Privacy
Policy.

This Privacy Policy describes how Turbo AI, Inc. (d/b/a Palo Alto Collaboration Company, "PACO", "we", "us") collects, uses, discloses, and protects personal information when you use Pana, our AI-powered personal assistant (the "Service"). Please read this Privacy Policy carefully before using the Service.

By creating an account or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, do not use the Service.

This Privacy Policy is incorporated by reference into the Pana Terms of Service. Capitalized terms used but not defined in this Privacy Policy have the meanings given in the Terms of Service

1. Who we are

Pana is a personal operating-system product built by PACO.

For purposes of this Privacy Policy, PACO is the controller of personal information collected through the Service. The Service is offered only to residents of the United States who are 18 years of age or older. By using the Service, you acknowledge this Privacy Policy. If you do not agree, do not use the Service.

Controller: Turbo AI, Inc., 5432 Geary Blvd #566, San Francisco, CA 94121

Privacy contact: support@turbotime.io

Legal counsel of record: Cedar Grove LLP

2. Summary

We built Pana as your personal operating system. The shape of the product determines the shape of this policy:

• Each user gets their own isolated server. Your conversations, files, API keys, and personal context live there — not in a shared PACO database. We do not pool user content centrally.
• A few things are strictly private. Personally identifiable information, content you upload, payment details, and the API keys you connect are private to your instance. We do not read them, train on them, or share them.
• A few things we must collect to operate. How many users we have, how much each is using, which packages are loaded, and when errors occur. These are event-based — we see that something happened, not what you said.
• We never sell your data. We never share it with advertisers. Sub-processors only see what they need to deliver the service.
• You can leave. Export your data, delete your instance, and we will destroy it within 30 days of confirmation.

This summary is provided for convenience only. In the event of any conflict between this summary and the sections below, the sections below control.

3. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above. Material changes — including any change to how we categorize the data we collect in §4, the addition of a new sub-processor that processes content, or any change to our LLM sub-processor and training stance in §6.5 — will be notified at least 30 days in advance via email and in-app notice. Non-material changes (typos, formatting, contact updates) take effect on posting. Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acknowledgment of the updates.

4. Data we collect

This section is the operative privacy commitment. The rest of the policy refines it.

4.1 Information provided to set up your account

We collect the information needed to create and personalize your Pana account. This may include:

• Contact and account details such as name and email.
• Basic professional information such as role, company, and a public profile link, used to personalize your account.
• Publicly available information referenced from a public profile link, where provided.

You can review, edit, or remove this information at any time.

4.2 Information you provide that's strictly private (we do not read or train on)

These live exclusively on your Pana instance. PACO employees do not access them as part of normal operation. Access for support purposes is governed by §9.

4.3 Required operational telemetry (event-based, no content)

We collect the minimum data required to operate, bill, and support the service. This is not opt-out outside specific jurisdictions.

These are sent as events — a structured signal that something happened, not a copy of what was in your conversation. We do not read message bodies, file contents, or API key values to produce this telemetry. If you install and enable the Agent, we additionally collect event-level metadata about the Agent’s local device operations, including: file system interaction events (such as file creation, modification, or deletion events, directory paths, and file types, but not file contents); application launch and interaction events; script and code execution events; Agent session duration and frequency; and the identity of API endpoints called by the Agent (but not the content of those requests or responses, except as necessary to perform your instruction). This operational data is event-based only and does not include the contents of your files, documents, or communications. As between you and PACO, PACO owns all de-identified and aggregated operational telemetry and Usage Data (as defined in the Terms of Service) derived from your use of the Service, including telemetry described in this §4.3. PACO will not attempt to re-identify any individual from such data and will implement reasonable technical measures to prevent re-identification.

