Privacy Policy

Last updated: October 18, 2026 · Policy version 2026-08-05

1. Introduction

Pikaan ("we", "our", or "us") is an AI-assisted claim review service. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

2. Data processing and retention

The registry below is Pikaan’s authoritative description of the personal data used by each launch capability. We do not sell personal data. A configured provider receives only the data needed for its role in the requested service.

Account and authentication

Data: Name, email address, account role and profile settings; Password hashes, sign-in sessions and security audit metadata; IP address and device or browser metadata used for security.
Purposes: Create and secure the account; Authenticate requests and prevent abuse; Provide account support and security notices.
Provider roles: Pikaan application and database hosting; Authentication and optional social sign-in providers.
Retention: Kept while the account is open. Security and audit records may remain for the period needed to protect the service or meet legal obligations after account cleanup.
User controls: Profile correction and account-rights requests are handled through account settings or the contact form.

Verification content and results

Data: Submitted text, URLs, documents, audio and transcripts; Extracted claims, sources, analysis results and session activity; Private object-storage references and processing diagnostics.
Purposes: Run the requested fact-checking workflow; Save sessions and results for the account owner; Secure, diagnose and support the verification service.
Provider roles: Configured AI model and web-search providers; Configured speech-to-text providers; Private file storage and application hosting providers.
Retention: Submitted text, transcripts and results remain with a saved session until the user deletes that session or account cleanup completes. Temporary uploaded objects use their object-specific expiry and cleanup schedule.
User controls: Session owners can delete saved sessions. Provider processing depends on the capability and model selected for that request.

Billing and credits

Data: Subscription, invoice and payment-provider identifiers; The amount, currency, date and plan of each subscription payment, and of any refund of it; Credit transactions, usage totals and reconciliation records; Pikaan does not store full payment-card details.
Purposes: Provide paid plans, receipts and credit accounting; Prevent duplicate charges and reconcile provider events; Meet tax, accounting and dispute obligations.
Provider roles: Payment processor; Pikaan billing database.
Retention: Commercial and accounting records are kept for the period required for billing, dispute handling and applicable legal obligations.
User controls: Subscription and payment-method controls are provided through the billing surface and payment processor.

Product analytics

Data: Privacy-filtered product events, route templates and aggregate counts; An account identifier after sign-in when analytics is configured; Submitted claim text, transcripts and source text are excluded by policy.
Purposes: Understand feature reliability and aggregate product usage; Improve navigation and launch operations.
Provider roles: Configured product-analytics provider.
Retention: Pikaan keeps local analytics delivery records for 90 days. Our analytics provider manages data under its own retention and deletion rules. Our current plan makes one year of event history available. This history window is not a guarantee of permanent deletion after one year; deletion requests are handled separately.
User controls: Turn optional usage analytics off using the control below. This stops future collection but does not delete past events. Use the contact form (“Privacy or data request”) to request deletion of analytics records linked to your account.

Ad campaign tracking

Data: If you arrive through one of our ad links, we keep that ad’s code in your browser tab for up to 24 hours; If you sign up, we save the code with your account; To count what our ads bring, our own reporting service receives your account ID, your sign-up date, that code (if we saved one), your plan with its status and dates, and the amount and date of each payment and refund.
Purposes: See which ads bring customers.
Provider roles: Pikaan application and database hosting; Our own reporting service, run by the Pikaan team on Pikaan’s hosting.
Retention: The code is deleted with your account. When you delete your account, our reporting service deletes your account ID, the code and your plan. Your payments stay there only as amounts and dates, not linked to you, plus a scrambled marker so late updates about you are ignored.
User controls: We skip the code if you turned off optional analytics or your browser asks sites not to track you.

Transactional email

Data: Recipient email address and message content while delivery is pending; A keyed recipient digest, delivery state, provider receipt and safe error code after delivery.
Purposes: Send verification, recovery, security, billing and access messages; Retry transient delivery failures and diagnose non-delivery.
Provider roles: Configured transactional-email provider.
Retention: Pending message content expires after 24 hours and is removed after successful or terminal delivery. Privacy-filtered delivery receipts are retained for 90 days.
User controls: Transactional messages are limited to service, security, billing and requested account operations.

Error diagnostics

Data: Error type, approved error code, route template and runtime surface; Release identifier and random correlation identifier; Raw messages, request bodies, URLs, claim text and stack values are excluded.
Purposes: Detect and diagnose application failures; Connect a user-visible reference to privacy-filtered operational logs.
Provider roles: Pikaan runtime logging; An external error sink only after explicit configuration approval.
Retention: The built-in sink writes only privacy-filtered metadata to runtime logs, which are retained for no more than 90 days under the launch policy.
User controls: A correlation identifier can be shared with support without sending submitted content.

