The honest version.

Beta-service disclaimer

Pengon is currently in open beta. We’re proud of what it does, but we’re also being honest about what that means while we’re still growing:

• No uptime SLA. We aim for the same edge-deployed reliability you’d expect from any Cloudflare-hosted service, but if Pengon ever becomes unreachable, your contact form keeps working - submissions fail open and reach you the same way they did before you installed Pengon.
• Classifier mistakes happen. AI spam detection is a probability game, not a perfect science. We catch the vast majority of AI-written spam, but the occasional real message will land in the Spam tab. Click Recover (not spam) and we email it to you; it takes one click.
• The product is still evolving. Features may change, ship, or be removed based on what beta customers actually need. We’ll keep you in the loop by email before anything that affects you.

What we collect

When a visitor submits a form on your Squarespace site, our worker receives the same data Squarespace already forwards to your inbox: the visitor’s name, email, phone (if present), the message text, any other answers your form asks for, and the page they submitted from. With it we keep the visitor’s browser (its user agent) and the country their IP address is in. The IP address itself is used only for rate limits and abuse checks, as a short hash. We classify the submission and store it so you can view it in your dashboard.

Pengon checks each submission before Squarespace receives it. A message we block as spam never reaches Squarespace, your inbox or anything connected to your form (Google Sheets, Zapier and the like); it’s only in your Pengon dashboard, where one click recovers it.

If you turn on visitor copies, Pengon also emails the visitor a copy of their own submission, from “your name via Pengon”, with replies going to you. Only messages that pass the spam filter get a copy, and an email address gets at most one copy a day from your site. It’s off unless you switch it on.

We also store the minimum needed to run your account: your Clerk user ID, your sign-up email, and the domain(s) of the site(s) you’ve connected.

If you pay for Pengon, by subscription or with the one-time lifetime payment, the payment is processed by Stripe. We do not store your card details - Stripe handles all card data on their PCI-compliant infrastructure. What we store on our end is the Stripe checkout session, customer and subscription IDs, the customer email and (optional) name you provided at checkout, your plan, the amount paid, and a timestamp. This is the minimum we need to grant access, issue refunds, and remit Swiss VAT.

How we use it

Your submission data is yours. We use it for exactly three things:

• Showing you your dashboard. Submissions you receive, their classification, the reasons they were flagged, the score.
• Sending recovery emails. When you click Recover (not spam), we send the original message as an email to the address on your Pengon account - this is a separate email from us, not a message put back into your Squarespace form inbox.
• Improving the spam filter, from the messages you correct. See the section below.

We never sell your submission data, use it for advertising, or let anyone train their models on it. It goes only to the service providers listed below, which process it for us.

Training examples

Pengon’s spam detection uses Jev, a classification model made by TypeSafe AI, Inc., which we reach through Cloudflare. The model is frozen and doesn’t learn from your submissions, and TypeSafe commits not to train its models on customer data. If Jev is slow or unavailable, the same check also runs on Clef, a model Cloudflare runs itself, and Cloudflare doesn’t store or train on those requests either. What we do do is keep a set of training examples that we use to test and tune Pengon’s classifier - its instructions, its thresholds and which model we run - so it gets sharper on the spam patterns Pengon customers actually see. The examples come only from messages you correct.

When you click Recover (not spam) on a flagged message - or Report spam on a message the AI let through - we keep that message as a training example. The example contains:

• The message text, with email addresses, links, phone-number patterns and the sender’s name automatically replaced with [email], [url], [phone] and [name] before storage;
• The AI’s original classification, score and reasons;
• Your verdict (“clean” or “spam”);
• A timestamp.

What an example does not contain: the name, email or phone field, the site’s domain, your user ID, the visitor’s IP or country, or any link back to your account or anyone else’s. We can’t tell which Pengon customer an example came from.

What a sender writes can still include personal details we don’t catch automatically, such as someone else’s name or a street address. So we treat the examples as personal data: they stay in our own database, are used only to test and improve Pengon’s filter, and are never shared or sold.

Why we do this. A spam classifier is only as good as the examples it’s seen. The corrections you give us are the highest-quality signal we have - cases where the AI got it wrong - and they’re what will eventually make Pengon catch more spam without misfiring on real clients. It’s the single biggest long-term investment we’re making in classifier quality.