4.4 Communications

When you contact us directly, we may receive personal data about you, such as your name, email address, message contents and attachments, and, if you join a live collaboration session, we do not retain the raw audio or screen recording, but we may generate and retain a text transcript of the conversation for support, quality, and record-keeping purposes. When you sign up for news and updates, we will collect your email address and any other data you share. When you communicate with us online, our third-party vendors may receive and store these communications on our behalf. Our emails may include tracking pixels to track information about how you interact with our emails, such as whether you open them and whether you access any included links, your approximate Location Information (described below) based on your IP address, and Device Information (described below), to improve our website, products, and services.

5. How we use that data

We use the data described in §4 to:

• Deliver, secure, and bill the Service, including provisioning and operating your Pana instance.
• Process payments and manage your Subscription, including billing, invoicing, refunds, and dispute resolution.
• Communicate with you (transactional, account-related, and — where you have consented — marketing communications), and respond to support requests.
• Maintain the security and integrity of the Service, including detecting, preventing, and responding to fraud, abuse, security incidents, violations of the Terms of Service, and other harmful activity.
• Improve and develop the Service (troubleshooting, debugging, performance monitoring, analytics, internal research, product development) — using only operational telemetry (§4.3) and deidentified or aggregated information.
• Comply with our legal obligations, respond to lawful requests from public authorities, and exercise or defend our legal rights.

We do not:

• Sell your data.
• Share your data with advertisers or data brokers.
• Use your conversations, files, or Connected Account content to train foundation models or any PACO-owned model. (See §6.5.)
• Read your conversations except in the narrow circumstances described in §9 and §11.

We may also create and use deidentified or aggregated information that cannot reasonably be used to identify you or any other individual. We maintain and use deidentified information without attempting to reidentify it, except solely to verify the adequacy of our deidentification process. As between you and PACO, PACO owns all de-identified and aggregated data and operational telemetry derived from your use of the Service (“Usage Data”), including the data described in §4.3. Usage Data does not include the contents of your conversations, files, or communications. PACO may use, disclose, and exploit Usage Data for any purpose, including operating, improving, and developing the Service. PACO will implement and maintain reasonable technical and organizational measures to prevent Usage Data from being used to identify any individual user, and will require any third party to whom PACO discloses Usage Data to maintain the same standard.

6. Connected Accounts and Agentic Actions

6.1 Scope of access

When you connect a third-party service to Pana, we receive only the access scopes you authorize through that service's authentication flow. We do not request more access than is necessary for the features you have enabled. You may revoke our access at any time, including through the App settings or through the third-party service's own controls. Revocation does not affect information we have already received and processed. Information already received and processed in connection with the Service will be retained in accordance with our retention practices described in §7, unless you separately request deletion of that information as described in §12.3.

6.2 Use of Connected Account Data

We use information from your Connected Accounts solely to provide the Service to you, including to (a) fulfill your instructions, (b) generate Outputs in response to your Inputs, (c) perform Agentic Actions you have authorized, and (d) maintain the security and integrity of the Service. We do not use information from your Connected Accounts for advertising, for profiling for third-party use, or to train or improve any AI model. We do not allow humans to read information from your Connected Accounts except in narrow circumstances: investigating suspected abuse, addressing a technical support request you submit, complying with applicable law, or with your express consent. Automated processing of Connected Account data by AI models to fulfill your instructions is described in §6.5.

6.3 Google API Services User Data Policy

Pana's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. With respect to information obtained from Google services (including Gmail, Google Calendar, Google Drive, and other Google APIs you connect to Pana), we:

• (a) use that information only to provide or improve user-facing features of the Service that are prominent in the requesting application;
• (b) do not transfer that information to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users;
• (c) do not use that information for serving advertisements; and
• (d) do not allow humans to read that information unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or for our internal operations and even then only when the information has been aggregated and anonymized.

