Privacy Policy

1. Who We Are

Parvl Pty Ltd (ACN 696 851 822, ABN 18 696 851 822) (“we,” “us,” or “our”) operates the Parvl platform. We act as a data controller for account information (your email, name, and organisation membership) and as a data processor on behalf of your organisation (the controller) for workspace content processed through our platform (Slack messages, and when connected, GitHub, Jira, and meeting transcript data). See our Data Processing Agreement for the full processor obligations.

2. Data We Collect

We collect and process the following categories of data:

• Account information: Email address, name, profile picture, and organization membership, collected and managed through Clerk, our authentication provider.
• Organization data: Organization name, settings, plan tier, billing information (when billing is enabled), and member roles.
• Decision data: Decisions, rationale, alternatives considered, participants, outcomes, assumptions, tradeoffs, quality scores, tags, and related metadata submitted by your team.
• Meeting transcripts (when configured): Content from meeting transcription services (Otter.ai, Fireflies, Read.ai) sent via webhook for decision extraction, when this integration is enabled by your organization.
• Slack messages: Messages from connected Slack channels that are processed through our decision classification pipeline.
• GitHub content (when connected): Pull request titles, descriptions, and comments from connected GitHub repositories, when this integration is enabled by your organization.
• Jira issues (when connected): Issue summaries, descriptions, and metadata from connected Jira projects, when this integration is enabled by your organization.
• Usage analytics and session recording: Page views, feature usage patterns, performance metrics, and session recordings collected via PostHog (US Cloud). Session recordings capture user interactions (clicks, scrolling, page navigation) with all text content masked to protect privacy (maskTextSelector: '*' configured). Your email address and display name are sent to PostHog to identify authenticated organisation administrators across sessions. End users whose Slack messages are processed are NOT PostHog users. These data are used to improve the product experience.
• Comments and interactions: Comments, reactions, and review queue actions taken within the platform.

3. AI Processing Disclosure

Parvl uses artificial intelligence to provide its core features. We believe in full transparency about how AI processes your data:

• Decision classification (Anthropic Claude): Decision text and surrounding context are sent to Anthropic's Claude API for classification by type (technical, strategic, operational, etc.) and confidence scoring. Anthropic does not retain or train on data sent via their API. Processing is governed by Anthropic's commercial API terms, which prohibit use of customer data for model training.
• Semantic embeddings (OpenAI): Decision text is sent to OpenAI's embedding API (text-embedding-3-small) to generate vector representations for natural language search. OpenAI does not retain or train on data sent via their API under their business terms.

Purpose limitation: AI processing is used solely for decision classification, search, and analytics within the Parvl platform. Your data is not used to train, fine-tune, or improve any AI model by default.

Service Improvement Program (opt-in): Organisation administrators may opt in to the Service Improvement Program (“SIP”) in Organisation Settings. When SIP is enabled, Parvl uses de-identified, aggregated correction data (confirm, reject, and edit actions on extracted decisions) to improve the accuracy of Parvl's classification models. No original message text is retained for this purpose. Parvl may also train customer-specific model adapters using that customer's correction data to improve accuracy for that organisation. SIP can be disabled at any time. Disabling SIP stops future collection; customer-specific adapters are deleted within 30 days. SIP is disabled by default.

Opt-out of AI classification: Organization administrators will be able to disable AI classification in organization settings when this feature becomes available. When AI processing is disabled, decisions can still be manually classified and searched using keyword matching. To request complete removal of AI-processed data, contact privacy@parvl.com.

4. Legal Basis for Processing (GDPR Article 6)

We process personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the Parvl service as described in your subscription agreement, including storing decisions, running the classification pipeline, and generating analytics.
• Legitimate interest (Art. 6(1)(f)): Processing necessary for our legitimate interests in improving the service, preventing abuse, and ensuring platform security. This includes usage analytics, rate limiting, and audit logging.
• Consent (Art. 6(1)(a)): Where required, we obtain consent for optional processing activities such as connecting third-party integrations (Slack, GitHub, Jira) and enabling optional AI features (search reranking).
• Legal obligation (Art. 6(1)(c)): Processing necessary to comply with legal obligations, such as maintaining audit logs and responding to lawful data requests.

Lawful basis by data category:

• Account data (email, name, profile): Contract performance (Art. 6(1)(b)) — necessary to provide the Service.
• Slack message analysis: Legitimate interests (Art. 6(1)(f)) — our legitimate interest in providing decision capture services, balanced against the minimal privacy impact as we only extract decision-relevant metadata, not personal communications.
• GitHub & Jira content (when connected): Legitimate interests (Art. 6(1)(f)) — extracting decision-relevant metadata from connected development tools at the organization's direction.
• Usage analytics: Legitimate interests (Art. 6(1)(f)) — product improvement and service reliability.
• Billing data (when billing is enabled): Contract performance (Art. 6(1)(b)) — necessary to process payments and manage subscriptions.

We act as a data processor on behalf of your organization (the data controller) when processing Slack messages and, when connected, GitHub content and Jira issues. Our Data Processing Agreement (DPA) governs this relationship and is available upon request at privacy@parvl.com.

5. Sub-Processors

We engage third-party sub-processors to deliver the Parvl service. Each sub-processor is bound by data processing agreements that require equivalent data protection standards. For the complete list of sub-processors including their purpose, data processed, and location, see our Sub-Processors page.

