Privacy Policy

Pazar IP, Inc. (“Pazar,” “we,” “us” or “our”) explains in this Privacy Policy how we collect, use, disclose and protect personal information when you visit pazar-ip.com (the “Site”) or use the Pazar platform and related services (the “Service”). Your use of the Service is governed by our Terms of Service.

1. Who we are and what this policy covers

Controller. Pazar IP, Inc., 2554 Lincoln Blvd, Number 2006, Venice, CA 90291, United States, is the controller for the personal information described in this policy. Contact: [email protected].

Two roles. Pazar processes personal information in two different capacities:

• As controller, for information we decide how to use: your account and login data, billing and contract records, communications with us, information about visitors to the Site, and marketing contacts. This policy covers that information.
• As processor, for content that our business customers and their users put into the Service: deal rooms, documents, contracts, messages, approvals, signatures and audit history (“Customer Content”). For Customer Content, the customer organization (or the client it acts for, where the customer is an agency) is the controller and decides how it is used. We process it only on that customer's instructions under our Data Processing Agreement. If you have questions about Customer Content that concerns you, contact the organization you use Pazar with, typically your employer or the organization that invited you; we will support it in responding.

Business use. The Service is offered to organizations for business purposes. The people whose information we process as controller are typically employees, representatives and contacts of those organizations.

2. Information we collect

A. Information you provide directly

• Account information: name, email address, password (hashed), phone number (optional), organization and role, and authentication data such as multi-factor settings and session identifiers.
• Profile information: business, brand or organization name, role, social links, biography and other details you choose to provide. Organization profiles, listings and briefs are Customer Content (section 1).
• Communications: information in messages to us, forms, emails, surveys or support requests.
• Billing information: billing contact, subscription and invoice details, payment status and transaction references. Card and bank details are collected and held by our payment provider, not by us.
• Licensing and workflow information, documents and content: what you submit in listings, briefs, deal rooms, offers, agreements and uploads. This is Customer Content (section 1), processed for the customer organization under the DPA.

B. Information collected automatically

• Log data: IP address, browser and device type, operating system, access times, pages viewed and referring pages.
• Usage data: interactions with pages, features and forms, session duration and error logs (service telemetry).
• Approximate location: general region inferred from IP address.
• Cookies: see section 7.

C. Information from third parties

• Our service providers (for example, delivery status from our email provider or payment status from our payment provider).
• Publicly available business sources, such as company websites and professional networks, for business contacts we approach.
• Integrations your organization connects (Google Calendar, Outlook Calendar, Salesforce, Stripe Connect): the authorization granted, the identifiers of events or records we create there and, for Stripe Connect, invoice and payment status (section 4.F).
• The organization that invites you to the Service, which provides your name and email address so we can create your account.

3. How we use information, our legal bases and how long we keep it

We use personal information for the purposes below. For users in the European Economic Area, the United Kingdom and Switzerland, the table also states the legal basis under the GDPR and the UK GDPR, and the retention period. Swiss law does not require a legal basis for most private-sector processing; the purposes and retention periods apply to users in Switzerland in the same way. “Contract” means the processing is necessary to perform a contract with you or to take steps at your request before entering one. “Legitimate interest” means the processing is necessary for a legitimate interest of ours or of a third party that is not overridden by your interests or rights; you may object at any time (section 10).

Providing account information is necessary to use the Service, and billing information where your organization purchases a paid plan; without them we cannot create your account or process payments. We do not use personal information for automated decisions that produce legal or similarly significant effects on you.

4. How we disclose information

We do not sell personal information and we do not share it for third-party marketing.

A. Service providers (subprocessors). We use a small number of providers to run the Service: cloud hosting and AI processing, identity and authentication, payment processing, email delivery, edge network and application protection, and electronic signature. The current list, with each provider's location and transfer safeguard, is published at pazar-ip.com/legal/subprocessors. Each provider may use personal information only to provide its service to us and is bound by a data processing agreement. Stripe, our payment provider, also processes payment data as an independent controller for its own purposes, including fraud prevention and legal compliance, as described in Stripe's privacy policy.

B. Within the Service, based on your choices. Information in your profile, listings, briefs and deal rooms is visible to the organizations and people you share it with or, where you set a profile, listing or brief to public, to other signed-in Pazar users. Nothing is shown to visitors who are not signed in.

C. Legal, safety and compliance. We may disclose information where reasonably necessary to comply with law, regulation, subpoena, court order or governmental request; to enforce our Terms and investigate violations; to detect or prevent fraud, security or technical issues; or to protect the rights, property or safety of Pazar, our users or the public.

D. Business transfers. If Pazar is involved in a merger, acquisition, financing, reorganization or sale of assets, information may be transferred as part of that transaction, subject to applicable law and to this policy. Information received from Google APIs is transferred in such a transaction only with your explicit prior consent.

E. Aggregated or de-identified information. We may use and disclose anonymous, aggregated information that cannot be used to identify you.