6.4 Agentic Actions

When the Service performs Agentic Actions on your behalf in a Connected Account or other third-party service, we transmit the information necessary to perform the action (for example, the contents of an email Pana sends for you, or the parameters of a calendar event Pana creates). Information transmitted to a third-party service in connection with an Agentic Action becomes subject to that service’s privacy practices once received. You are solely responsible for the consequences of Agentic Actions performed within the scope of your authorization, whether in a Connected Account, a third-party service, or on your device, as described in the Terms of Service. You are responsible for understanding and complying with the terms of service of any third-party service you authorize Pana to access or interact with. We are not responsible for any suspension, restriction, or termination of your access to a third-party service resulting from Pana's actions in that service at your direction, and we are not responsible for any claim by a third-party service arising from information Pana transmitted to or actions Pana took in that service at your direction.

6.5 LLM sub-processors

To generate Outputs, the Service sends your Inputs and, where relevant, content from your Connected Accounts to large language model providers. Pana supports two modes for how those requests reach a model provider, and the sub-processor relationship differs accordingly.

1. PACO-routed model access. In the default mode, Pana routes your requests to the model providers PACO has contracted with (currently including Anthropic and OpenAI; see §10). For our primary language model providers (currently Anthropic via the Anthropic API and Amazon Bedrock), we use zero-retention API tiers under contractual terms that prohibit those providers from using the data we send to train or improve their models, and that do not retain your inputs or outputs beyond what is required to return a response. Certain specialized model services, including voice processing (currently OpenAI) and image generation (currently Nano Banana), may operate under different terms that permit limited data retention by those providers for operational or safety purposes. A current list of our sub-processors and their applicable data practices is available at turbotime.io/sub-processors.

2. Bring your own key or subscription. Where you configure Pana with your own API key or subscription for a third-party model provider, your Inputs and any Connected Account content included in the request are sent directly from your Pana instance to that provider under your own account and under that provider's terms of service and privacy practices. In this mode data goes directly from the customer to the model provider; PACO does not process or store it. Provider keys you supply are stored on your Pana instance and used only to make requests you initiate.

7. Storage, retention, and deletion

7.1 Where it lives

7.2 Retention criteria

The criteria we use to determine retention periods include: (a) the duration of your active use of the Service; (b) the category and sensitivity of the information; (c) the purposes for which the information was collected and whether those purposes can be met by other means; (d) our legal, tax, and regulatory obligations; and (e) the existence of any actual or anticipated dispute or investigation.

7.3 Deletion after termination

Following termination of your Account, we will retain your Pana instance and your Inputs / Outputs for thirty (30) days to allow you to export using the export tools we make available. After the export period: (a) your Pana instance is decommissioned and its disks wiped; (b) operational telemetry is anonymized within 90 days; (c) billing records are retained as required by law. Residual copies may persist in routine backups for limited additional periods, after which they will be overwritten or deleted in the ordinary course.

7.4 Backups and system logs

We maintain operational backups and system logs that may include limited information necessary to restore service, diagnose issues, and detect abuse. These backups and logs are retained for limited periods consistent with their operational purpose and are then deleted or further isolated from active systems.

8. Security

Network. Single hardened entry point; instances are not exposed to the public internet directly.

Access control. Production access today is restricted to a single named PACO operator via a single allow-listed IP and SSH. Expansion of this list requires written change control.

In-transit encryption. TLS for all client-instance traffic.

Sub-processor security. We require SOC 2 / ISO 27001 or equivalent posture from production sub-processors (§10).

Incident response. We will notify affected users without undue delay and within statutory windows, as set forth below.

We do not promise that no breach is possible. We promise that the architecture limits blast radius (per-instance isolation), and that only a single operator has production access today. You are responsible for keeping your Account credentials confidential and for promptly notifying us of any actual or suspected unauthorized access to or use of your Account.

In the event of a security incident involving unauthorized access to or disclosure of your personal information, we will notify affected users without undue delay and within the timeframe required by applicable law. Notification will be provided by email to the address associated with your Account or by prominent notice in the App, and will include, to the extent permitted by law and reasonably available at the time of notification: a description of the nature of the incident; the categories of information involved; the steps we have taken or are taking to address the incident; and steps you can take to protect yourself. We will cooperate with applicable law enforcement and regulatory authorities in connection with any security incident.