Don’t want to contribute? Don’t click Recover or Report spam. Use the Delete button on the row instead - the submission is removed from your dashboard with no training-corpus entry created. You can also delete submissions in bulk via the checkboxes.

Cookies & analytics on this site

pengon.dev uses two privacy-friendly analytics tools. The first is Cloudflare Web Analytics, which counts page views without cookies or anything stored on your device, and without fingerprinting: which page was opened, the site that linked to it, and the visitor’s country, browser and type of device. It runs without a consent choice because it identifies no one. We use the totals to see how many people visit and where they come from.

The second is PostHog (EU). PostHog requests go through a Cloudflare reverse proxy at p.pengon.dev, which passes them on to PostHog’s EU servers, so PostHog receives them (it’s in the list below). We use PostHog to understand which sections of the landing actually help people decide - not to build ad profiles or sell anything. We don’t use advertising cookies or share data with advertising partners.

Our cookie banner is provided by Cookie-Script, a managed consent platform. PostHog does not load until you accept the “Performance” category (or click Accept All). If you reject, no PostHog script is loaded and no analytics cookies are set. If you accepted before and reject later, PostHog stops sending anything from then on. Your choice is stored by Cookie-Script in a small first-party cookie (CookieScriptConsent); clear it to see the banner again.

We’ve configured PostHog with person_profiles: "identified_only" - no person profile is created for anonymous visitors. PostHog itself is GDPR-compliant under EU hosting; see their privacy policy for details.

How long we keep things

• Submissions in your dashboard: kept for 90 days, then deleted automatically. You can delete them sooner, one at a time or in bulk.
• Security logs (rate limits, blocked requests): 90 days.
• Account info: kept while your account is active. Deleting your account (Settings → Delete my account) removes it, with your sites, submissions and billing records, straight away.
• Backups: we back the database up every night and keep each backup for 30 days, so deleted data is gone from the backups within 30 days too.
• Training examples: kept for as long as they help us improve the filter. They aren’t linked to any account, so deleting your account doesn’t remove them; to have one removed, tell us what the message said and we’ll find and delete it.

Third-party services we use

Pengon runs on Cloudflare (Workers, D1, R2, AI Gateway, Pages). Auth is handled by Clerk. Transactional emails (recovery notices, alerts, the weekly digest, trial and setup reminders and, if you turn them on, visitor copies) are sent by Cloudflare’s Email Service. Payments are processed by Stripe. Form classification is done by Jev, a model from TypeSafe AI, Inc.: the name, email and message of each submission are sent through Cloudflare’s AI Gateway to TypeSafe to be classified. If visitor copies are on, or the form has no message field, the other answers (which can include a phone number) are sent too. If Jev is slow or unavailable, they’re also classified by Clef, a model Cloudflare runs on Workers AI (that copy doesn’t leave Cloudflare), and whichever answers first is used. Each of these processes data on our behalf under their own data-processing terms; we don’t share data with anyone else.

Sub-processors at a glance:

• Cloudflare - hosting, cookie-free website analytics on pengon.dev, database, AI Gateway, Workers AI (which runs the backup classifier) and Email Service (all of Pengon’s email) (US/EU/global edge).
• TypeSafe AI, Inc. - spam classification of form submissions, reached through Cloudflare’s AI Gateway. Transfers under the EU Standard Contractual Clauses (their DPA).
• Clerk - authentication, user records (US).
• Stripe - payment processing, subscriptions and lifetime payments (US/IE).
• PostHog - website analytics on pengon.dev (only with your consent), and security events about form traffic, such as a site hitting its rate limit, with the site ID and the visitor’s country and browser but no IP address (EU).
• Cookie-Script - the cookie banner on pengon.dev, which stores your choice.
• Google Fonts - one of the typefaces on pengon.dev and in the dashboard is loaded from Google, so Google sees your IP address when the page loads.
• flagcdn.com - the small country flags on the dashboard’s Stats page are loaded from there.

If you write to us by email: Google runs our mailboxes. An AI assistant, xAI (Grok Bot), reads the emails sent to hello@pengon.dev and erkens@trypengon.com and helps us answer questions about how Pengon works and how to set it up. A person handles anything about money, complaints or your data. The assistant sees only the email you sent. It has no access to your account, your payments or the messages from your form. Google and xAI may process these emails outside Switzerland and the EEA.

