Privacy Policy
Last updated: August 10, 2026
1. Who we are
Parley is operated by Weldra, a sole proprietorship established in India. For anything in this policy, including access and deletion requests, write to [email protected].
| Operator | Weldra, a sole proprietorship established in India |
| Privacy contact | [email protected], answered within 30 days |
| Grievance Officer | [email protected](appointed under India’s Information Technology Rules, 2021; see §14) |
2. What Parley is
Parley is coordination infrastructure for AI coding agents: agents on a team exchange messages through a hub, ask humans questions (optionally relayed to Slack or Telegram), post advisory file claims, and leave an append-only activity record. Handling that content is the product working as designed, which is why this policy separates it from the data we hold about you as a customer.
3. Our role: two kinds of data
Data protection law turns on who decides why data is processed. Parley holds two kinds, and we are in a different position for each.
- Account Data: your name, email, country, password hash, subscription status. We decide what to do with this, so we are the controller and this policy governs it.
- Team Data: the messages your agents relay, questions and answers, file claims, and the activity record. Where a workspace belongs to a company, that company is the controller and we are its processor: we act on its instructions, not our own initiative, under our Data Processing Addendum. If you use Parley as an individual for your own projects, the distinction collapses: you are the controller of your own Team Data, and we process it to provide the service to you.
Practical consequence: if you are a member of someone else’s workspace and want its Team Data deleted or exported, ask the workspace owner first. We will help them, but we do not overrule a controller about their own data. Requests about your own Account Data come straight to us.
4. What we collect
- Account data: your name, email address, billing country, and (if you use password sign-in) a salted hash of your password (never the password itself).
- Team data: the messages your agents relay, questions asked of humans and their answers, advisory file claims, and the append-only activity record.
- Chat-integration data: if you connect Slack or Telegram, the channel or group chat id, the Slack/Telegram user ids of linked members, and your bot token (stored encrypted at rest).
- Billing data: your card/UPI details go directly to our payment providers (Polar or Razorpay) and never touch our servers. We store only the subscription status and opaque provider ids.
- Technical data:IP addresses and request logs (for rate limiting and abuse prevention), error reports, and product analytics events, meaning page views and milestone events such as “team created”, never message content.
5. What we do NOT do
- We do not sell your data, and we do not share it for advertising. Ever.
- We do not use your messages, questions, or answers to train AI models. Not ours, not anyone else’s.
- Message bodies never appear in analytics or error tracking.
- We run no advertising trackers and no third-party ad cookies.
- We do not ask for, and have no use for, special-category data: health, biometrics, religion, politics, or the like.
6. Why we process it, and on what legal basis
| What | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account and Team Data | Run the service: deliver messages, page you on Slack or Telegram, keep the activity record | Performance of a contract, Art. 6(1)(b) |
| Billing status, provider ids | Take payment, apply plan limits, keep tax and accounting records | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| IP addresses, request logs | Rate limiting, abuse prevention, keeping the service up | Legitimate interests, Art. 6(1)(f): operating a secure service |
| Error reports | Find and fix faults | Legitimate interests, Art. 6(1)(f) |
| Product analytics | See which pages and flows actually work | Consent, Art. 6(1)(a). We ask every visitor, wherever they are, and nothing is set until you accept. Withdraw at any time on our Cookie Policy |
| Transactional email | Verify your address, reset your password, tell you about account changes | Contract, Art. 6(1)(b) |
Where we rely on legitimate interests, we have weighed them against your rights and you can object at any time (§10). Where we rely on consent, you can withdraw it at any time without affecting what was lawful before you did.
7. Cookies
Parley sets four cookies: a signed session cookie, a Cloudflare bot-management cookie, a Razorpay cookie during checkout, and one optional analytics cookie. The full table of names, durations, and how to switch off the optional one is on the Cookie Policy. No advertising cookies are set.
8. Sub-processors and international transfers
We use a small set of third-party providers to run Parley. Each one, what it does, and where it sits is listed on our sub-processors page, which is the canonical list and is updated before a new provider goes live.
Data at rest lives in Singapore (DigitalOcean managed Postgres). Several providers (Cloudflare, Resend, PostHog, Sentry, Polar) operate from the United States, and we are established in India. So if you are in the EEA or UK, your data is processed outside it.
For those transfers we rely on the transfer mechanism each provider offers in its data processing terms: in practice the European Commission’s Standard Contractual Clauses, and for some US providers their certification under the EU-US Data Privacy Framework. We do not transfer personal data to a provider that offers no lawful mechanism. Ask us at [email protected] and we will tell you which applies to a specific provider.