9. Customer support and PACO personnel access

Some support tasks require an authorized PACO operator to connect to your Pana instance — for example, restoring service after a crash or applying a critical patch.

A single named PACO operator (per §8) can SSH to instances. The operator can read logs and operational state. Conversation content and file contents are not part of routine support and are not extracted.

You can request a support session with restricted access. Contact support@turbotime.io.

No "shoulder-surfing." We will not silently observe an active session. Any troubleshooting that requires reproducing a behavior will be coordinated with you.

10. Sub-processors

Pana is delivered with the help of third-party sub-processors. A current list of those sub-processors, their role, and the region in which each operates is maintained at turbotime.io/sub-processors. The list is not exclusive: we may add, remove, or substitute providers (in particular, foundation model providers) as the model and infrastructure landscape evolves. We will keep that page up to date and notify users of material changes per §3.

We share information with the following categories of recipients, in each case subject to obligations consistent with this Privacy Policy: sub-processors and service providers (see §10), Connected Accounts you authorize, our corporate affiliates, professional advisors (accountants, auditors, lawyers), legal and safety recipients (government, law enforcement, courts where required by law), parties to a corporate transaction (with notice), and other parties to whom you direct us to share your information.

We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising.

11. Legal disclosure and law enforcement

We will disclose information only when required by valid legal process and only to the extent we have it.

An important architectural note. Because we do not centrally store user conversations or files, we cannot produce them from PACO's own systems in response to a subpoena directed at PACO. We can produce: account metadata, operational telemetry (§4.3), and billing records. We do not centrally store your conversation content, files, or Connected Account data. Those live on your dedicated Pana instance.

To the extent PACO has the technical ability to access or assist in the production of data stored on your Pana instance, which depends on the security configuration in place at the time, we will comply with valid legal process requiring us to do so. Where we lack the technical means to produce specific data, we will inform the requesting authority accordingly.

We will, where permitted by law, notify you of legal requests targeting your account or instance before complying.

12. Your privacy rights — California and other U.S. state disclosures

This section supplements the rest of this Privacy Policy and applies to residents of California and other U.S. states with comprehensive consumer privacy laws applicable to PACO. References to "personal information" include "sensitive personal information" as those terms are defined under the applicable state law.

12.1 Categories of personal information collected

In the preceding 12 months, we collected the following categories of personal information, for the purposes described in §5, from the sources described in §4 and §6, and disclosed those categories to the recipients described in §10:

12.2 Your rights

Depending on your state of residence, you may have the rights to:

• Know / access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account and information, subject to applicable exceptions (including information necessary to complete a pending transaction, detect or prevent security incidents, comply with a legal obligation, or exercise free speech or other rights provided by law).
• Portability — receive a copy in a portable format.
• Opt out of "sale" or "sharing" for cross-context behavioral advertising. (We do not sell or share for cross-context behavioral advertising.)
• Limit use of sensitive personal information. (We do not use sensitive personal information for purposes that would require offering this right.)
• Non-discrimination for exercising privacy rights.
• Appeal if we deny your request. If we deny your privacy rights request, you may appeal by emailing support@turbotime.io with the subject line “Privacy Request Appeal” and a description of the request we denied. We will respond to appeals within 45 days of receipt. If your appeal is denied, you may lodge a complaint with your state’s privacy regulator.
• Lodge a complaint with your state's regulator.

12.3 How to exercise your rights

Email support@turbotime.io or submit a request through the App settings. We will need to verify your identity before responding (typically by confirming the email address associated with your Account). We will respond to verifiable requests within the time period required by applicable law (generally 45 days, with the possibility of one extension). You may designate an authorized agent to make a request on your behalf; we will require proof of authorization. Please note that most of your personal content, including conversations, files, and Connected Account data, is stored on your dedicated Pana instance and is accessible to you directly through the Service. A right-to-know request to PACO will produce the information PACO holds centrally, but not the contents of your Pana instance, which you control directly and that PACO does not otherwise have access to.

