Privacy Policy

This policy explains what Parley collects and why. Parley is used by businesses (“customers of Parley”) to talk with their own users (“end users”). For end-user data, the business that installed Parley decides what is collected and is the controller; Parley processes it on their behalf.

Account data

When you sign in with Google we receive your name, email address and profile photo from Google. We store these in your Parley profile to identify you and show you to your teammates. We do not receive your Google password.

End-user data processed for our customers

• Conversations: messages, attachments, timestamps, delivery status, internal notes and tags.
• Identity: the user id, name, email and avatar a business chooses to send with identify(), or a random anonymous id generated on the device.
• Context the business sends: custom attributes, events, app version, platform, locale and device model if supplied. Parley does not collect device data on its own.
• Telegram: the Telegram user id, first name, username and chat id of people who message a connected bot.
• Push tokens: APNs and Firebase tokens, used only to deliver replies.
• Subscription context: entitlement and product information from RevenueCat when a business connects it.

Processors

• Supabase — database, authentication and file storage.
• Railway — application hosting.
• Anthropic — generating AI replies and drafts when a business enables AI. Only the relevant documentation excerpts, recent messages in that conversation and the business's instructions are sent.
• HandyPay (with Stripe) — subscription payments. Parley never receives card numbers.
• Telegram, Apple Push Notification service and Firebase Cloud Messaging — message delivery, when the business enables them.
• Google — sign-in.

Security

Each workspace's data is isolated with database row-level security. Secret API keys are stored as hashes; integration credentials are encrypted at rest; attachments are private and served through short-lived signed links.

Retention and deletion

Data is kept while the workspace exists. Businesses can delete individual end users (and their conversations and files) from the dashboard or the server API, and can delete a workspace entirely. End users who want their data deleted should contact the business they talked to; we will help that business fulfil the request.

Cookies and local storage

The Parley dashboard uses cookies to keep you signed in. The website widget stores an anonymous id, a session token and invitation preferences in the visitor's browser storage. Parley does not use advertising trackers.

Contact

Questions about this policy: nathanjhsn@icloud.com.