Privacy Policy

This Privacy Policy explains how Parlyo collects, uses, stores, and protects personal data when you visit our website, create an account, upload content, or use our AI-powered services.

This document is provided for transparency and product readiness. It should be reviewed by qualified legal counsel before broad commercial launch.

1. Who we are

Parlyo provides software that helps users and organizations transform audio, video, messages, classes, talks, and teachings into transcripts, summaries, study materials, newsletters, social content, and searchable knowledge.

For account, billing, and platform administration data, Parlyo generally acts as a data controller. For audio, video, transcripts, generated content, and organization workspace content uploaded by customers, Parlyo generally acts as a processor on behalf of the customer organization.

2. Data we collect

• Account data: name, email address, password hash, organization, role, and login information.
• Organization data: workspace information for organizations, schools, companies, associations, or teams.
• Uploaded content: audio files, video files, photographs selected for text recognition, recognized text and your corrections, authorized source URLs (including YouTube URLs), filenames, metadata, transcripts, summaries, generated content, and exports.
• Usage data: actions performed in the application, processing status, quota usage, and feature usage.
• Billing data: subscription status, provider and customer identifiers, purchase and renewal events, invoices where applicable, and plan information processed through Stripe, Apple, Google Play, or RevenueCat depending on the purchase channel. Parlyo does not receive complete payment-card details from these providers.
• Email data: transactional email delivery information processed through Brevo.
• Technical data: IP address, device/browser information, security logs, error logs, and diagnostic events.

3. Sensitive content

Parlyo may be used by organizations that handle sensitive topics. Uploaded messages, teachings, or documents may reveal religious beliefs or other sensitive information. Customers should only upload content they are entitled to process and should inform their teams, speakers, and contributors where required by applicable law.

4. How we use data

• To create and secure user accounts.
• To provide transcription, summarization, content generation, search, exports, and workspace features.
• To manage roles, permissions, subscriptions, quotas, and billing.
• To send transactional emails such as password resets and invitations.
• To detect abuse, protect the service, troubleshoot errors, and maintain platform security.
• To comply with legal, accounting, and security obligations.

5. Legal bases

Depending on the context, we process personal data to perform a contract, comply with legal obligations, pursue legitimate interests such as security and service improvement, or based on consent where required.

6. Sub-processors

We rely on trusted providers to operate the service, including:

• Render for application hosting and infrastructure.
• Cloudflare R2 for object storage and DNS/security services.
• OpenAI for AI transcription, analysis, and generation features.
• Google Cloud Vision for optional text recognition from photographs, when this feature is enabled and you request it.
• Stripe for web billing, payments, invoices, and subscription management.
• Apple App Store and Google Play for mobile purchases and subscription management on their respective platforms.
• RevenueCat for validating and normalizing mobile subscription status from Apple and Google.
• Brevo for transactional email delivery.

7. AI processing

After a user gives explicit, versioned consent in Parlyo, content is sent to OpenAI only to perform the requested features. For an authorized YouTube import, Parlyo first attempts to retrieve subtitles made available for the video. If usable subtitles are unavailable, the video or extracted audio is sent to OpenAI for transcription. For other media transcription, the uploaded audio, video or audio extracted from video, together with related metadata, is sent to OpenAI. For analysis and content generation, the transcript, text pasted by the user or extracted from documents, and related metadata, such as title, speaker or author, language, content type, source identifiers, and relevant dates, are sent to OpenAI. For semantic search and answers, questions or search queries and relevant transcript excerpts are sent to OpenAI. Summaries, outlines, source excerpts, and previously generated content may also be sent when they are needed as context for a requested outline, ebook, answer, analysis, or generation. These data categories are sent only for transcription, semantic search, answering user questions, analysis, and generation of content requested by the user.

The consent record identifies the user, disclosure version, consent time, rights-attestation time, and any later withdrawal. Consent can be withdrawn in the product; withdrawal blocks new OpenAI processing until consent is granted again, but cannot recall data already sent or stop a provider request already in progress. Parlyo does not intentionally use customer workspace content to train a public model unless explicitly agreed in writing.

Photo text recognition is a separate, optional action. Selecting a photo alone does not send it to Google. After your separate, versioned photo consent and extraction request, Parlyo sends an oriented copy of the image pixels without EXIF metadata to Google Cloud Vision. Parlyo retains the imported image, the recognized text and your corrections separately. On mobile, a converted or resized JPEG may be imported rather than the camera's original file. Photo drafts are private to their creator in the relevant workspace. Only when you choose to use the corrected text in Parlyo does it enter the existing content workflow, with that workflow's visibility rules and separate OpenAI consent. Withdrawing photo consent blocks new OCR calls and discards results of a call already in progress; it cannot recall pixels already sent to Google. It does not itself delete stored photos or content generated earlier. The photo screen provides a separate deletion action.

8. Data retention

• Account and organization data is kept while the account remains active.
• Uploaded files, transcripts, and generated content are kept while the customer keeps them in the workspace.
• Unlinked photo OCR drafts are scheduled for deletion after the retention period shown in the photo screen (30 days by default). Linked photos remain until deleted or until their account is deleted. Deleting a photo does not delete content already generated from its corrected text.
• Security and technical logs are generally retained for a limited period needed for security and operations.
• Billing records may be retained for legal, tax, and accounting obligations.
• Invitation and password reset tokens are retained only for short operational periods.

9. Your rights

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to processing, or export your personal data. For workspace content, requests should normally be made through the customer organization that controls the workspace.

10. Security

Parlyo uses access controls, role-based permissions, organization-level data isolation, private file storage, signed access URLs, upload validation, HTTPS, environment separation, and operational logging controls to protect customer data. No internet service can be guaranteed to be perfectly secure.

11. Cookies

The public website is designed to work without non-essential marketing cookies. If analytics, advertising pixels, or other non-essential trackers are introduced, we will update this policy and implement consent where required.

12. Contact

For privacy requests or questions, contact us at contact@parlyo.app.