12.4 AI training opt-out

We do not use your Inputs, Outputs, or Connected Account content to train our or our sub-processors' AI models.

12.5 Marketing communications

You can opt out of marketing emails via the unsubscribe link in any marketing email, and out of marketing push / SMS through App or device settings. We may continue to send transactional, account-related, and service-related communications.

12.6 Other state residents

If you are a resident of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or another state with a comprehensive consumer privacy law applicable to PACO, you may have rights similar to those described above. To exercise your rights, contact us at support@turbotime.io.

12.7 California "Shine the Light"

California Civil Code § 1798.83 permits California residents to request information regarding our disclosures of personal information to third parties for those third parties' direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

13. Sensitive data and health information

The Service is not designed to receive or process protected health information regulated under HIPAA, education records subject to FERPA, financial account information regulated under GLBA, biometric identifiers regulated under state biometric privacy laws (including BIPA), or other categories of regulated sensitive data. As stated in the Terms of Service, you agree not to submit such data to the Service. We are not acting as a HIPAA business associate, a regulated consumer health data controller (under the Washington My Health My Data Act, Nevada SB 370, or similar laws), or a financial institution under GLBA, and the safeguards those laws would otherwise require may not apply to information you submit to the Service. If you choose to submit regulated sensitive data to the Service despite this prohibition: (a) you do so at your sole risk; (b) you assume all legal, regulatory, and financial consequences of such submission, including any liability to third parties or regulatory authorities; (c) PACO disclaims all liability arising from the receipt, storage, processing, or disclosure of such data; and (d) you agree to indemnify the PACO Parties for all claims, penalties, and losses arising from your submission of such data. You acknowledge that the Agent’s access to your files and Connected Accounts may result in the incidental processing of regulated sensitive data (such as health information in emails or financial data in documents) as part of fulfilling your instructions. We do not intentionally collect, use, or retain such incidentally accessed sensitive data for any purpose other than fulfilling your specific instruction, and we do not treat ourselves as a regulated handler of such data solely because it was incidentally accessed in the course of performing an Agentic Action you authorized. Where you configure User Integrations, including messaging applications such as WhatsApp or iMessage, those integrations may expose the Service to sensitive personal data of third parties (including contacts and message content). You are solely responsible for ensuring that your configuration and use of User Integrations complies with all applicable privacy laws and the privacy rights of any third parties whose data may be accessible through those integrations.

14. United States only; no international use

The Service is offered only to residents of the United States. We do not direct the Service to, and do not knowingly collect personal information from, individuals outside the United States. If you are located outside the United States, please do not use the Service. Your Pana instance is hosted on infrastructure located in the European Union (currently Germany); by using the Service, you acknowledge that your data will be stored on EU-based infrastructure operated on PACO’s behalf pursuant to an Article 28-compliant data processing agreement with Hetzner Online GmbH.

15. Children's privacy

Pana is for users 18 years of age or older. We do not knowingly collect information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it. Parents or guardians who believe a child has provided information may contact support@turbotime.io.

16. Cookies and similar technologies

Pana is delivered primarily through the App. We and our service providers use mobile SDKs, push notification tokens, device identifiers, and similar technologies to operate, secure, and analyze use of the Service. We do not use these technologies for third-party advertising or for cross-context behavioral advertising. You can control device-level identifiers and notification permissions through your device settings. We recognize and process the Global Privacy Control (GPC) opt-out signal. Because we do not sell personal information or share it for cross-context behavioral advertising, a GPC signal does not change our data practices in any substantive way. We record GPC signals we receive and treat them as a standing do-not-sell and do-not-share request for purposes of applicable state privacy laws.

17. Business transactions

If PACO is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, your information may be disclosed to and transferred to the prospective or actual counterparty as part of the diligence process or transaction. We will require the recipient to honor commitments consistent with this Privacy Policy with respect to your information, and we will notify you of any material change in how your information is handled.

18. Contact

support@turbotime.io

Mailing address: 5432 Geary Blvd #566, San Francisco, CA 94121