F. Integrations you connect. Your organization can connect the following from its settings. Google Calendar and Outlook Calendar: Pazar writes deal milestones (deal start and end dates, royalty report due dates, approval submission deadlines) as events into the calendar you select in the connected account, and updates them when the deal changes. Pazar stores the authorization token and the identifiers of the events it created. Disconnecting in your settings removes the stored authorization from Pazar; you can also revoke Pazar's access in your Google or Microsoft account settings. Events already created remain in your calendar. Salesforce: if your organization installs Pazar's Salesforce package, Pazar sends deal status events (for example, agreement signed or expired) to your Salesforce so that the related Opportunities update; Pazar stores the API key and webhook registration your organization created. Stripe Connect: links the licensor organization's Stripe account so that royalty invoices are issued and paid through it; Pazar receives invoice and payment status from Stripe and keeps it with the royalty statements as billing records. Pazar's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Where your information is stored and international transfers

Customer data is hosted on Amazon Web Services in the European Union (Frankfurt, Germany). Identity, billing, e-signature, email delivery and edge services are provided by providers in the United States, listed at pazar-ip.com/legal/subprocessors.

Customer data is hosted in the EU and administered by our team from within the EU. Where personal information of users in the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, including the United States, we rely on the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses, supplemented by the UK Addendum or Swiss amendments where applicable. You can request a copy of the safeguards we rely on by contacting us (section 14).

6. AI processing

Some features of the Service use AI models to analyze documents, extract and summarize contract terms, assess rights and royalties, and suggest licensing partners on the basis of obfuscated attributes. This processing runs on infrastructure listed on our subprocessor page, in the European Union. Inputs and outputs are not used to train AI models.

7. Cookies

The Site and the Service use only strictly necessary cookies and similar technologies: those required to sign you in, keep your session secure and remember settings you choose. We do not use analytics, advertising or tracking cookies, and we do not need your consent for strictly necessary cookies. If we introduce cookies that require consent, we will ask for it before they are set and update this section. You can delete or block cookies in your browser settings; the Service will not work without the sign-in cookies.

8. Data retention

We keep personal information only as long as needed for the purposes in section 3, and then delete or anonymize it. Where law requires us to keep records longer (for example, tax and accounting records), we keep only what the law requires, restrict access to it and delete it when the retention period ends. Retention of Customer Content is governed by the customer organization's instructions and the DPA. Signature completion records are kept by our e-signature provider for at least seven years after signing to support the legal validity of signed documents, under that provider's retention schedule and our Data Processing Agreement.

9. Security

We maintain administrative, technical and organizational measures appropriate to the risk, including encryption in transit and at rest, role-based access on a need-to-know basis, support for multi-factor authentication, logging and monitoring, encrypted backups and contractual obligations on our providers. The measures are described in Annex 3 of our Data Processing Agreement. No system is completely secure; if we become aware of a personal data breach affecting you, we will notify you and the competent authorities where the law requires it.

10. Your rights

A. Users in the EEA, the United Kingdom and Switzerland. You have the right to:

• access the personal information we hold about you and receive a copy;
• have inaccurate information corrected and incomplete information completed;
• have your information erased, where there is no overriding reason to keep it;
• restrict processing in the situations provided by law;
• receive the information you provided to us, where we process it by automated means on the basis of a contract or your consent, in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
• object to processing based on our legitimate interests, on grounds relating to your particular situation, and object at any time to direct marketing;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement; in the UK, with the Information Commissioner's Office; in Switzerland, with the Federal Data Protection and Information Commissioner.

B. Users in the United States. Depending on your state of residence, you may have rights to access, correct or delete your personal information, to receive information about how it is used and disclosed, and to opt out of certain uses. We do not sell personal information and do not share it for cross-context behavioral advertising. If that changes, we will provide the opt-out mechanisms the law requires.

C. How to exercise your rights. Email [email protected] with the subject line “Privacy Request”, or write to the address in section 14. We may need to verify your identity before acting on a request. We respond within one month for requests under the GDPR or the UK GDPR, within 30 days under Swiss law, and within the time applicable law requires elsewhere; we will tell you if we need longer. You can also complain to us directly at the same address about how we handle your personal information: we acknowledge complaints within 30 days, look into them without undue delay and tell you the outcome. Where your request concerns Customer Content controlled by a customer organization, we will forward it to that organization and support its response.

D. Account settings and email preferences. You can update your account and profile information in your account settings, and opt out of marketing emails through the unsubscribe link in each email or by contacting us. You will still receive service and security notices for your account.

11. Children

The Site and the Service are intended for business use, and accounts are not available to anyone under 18. We do not knowingly create accounts for minors; if you believe we have, contact us at [email protected] and we will delete the account. Customer Content may include information about individuals under 18, for example talent represented by a customer in a licensing agreement; the customer organization is responsible for that information under the DPA.

12. Links to other websites

The Site and the Service may link to third-party websites and services. Their privacy practices are their own; this policy applies only to information collected by Pazar.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on the Site with a new “Last Updated” date and, for material changes, notify you through the Service or by email to the address associated with your account before the changes take effect.

14. Contact