PABAA Privacy Policy and Personal Data Rules
Privacy built into the software
Several of these are architectural rather than promises: the software cannot collect what it never asks for.
Your database, not ours
PABAA runs on hosting you control. Customer records, orders and content live in your own database, which we cannot reach.
Consent analytics store no identity
Cookie decisions are saved as a choice, a list of categories and a time. No IP address, no browser details and no session token are kept.
Addresses hashed where possible
Where an IP is needed to rate-limit an anonymous action, only a salted hash is kept. That is enough to compare, but never enough to read back.
Deletion actually deletes
A removal request clears the record instead of just marking it hidden. When a contact is deleted in the CRM, the row is gone.
Counting needs consent
Visitor counts start only after analytics consent by default. Do Not Track and Global Privacy Control are respected, and no IP address is stored with a visit.
Confirmed sign-ups only
A newsletter sign-up counts only once it is confirmed by email. We keep the words you agreed to and the time you agreed.
Privacy by Design
Privacy is at the heart of our system. We design our software to collect only what is necessary. This means your data stays on your hosting, beyond our reach. We have no access and no copy. We believe in privacy by design, which means we never ask for data we do not need.
How we handle your data
When you interact with us, we gather minimal data. We only receive your email, license tier, and a payment reference during purchases. Your card details are never stored. Your PABAA installation collects data you configure it to store. This includes customer contacts and orders. This sits in your database on your hosting.
Our Commitment to Data Security
Security is a top priority for us. We hash passwords and use prepared statements for database queries to prevent attacks. Uploaded files are stored securely, and unauthorized script execution is blocked. These measures help protect your data from unauthorized access.
Your Rights and Control
You have full control over your data. Request a copy of your personal data, ask for corrections, or request deletion. For data in your PABAA installation, you are the controller: those requests come to you and PABAA gives you the tools to answer them. Requests to us are answered within 30 days.
Third-Party Interactions
We collaborate with trusted third parties like POK, Stripe, and PayPal for payment processing. Each operates under its own privacy terms. Our license validation process exchanges only essential information with the PABAA Master Hub. It exchanges the licence key and site domain and nothing else.
To ask about your data, open a support ticket. For background, here is an overview of information privacy.
Key takeaways
- Your data stays on your hosting, under your control.
- We collect only essential information.
- Security measures help protect your data from unauthorized access.
- You have rights to manage your data effectively.
- Trusted third parties handle payments under their privacy terms.
Frequently asked questions
Can PABAA staff see my customer data?
No, PABAA staff cannot access your customer data. The software runs on your hosting, using your database. There is no telemetry channel for customer records.
What data is sent to the AI provider?
Only the prompt and context for that specific generation are sent. Your customer list and order history are not shared with the AI provider.
How do I delete a subscriber or contact?
To delete a subscriber or contact, go to the CRM section and remove the contact. The record is permanently deleted, not just hidden.
What if I need help with privacy settings?
Our support team is ready to assist you. Open a ticket, and a team member will guide you through any privacy-related concerns you have.
Need something removed?
Send a request through support and we will confirm once it is done.