Privacy Policy

This Privacy Policy explains how Parlo Technologies Pvt. Ltd. (“Parlo”, “we”, “us” or “our”), based in Bengaluru, India, collects, uses and protects personal data when you visit our website or use the Parlo platform.

In this policy, “personal data” means any information that relates to an identified or identifiable individual. Where Indian law refers to “digital personal data”, we mean the same thing.

This policy covers two groups of people:

• Website visitors: people who browse our website, read our content, use our free tools or contact us.
• Account users: people who sign up for, administer or use a Parlo account on behalf of a business (our “customers”).

Data our customers upload

Our customers use Parlo to communicate with their own contacts. For the contact lists, conversations, order details and other data that customers upload to or generate in the platform (“customer data”), the customer decides what is collected and why. For that data, the customer is the controller (under the GDPR) or the data fiduciary (under India's Digital Personal Data Protection Act, 2023), and we act as their data processor. We handle customer data only on the customer's instructions and under our data processing agreement with them.

If you received a WhatsApp message from a business that uses our platform and have questions about your data, please contact that business directly. Where required, we will help them respond to your request.

Use of the platform is also governed by our Terms of Service.

Information you give us

• Account details: your name, work email address, phone number, company name, role and password.
• Billing details: billing name and address, GSTIN and payment information. Card and bank details are handled by our payment provider; we don't store full card numbers.
• WhatsApp setup details: your business name, display name, WhatsApp phone number and the identifiers of your Meta business and WhatsApp Business accounts.
• Communications: support requests, sales enquiries, feedback and survey responses.

Information collected automatically

• Device and log data: IP address, browser and operating system, pages viewed, referring pages and timestamps.
• Usage data: the features you use, actions you take in the product and your settings.
• Cookies and similar technologies, as described in the cookies section below.

Information from third parties

• Meta, when you connect a WhatsApp Business Account: for example account status, phone number quality rating, template status and message delivery status.
• Integrations you connect, such as ecommerce platforms or CRMs, to the extent you authorise them to share data with us.
• Payment providers: confirmation of payments and related transaction details.

We use personal data to:

• Provide, operate and maintain the platform, including delivering messages through Meta's WhatsApp Business Platform
• Create and manage accounts and verify the identity of users who sign in
• Process subscription payments, invoices and wallet top-ups
• Respond to support requests and enquiries
• Send service communications, such as security alerts, billing notices and important product changes
• Send marketing communications where the law allows, with an easy way to opt out
• Understand how the platform is used so we can fix problems, improve features and build new ones
• Detect and prevent fraud, abuse, spam and security incidents
• Comply with legal obligations and enforce our terms

We do not sell personal data. Where our AI features process customer data, they do so to provide the service to that customer and under the customer's instructions.

India: Digital Personal Data Protection Act, 2023

Where the Digital Personal Data Protection Act, 2023 (DPDP Act) applies, we process your personal data on the basis of your consent, or for a legitimate use permitted by the Act, such as where you have voluntarily provided data for a specific purpose or where processing is needed to comply with law. You can withdraw consent at any time. Withdrawal doesn't affect processing that took place before it.

EEA and UK: GDPR

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to provide the service you or your organisation signed up for.
• Legitimate interests: to secure, improve and promote our service, where those interests are not overridden by your rights.
• Consent: for non-essential cookies and certain marketing communications.
• Legal obligation: to keep financial records and respond to lawful requests.

Parlo is built on Meta's WhatsApp Business Platform (Cloud API). Every WhatsApp message sent or received through our platform is delivered through Meta's infrastructure. This means Meta processes message content and related metadata, such as phone numbers, timestamps and delivery status, in order to deliver messages.

We use Meta as a sub-processor for message delivery. Meta's processing is also governed by its own terms and policies, including the WhatsApp Business terms and Meta's privacy policy. We don't control how Meta handles data within its own systems, and we encourage you to review its policies.

We share personal data only as described below:

• Service providers (sub-processors) that help us run the platform, in these categories: cloud hosting and storage, email delivery, payment processing, product analytics, customer support tools and error monitoring. They may use personal data only to provide services to us, under written contracts.
• Meta, for WhatsApp message delivery, as described above.
• Integrations you enable, such as your ecommerce platform or CRM, which receive the data you choose to sync.
• Professional advisers, such as lawyers, auditors and insurers, who are bound by confidentiality obligations.
• Authorities, where we are required to by law, or where disclosure is needed to protect rights, safety and security.
• Business transfers: if we are involved in a merger, acquisition or sale of assets, subject to confidentiality and, where required, notice to you.

You can request our current list of sub-processors through our contact page.

We are based in India, and our service providers, including Meta, may process personal data in other countries. When we transfer personal data across borders, we do so in line with applicable law.

For transfers from the EEA or UK to countries without an adequacy decision, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK addendum to them. For transfers from India, we comply with any restrictions notified by the Government of India under the DPDP Act.

We keep personal data only for as long as we need it for the purposes in this policy:

• Account data: while your account is active, and for a reasonable period afterwards to handle queries, reactivation or disputes.
• Billing records: for the period required by tax, accounting and company law.
• Customer data: according to the customer's settings and instructions. After an account closes, we delete or return customer data within 90 days, unless the law requires us to keep it longer.
• Logs and website analytics: for a limited period, after which they are deleted or anonymised.

We use technical and organisational measures appropriate to the risk, including encryption of data in transit and, where appropriate, at rest; role-based access controls; logging and monitoring; regular backups; and confidentiality obligations for our staff.

No system is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as required by law.

You are responsible for keeping your account credentials safe and for managing which team members can access your account.

Depending on where you live, you may have the right to:

• Get information about the personal data we hold about you and how we process it
• Correct, complete or update inaccurate personal data
• Have personal data erased when it is no longer needed
• Withdraw consent you have given
• Object to or restrict certain processing, including direct marketing
• Receive your personal data in a portable format (under the GDPR)
• Nominate another person to exercise your rights in the event of your death or incapacity (under the DPDP Act)
• Raise a grievance with us and complain to the Data Protection Board of India or your local data protection authority

To exercise any of these rights, email us at support@parlo.app. We may need to verify your identity before acting on your request, and we will respond within the time required by applicable law.

If your request concerns customer data, such as messages you received from a business that uses our platform, we will pass it to that business, because it controls that data.

We use cookies and similar technologies on our website and in the product:

• Essential cookies keep you signed in, protect your account and make the site work. They can't be switched off.
• Preference cookies remember choices such as your language.
• Analytics cookies help us understand how the site is used so we can improve it.
• Marketing cookies, where used, help us measure how well our campaigns perform.

Where the law requires it, we ask for your consent before setting non-essential cookies. You can also control cookies through your browser settings, although blocking some of them may affect how the site works.

Parlo is a business service and is not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Customers are responsible for obtaining any parental or guardian consent the law requires before they message minors using our platform.

We may update this policy from time to time. When we make material changes, we will tell account users by email or in the product and update the date at the top of this page. We encourage you to review this policy periodically.

If you have questions about this policy or how we handle personal data, email us at support@parlo.app or reach us through our contact page.

For the purposes of the DPDP Act and the Information Technology Act, 2000 and the rules made under them, our Grievance Officer is:

• Name: [Grievance Officer name]
• Company: Parlo Technologies Pvt. Ltd.
• Address: Bengaluru, India
• Email: support@parlo.app

We will acknowledge grievances promptly and aim to resolve them within the time the law requires. If you are not satisfied with our response, you may be able to take your complaint to the Data Protection Board of India or, in the EEA or UK, to your local data protection authority.