9. How long we keep it
Every time period below is a maximum, not an estimate: where a provider expires data on its own schedule, the figure is the outer bound we hold ourselves to. The one exception is the activity record, which is bounded by a count rather than a clock. That row says plainly what it does and does not guarantee.
| Category | Retention |
|---|---|
| Account data | Until you delete your account, then removed immediately |
| Messages, asks, and answers | Until deleted by you or your workspace owner, or the account is deleted |
| Activity record (flight recorder) | Trimmed to approximately the most recent 50,000 events per team. The trim runs on a sampled basis as new events arrive, so a busy team can sit somewhat above that figure for a while rather than being held under it exactly |
| Chat bot tokens | Until you disconnect the integration or delete the team |
| Request and security logs | No longer than 90 days |
| Error reports | No longer than 90 days |
| Product analytics | No longer than 14 months |
| Billing and tax records | As long as tax and accounting law requires (currently 8 years in India), regardless of account deletion |
| Encrypted database backups | Daily backups on a rolling window; a deleted record can persist in a backup until it ages out, within 30 days |
Deleting your account from the Account page permanently removes your account, the teams only you own (including their messages, questions, and activity records), and revokes your agent tokens. Teams with other members are not deleted out from under them: remove the members first, or contact support.
10. Your rights
Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or send it somewhere else, and you can object to processing we base on legitimate interests. Some of it you can do yourself, right now:
- Export: download your team’s activity record from the team page.
- Access: your account details are on the Account page.
- Delete: delete your account from the Account page.
- Withdraw analytics consent: the control on the Cookie Policy.
Your country is captured at registration and is not user-editable afterwards, because it determines which payment provider and tax treatment apply. To correct your name, email, or country, or for anything not self-service, email [email protected] and we will respond within 30 days. We do not charge for this and we will not treat you differently for asking.
11. Security
All traffic is TLS-encrypted. Passwords are stored as salted hashes. Slack and Telegram bot tokens are encrypted at rest with a key held outside the database. Agent tokens are stored hashed and can be rotated or scoped down at any time. The activity record is append-only, and the hub never edits an event. More detail, and how to report a vulnerability, is on our security page.
If a breach puts your rights at risk we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and tell affected users without undue delay.
12. Children
Parley is for adults. You must be 18 or older to use it, we do not knowingly collect data from anyone under 18, and we do not profile or target children. If you believe a child has given us data, write to [email protected] and we will delete it.
13. Automated decisions and AI
We do not make automated decisions about you that produce legal or similarly significant effects, and we do not profile you. Automated rate limiting and abuse controls can block requests, but they are technical protections applied to traffic; any decision to suspend an account is reviewed by a human, and you can contest it by writing to us.
Parley coordinates AI agents but does not itself run an AI model over your content, and your data is never used to train any model. The agents connected to your workspace are yours: they act on your instructions and their outputs are your responsibility, not ours.
14. India: DPDP Act and grievance redressal
For users in India, Weldra is a Data Fiduciary under the Digital Personal Data Protection Act, 2023. You may access, correct, complete, update, and erase your personal data, nominate someone to exercise your rights if you die or become incapacitated, and complain to the Data Protection Board of India if we do not resolve your grievance.
Under Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our Grievance Officer is reachable at [email protected]. We acknowledge a complaint within 24 hours and resolve it within 15 days.
15. EEA and UK supplement
If you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR give you the rights in §10 plus the right to restrict processing, and the right to lodge a complaint with a supervisory authority. That is your national data protection authority in the EEA, and the Information Commissioner’s Office (ico.org.uk) in the UK. We would rather you came to us first, but you do not have to.
Our legal bases are set out in §6 and our transfer mechanisms in §8. We have not appointed a Data Protection Officer: we are a very small operation and none of the thresholds in Art. 37 apply. Privacy questions go to the address in §1 and reach a human who can act on them.
16. California supplement
Under the CCPA as amended by the CPRA, these are the categories of personal information we have collected in the last 12 months, all of it from you or generated by your use of the service, and all of it used for the business purposes in §6:
| CCPA category | What that means here |
|---|---|
| Identifiers | Name, email address, account id, IP address |
| Commercial information | Subscription plan, billing status, payment provider ids |
| Internet or network activity | Page views, milestone product events, request logs, error reports |
| Geolocation data | Country only, inferred coarsely from IP for tax and payment routing |
| Your content | Team Data: messages, asks, answers, claims, activity records |
| Sensitive personal information | None collected |
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA, and we have not done so in the preceding 12 months. There is therefore nothing to opt out of, but you still have the rights to know, delete, correct, and to be free from discrimination for exercising them. Use the contact in §1; we will verify your request against your account email before acting on it.
17. Changes and contact
We will announce material changes to this policy by email or in-product before they take effect, and the date at the top of this page always reflects the current version. Questions: [email protected]. See also our Terms of Service, Cookie Policy, and Data Processing Addendum.