1. Overview

Pagora ("Pagora", "we", "us", or "our") operates a multi-tenant workspace platform that lets businesses create, manage, and scale websites ,including online stores, service platforms, shipping operations, and personal brand sites. This Privacy Policy explains what personal data we collect across our marketing site and product dashboard, why we collect it, how it's shared, and the choices and rights available to you.

This Policy applies to visitors of usepagora.com, workspace owners and team members ("Workspace Users"), and end customers who interact with sites built on Pagora ("Site Visitors"). Where a Workspace User collects data from their own Site Visitors through a site they've built, that Workspace User acts as the data controller for that data, and Pagora acts as a processor on their behalf, their own privacy policy governs that relationship.

2. Information We Collect

We collect what's needed to run your workspace and sites: your account details, the content you publish, payment information (handled by our payment processor, never stored by us), and basic usage data so the dashboard keeps getting better.

Table showing categories of information collected, with examples and sources
Category	Examples	Source
Account & Workspace	Name, email, password hash, role, workspace name, team members	Provided by you
Site & Content	Pages, product catalogues, media, domain settings, theme configuration	Provided by you
Payment	Billing address, plan tier, last 4 card digits, transaction history	Our payment processor
Usage & Device	IP address, browser type, pages viewed, feature usage, crash logs	Collected automatically
Communications	Support tickets, emails, call notes, survey responses	Provided by you

We do not collect more than is necessary to provide the Service, and we never ask for sensitive categories of data (such as government IDs or health information) unless a specific feature you opt into requires it, in which case we'll tell you at the point of collection.

3. How We Use Your Information

We tell you at the point of data collection what we use it for, and we only process your data for the reasons stated below:

Table showing purposes for processing data, with examples and legal basis
Purpose	Examples	Legal Basis
Provide the Service	Hosting sites, rendering dashboards, syncing teams	Contract
Billing & Invoicing	Processing subscriptions, sending receipts	Contract
Security & Fraud Prevention	Detecting suspicious logins, rate-limiting abuse	Legitimate interest
Product Improvement	Understanding which features are used, fixing bugs	Legitimate interest
Support & Communication	Responding to tickets, sending service notices	Contract
Marketing (opt-in)	Product updates, newsletters	Consent

We never use the content of your sites or your customer data to train third-party advertising models, and we don't sell personal information to data brokers.

We share personal data only with the following categories of recipients, and only as needed to operate the Service:

Payment processors — to process subscription charges and payouts. We never store full card numbers ourselves.
Infrastructure & hosting providers — cloud compute, storage, CDN, and email delivery vendors that keep Pagora online.
Analytics & product tooling — privacy-conscious analytics tools used to understand aggregate product usage.
Professional advisors — auditors, lawyers, and accountants, bound by confidentiality.
Legal & regulatory authorities — only where required by law, court order, or to protect the rights and safety of our users.
Business transfers — in the event of a merger, acquisition, or asset sale, with notice provided beforehand.

We do not sell or rent your personal information to third parties for their own marketing purposes.

5. Cookies & Tracking Technologies

Pagora and sites built on Pagora use cookies and similar technologies for essential platform functions, analytics, and (where you opt in) marketing. The full breakdown of categories, retention periods, and your controls live in our dedicated Cookie Policy, including the live preference center where you can manage consent at any time.

6. Data Security

Security is built into the platform, not bolted on. Production data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access to customer data is role-based and logged, and every workspace is logically isolated from every other workspace.

SOC 2 Type IIGDPR CompliantISO 27001PCI DSS Level 1

7. International Data Transfers

Pagora is a global platform, and personal data may be processed in countries other than your own, including the United States and the European Union. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on recognised safeguards such as Standard Contractual Clauses or an equivalent legal mechanism, and we hold our infrastructure partners to the same security standards described in Data Security above.

8. Data Retention

We keep data only as long as we need it to provide the Service or meet our legal obligations:

Table showing data retention periods for different types of data
Data Type	Retention Period	Why
Account & workspace data	Duration of your account + 30 days	Recovery window after account deletion
Published site content	Until removed by you or account closure	You control your own content
Billing records	7 years	Tax & accounting obligations
Support tickets	3 years	Quality & dispute resolution
Server & security logs	12 months	Fraud detection, incident response

9. Your Rights

Depending on where you live, you may have the right to:

Access a copy of the personal data we hold about you.
Correct inaccurate or incomplete data.
Delete your personal data, subject to legal retention requirements.
Export your data in a portable format.
Object or restrict certain processing, including marketing.
Withdraw consent at any time where processing is based on consent.

Exercise a privacy right
Email our privacy team and we'll respond within 30 days, or sooner where legally required by law.

10. Children's Privacy

Pagora is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Policy as our Service evolves or as laws change. Material changes will be announced via email or an in-product notice at least 14 days before they take effect. The "Last Updated" date at the top of this page always reflects the current version.

12. Contact Us

If you have questions regarding this Policy or about the privacy practices of Pagora, please contact us by email at privacy@pagora.com.