Access requests and support

Data: Waitlist or support email, name and message; Signed-in feedback message, feedback type, account association, reference identifier and workflow status; A redacted route, broad viewport-size hint, browser name and major version, operating system and app release recorded with feedback; never page content, query strings, the full browser identification string or fact-checking results; Only when you choose to include it, a reference to the review you were on, which the team may open to investigate your report; Your feedback conversations, meaning your messages, the team’s replies and status updates, which we keep so we can respond to you and improve the service; Decision, delivery and support-handling metadata.
Purposes: Review access requests and answer support questions; Acknowledge, triage and resolve feedback; Reproduce and fix the problems feedback reports; Maintain abuse-prevention and request audit records.
Provider roles: Pikaan access administration; Support email provider.
Retention: Kept while the request is active and for the follow-up or security period required by the owning access or feedback workflow. Stored feedback stays associated with the account and is removed when the account is permanently deleted.
User controls: Use the contact form to correct or remove an access or support request. Deleting your account removes stored feedback with it.

Contact messages

Data: Your name (optional), email address, the topic you choose and your message; A coarse browser name and major version and your operating system, and a keyed hash of your network address (never the address itself), kept only to prevent abuse; A link to your account, only if you were signed in when you wrote; A reference number, the status the team gives your message and whether the team’s email about it was delivered.
Purposes: Answer your message and any follow-up by email; Handle privacy and data requests you send; Keep the contact form free of spam and abuse, with a security check, a hidden field and limits per network and per email address.
Provider roles: Pikaan application and database hosting; Support email provider, for the team’s email and one short acknowledgement to you; The security check provider, for visitors who are not signed in.
Retention: Kept for 24 months from the day you write, then deleted automatically. Abuse-control counters are deleted within a day. The team’s email about your message stays in the support inbox until the team removes it. Deleting your account does not delete a message you sent; ask through the contact form to have it removed sooner.
User controls: Use the contact form and choose “Privacy or data request” to ask for a copy, a correction or earlier deletion of your messages. Messages you sent while signed in are also part of your account data export.

Feedback, feature requests and roadmap

Data: Your name, email address, plan and account ID; Your feedback, your contact messages, your emails to our support address, and our replies; The page you were on (without personal details) and the app version; If you link a review to a feedback message, we include that review’s ID and title so the team can open it; The ideas, votes and comments you add in the Ideas section of Pikaan, shown to other signed-in Pikaan users with your first name and last initial only; Your early-user status and perks.
Purposes: Answer your messages and fix the problems you report; Let you suggest and vote on features, and tell you when they ship; Run the early-user program.
Provider roles: Our own feedback service, run by the Pikaan team on Pikaan’s hosting; Our email provider, for replies sent from pikaan.com.
Retention: Kept while your account is open. When you delete your account, your feedback, votes, comments and early-user status are deleted. Ideas you started stay in the Ideas section without your name. Contact messages and emails to our support address are deleted after 24 months.
User controls: Delete your account, or use the contact form (“Privacy or data request”) to get a copy, a correction or an earlier deletion. You can turn off emails about shipped ideas from any of those emails or in your profile.

3. Providers and international processing

Depending on the selected capability, Pikaan uses configured hosting, storage, authentication, payment, AI model, web-search, speech-to-text, analytics, email, and runtime-logging providers. Providers may process data outside your country. Pikaan limits each provider to its documented role. Where a transfer safeguard is required, Pikaan’s launch policy requires the appropriate contract and configuration before that provider is enabled. Contact us for the current provider list that applies to your request.

Technical error reports, which contain no personal content, may be sent to our error-reporting provider so that we can find and fix what breaks.

4. Security

We implement industry-standard security measures including encrypted connections (TLS), secure password hashing, and token-based authentication to protect your data.

7. Optional Usage Analytics

Pikaan may send a small set of structured usage events through our same-site analytics proxy to our product-analytics provider’s European service. These events help us understand broad product funnels. The analytics SDK runs without analytics cookies or persistent browser identifiers, and session replay, automatic element capture, surveys, console capture, network capture, and exception capture are disabled. Fact-checking inputs, verification content, source URLs, media, transcripts, reports, and exports are not analytics properties.

You can turn optional usage analytics off quietly at any time. Pikaan stores only this on/off preference in your browser and, when you are signed in, on your account. We also honor Global Privacy Control and Do Not Track browser signals.

Privacy-safe usage analytics

Help Pikaan improve with cookieless usage events. Verification text, media, reports, and source content are never included.

Analytics are on. No analytics cookies or browser identifiers are stored.

5. Your rights

Depending on your location, you may have rights to access, correct, obtain a copy of, restrict, object to, or delete personal data, and to withdraw consent where consent is the processing basis. Account settings are not the only request path: use the contact form (choose “Privacy or data request”) to exercise a right or raise a privacy complaint.

6. Contact

If you have questions about this Privacy Policy, please use the contact form.