCPA, providing a data request form, and a dedicated privacy email. They also state they do not sell data for marketing without consent and have not experienced a recent breach. However, the unexplained "Deterministic Score: 0/70" raises a significant concern about underlying privacy practices that contradict these positive indicators.
Recommended Actions
Users should utilize the provided data request form or privacy email to exercise their data rights, especially if they have concerns.
Review the full privacy policy to understand the scope of data collection and sharing, particularly regarding the 17 data partners.
Monitor for any further clarification or updates regarding the company's privacy practices, especially concerning the low deterministic score.