Data Processing Agreement

What this is

This Data Processing Agreement explains how Parli handles the personal information you put into it on your company’s behalf. It is written to satisfy the kind of vendor review an office manager or a general contractor may run before signing.

It forms part of our Terms of Service. Where the two disagree about the handling of personal information, this document wins.

If your company needs a countersigned copy for its files, email support@parli.io and we will send one back signed the same day.

Who is responsible for what

Your company decides what information goes into Parli and why. In the language of privacy law, that makes your company the “controller”.

Parli stores and processes that information to run the service for you, and does not decide what to collect or what to do with it beyond that. That makes us the “processor”.

Because your company is the controller, it is your company’s job to have a proper reason for holding your crew’s information and to tell them you are using software like Parli — the same as with your payroll system.

What we will and will not do with it

We process your information only to provide Parli: to store your work, show it to the right people, send the notifications you asked for, take payment, and support you when you ask. Your use of Parli under the Terms is our instruction to do those things.

We will not use your information for our own purposes. We do not sell it, we do not advertise against it, and we do not use it to train AI models — including our own.

If a law ever required us to hand over your information, we would tell you first unless that law forbids it.

Everyone at Parli with access to customer information is bound to keep it confidential.

Security

We keep the technical and organizational protections set out in Annex C below, and we will not weaken them during your subscription. Those are the same measures described in plain language at parli.io/security.

Companies that help us run Parli

Parli runs on infrastructure operated by other companies, listed in Annex B. Each is bound by a written contract that holds it to protections no weaker than the ones in this document, and each receives only what it needs to do its job.

If we add or replace one, we will post the change on this page and email the administrators on your account at least thirty days before it starts handling your information. If you object on reasonable data protection grounds within that period, tell us and we will work with you; if we cannot resolve it, you may cancel the affected part of your subscription without penalty.

We remain responsible to you for what these companies do with your information.

Requests from your crew about their own information

If one of your people asks to see, correct, export or delete the information you hold about them, most of it you can handle yourself inside Parli — team records are editable, the owner can export the yard to a spreadsheet, and anyone can permanently delete their own account from Settings.

Where you need us, we will help. If such a request comes to us directly, we will not answer it ourselves — we will pass it to you, because it is your company’s decision to make.

If something goes wrong

If we discover a breach of security that affects your information, we will tell you without undue delay and in any case within 72 hours of confirming it.

We will tell you what happened, which information and roughly how many people are affected so far as we can tell, what we are doing about it, and what we suggest you do. We will keep you updated as we learn more.

Telling you promptly is not an admission that we were at fault.

Checking up on us

Once in any twelve months, you may ask us in writing for the information reasonably needed to confirm we are meeting this agreement, and we will provide it — including any third-party audit report we hold at the time.

If your regulator requires an inspection beyond that, we will accommodate a reasonable one on thirty days’ notice, during business hours, without disrupting other customers, and at your cost.

Where your information is kept

Parli is hosted in the United States. If your company is in the European Economic Area, the United Kingdom or Switzerland, the European Commission’s Standard Contractual Clauses apply to that transfer and are incorporated into this agreement by reference, with Parli as data importer and your company as data exporter.

When you leave

Before you go, you can export your yard to a spreadsheet at any time from inside Parli.

After your subscription ends we keep your workspace for thirty days so you can change your mind or pull anything you missed. After that we delete it. Copies inside our routine backups age out on the normal backup cycle and are not restored to live use.

If you would rather we deleted everything immediately, ask and we will.

Annex A — What is processed

Subject matter and duration: the provision of Parli to your company, for as long as your subscription lasts, plus the wind-down period described above.

Nature and purpose: storing, organizing and displaying the records your company enters, so it can schedule crews and equipment, track jobs and costs, file field reports, and notify the right people.

Types of personal information: names, email addresses, phone numbers, job titles and roles; hourly pay rates where your company records them; an emergency contact number where entered; photographs and the contents of notes and field reports; job site addresses and their map coordinates; sign-in records and, on phones, an anonymous notification token.

Categories of people: your company’s employees and crew; contacts at subcontractors you schedule; and any other individuals your company chooses to enter into its records.

Special categories: none are requested or required. Parli is not built for health, biometric or other special-category information, and it should not be entered.

Annex B — Companies that process information for us

Supabase — database, sign-in and file storage. United States.

Vercel — application and website hosting. United States.

Stripe — subscription payments. Card details go from your browser to Stripe directly and are never held by Parli. United States.

Resend — delivery of email such as invitations and notifications. United States.

Anthropic — powers the assistant. Receives only the workspace content needed to answer a request, and does not train on it. United States.

OpenAI — powers the assistant and voice mode. Receives only the workspace content needed to answer a request, and the audio when voice mode is used; does not train on it. United States.

Apple and Google — deliver notifications to phones and distribute the mobile app, and confirm identity if a user chooses to sign in with an Apple or Google account. They do not receive your workspace records.

Annex C — Security measures

Separation between companies is enforced by the database, not only by the screens: every record is tagged with the company that owns it, and the database refuses to return another company’s rows even if the software asked. Every table in Parli enforces this rule.

That separation is tested automatically before every release. Accounts at each role attempt to read and change what they should not; if a door opens that was previously shut, the release stops.

Access inside a company is limited by role, and can be narrowed further with custom roles. Pay rates are restricted at the database level to administrators and to the person whose rate it is.

Information is encrypted in transit and at rest. Files and photos are held in private storage, reachable only through short-lived links issued to a signed-in user; a share link exists only where the customer deliberately creates one, and can be revoked at any time.

Passwords are stored only as a one-way hash and cannot be read by anyone at Parli. Sign-in with Google or Apple is supported so a password need never be shared with us at all.

Operational keys and credentials are held in encrypted secret storage separate from the source code.

Deletions of company records are written to an audit log showing what was removed, by whom and when.

The database is backed up automatically each day.

Parli holds no payment card numbers, and contains no advertising, analytics or third-party tracking software.

Liability

The limitations and exclusions of liability in our Terms of Service apply to this agreement as well, and apply to all claims arising out of it taken together.