B2B customers who need a signed Data Processing Agreement (DPA) can find ours at /dpa.

Your rights

You can ask us at any time to:

• Export everything we have on you (submissions, account info);
• Delete your account and all associated submissions;
• Correct anything we’ve recorded inaccurately.

Just email hello@pengon.dev. We answer as soon as we can, usually within a few working days. You can also delete your account yourself under Settings. Training examples aren’t linked to you, so we can only find one if you tell us what the message said; then we delete it.

If we emailed you about Pengon

We sometimes email agencies and businesses that use Squarespace to tell them about Pengon. If you got one of those emails, this is what we hold about you and why.

• Who is responsible: Quad Studio Gjini, Micafilstrasse 12, 8048 Zürich, Switzerland.
• What we hold: your business name, website, work email and country, the name we greeted you by, a short note on why Pengon might suit you, when we emailed you, whether you replied, and whether you clicked a link in the email or claimed your seat.
• Where we got it: public sources, such as your website and public lists of Squarespace sites and designers.
• Why we use it: to offer you something that fits your work. Our legal basis is our legitimate interest in telling businesses about Pengon.
• Who else handles it: Google runs the mailbox we write from and the spreadsheet where we keep the list. xAI (Grok Bot), an AI assistant, helps us find businesses, write the emails and keep the list up to date. If you open your seat link, Cloudflare and PostHog record that, and if you claim your seat, Clerk creates your login. Some of them are outside Switzerland and the EEA.
• How long we keep it: no more than 12 months after our last email to you, unless you become a customer.

Don’t want to hear from us? Reply to the email and say so, or write to hello@pengon.dev. We’ll stop and delete what we hold, keeping only your email address on a do-not-contact list so we never write to you again. You can also ask to see or correct what we hold, and you can complain to your data protection authority.

Plain-language disclaimer

This page is a friendly explanation of what we actually do, not a legal contract. The contract is our Terms of Service and, for business customers, the DPA. If something here is unclear or you’d like a specific question answered, please reach out.

Legal notice - who runs Pengon

Published in accordance with Swiss e-commerce disclosure requirements (UWG Art. 3 lit. s) and the equivalent EU/EEA transparency expectations.

Operator

Pengon is operated by:
Quad Studio Gjini
Micafilstrasse 12
8048 Zürich, Switzerland

Quad Studio is a Swiss sole proprietorship. The proprietor is responsible for the content of pengon.dev and the operation of the Pengon service.

Contact

Product, support, refunds, data requests: hello@pengon.dev
Business, billing, legal: info@quadstudio.ch

VAT & tax

Quad Studio is currently below the Swiss VAT registration threshold (CHF 100,000 annual turnover) and is therefore not registered for Swiss VAT. For Founding Member payments, Stripe Tax determines any applicable destination-country VAT/GST at checkout and itemises it on the receipt.

Liability for content & links

We take reasonable care that the information on pengon.dev is accurate, but make no warranty as to its completeness or fitness for any particular purpose. Liability is excluded to the maximum extent permitted by Swiss law, except in cases of intent or gross negligence.

pengon.dev contains links to third-party websites (Squarespace, Cloudflare, Stripe, Clerk and others). We have no control over their content and accept no liability for them.

Copyright & trademarks

All content on pengon.dev - text, code samples, screenshots, logos, the Pengon name and visual identity - is copyrighted by Quad Studio unless otherwise indicated. Reproduction, adaptation, or commercial use requires our prior written consent.

Squarespace is a trademark of Squarespace, Inc., used here for descriptive purposes only. Pengon is not affiliated with, sponsored by, or endorsed by Squarespace.

Governing law & jurisdiction

This notice, the website, and the Pengon service are governed by Swiss law. Place of jurisdiction: Zürich, Switzerland, subject to mandatory consumer-protection law in the buyer’s country of residence.

EU online dispute resolution

The European Commission provides an online dispute-resolution platform at ec.europa.eu/consumers/odr. Quad Studio is not obligated and does not participate in dispute-resolution proceedings before a consumer arbitration board.