6. Data Retention

• Decision data: Retained for the duration of your subscription, with a default maximum retention period of 2 years. Organization administrators can configure shorter retention periods.
• Raw transcripts: Retained for 90 days by default (configurable per organization).
• Webhook delivery logs: Retained for 90 days.
• Audit logs: Retained for a minimum of 1 year for compliance purposes.
• Account data: Retained for the life of the account plus 30 days after cancellation to allow reactivation or data export.
• Backups: All data, including backups, is permanently deleted within 60 days after account cancellation.
• Deletion on request: You may request deletion of your personal data at any time. Requests are fulfilled within 30 days, subject to any applicable legal hold obligations (when legal hold is configured).

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Right of access (Art. 15): Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate or incomplete personal data.
• Right to erasure (Art. 17): Request deletion or anonymization of your personal data. Parvl anonymizes personal identifiers while preserving decision records for organizational continuity.
• Right to data portability (Art. 20): Export your data in machine-readable format (JSON or CSV) via Settings or the API.
• Right to restriction of processing (Art. 18): Request that we limit processing of your personal data in certain circumstances.
• Right to object (Art. 21): Object to processing based on legitimate interest, including profiling.

How to exercise your rights: Use the data export and erasure features in Settings, submit a request to privacy@parvl.com, or use the per-user DSAR export endpoint. We respond to all requests within 30 days.

You also have the right to lodge a complaint with your local supervisory authority if you believe your data protection rights have been violated.

8. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our primary sub-processors are located. For all such transfers, we rely on the European Commission's Standard Contractual Clauses (SCCs) to ensure an adequate level of data protection. Where a sub-processor is located in a country with an adequacy decision from the European Commission, transfers are made under that framework.

9. Cookies

Parvl uses only essential cookies required for authentication and session management, provided by Clerk. We do not use tracking cookies, analytics cookies, or advertising cookies. No cookie consent banner is required because we do not use non-essential cookies. For details, see our Cookie Policy.

10. Children's Privacy

Parvl is a business-to-business platform designed for professional use. Our service is not directed at children under the age of 16, and we do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected data from a child under 16, we will take steps to delete that data promptly.

11. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• Categories of personal information collected: Identifiers (name, email), professional information (organization, role), internet activity (usage analytics), and content you provide (decisions, comments).
• No sale of personal information: We do not sell, and have never sold, personal information to third parties.
• No sharing for cross-context behavioral advertising: We do not share personal information for cross-context behavioral advertising purposes.
• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to opt-out: As we do not sell personal information, the right to opt-out of sale does not apply. You may opt out of AI processing as described in Section 3.
• Non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your California privacy rights, contact privacy@parvl.com or use the data management features in Settings.

12. Australian Privacy Act Compliance

Parvl Pty Ltd is an Australian company subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This section describes our compliance with the APPs as the primary privacy framework governing our operations.

APP 1 — Collection of Personal Information

We collect the categories of personal information described in Section 2 of this policy. Information is collected directly from you (account registration), from your organisation's connected services (currently Slack; and, when connected, GitHub and Jira), and from your use of the platform (usage analytics).

APP 5 — Notification of Collection

We collect personal information from your Slack workspace messages. This information is collected via the Slack API when your workspace administrator authorises the Parvl application. Your organisation administrator is responsible for ensuring that team members are notified that their communications in monitored channels may be processed by Parvl for decision classification.

APP 6 — Use and Disclosure

We use personal information only for the purposes described in this policy: providing the Parvl decision intelligence service, improving the platform, and communicating with you about your account. We do not use personal information for direct marketing without consent.

APP 8 — Cross-Border Disclosure

We disclose personal information to overseas recipients, including:

• Anthropic (AI classification) — United States
• OpenAI (embedding generation) — United States
• Supabase (database hosting) — India (Mumbai)
• Clerk (authentication) — United States
• Railway (API hosting) — United States
• Vercel (web hosting) — United States
• Sentry (error monitoring) — United States
• Stripe (payment processing, when billing is enabled) — United States
• PostHog (product analytics, session recording with text masking) — United States

We take reasonable steps to ensure these recipients comply with the Australian Privacy Principles, including through data processing agreements that impose equivalent data protection obligations.

APP 11 — Security of Personal Information

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Our security measures include encryption in transit (TLS 1.2+) and at rest (AES-256), row-level security for multi-tenant data isolation, HMAC-verified webhooks, and role-based access controls. For full details, see our Security Practices page.

Automated Decision-Making Disclosure

Parvl uses machine learning to classify messages, assign confidence scores, and route low-confidence items for human review. These outputs are designed as decision support for organisational memory, not automated decision-making about individuals. Customer organisations are responsible for ensuring that Parvl output is not used as the sole basis for any decision affecting an individual's employment, compensation, or professional standing. Personal information used in classification includes message content, author identifiers, and channel metadata. Customers may request human review of any classification via their administrator interface or the review queue.

Complaints and the OAIC

If you believe we have breached the Australian Privacy Principles, you may lodge a complaint by contacting us at privacy@parvl.com. We will investigate and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Notifiable Data Breaches Scheme

Parvl complies with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. In the event of an eligible data breach that is likely to result in serious harm to any individual, we will notify the OAIC and affected individuals as soon as practicable in accordance with our obligations under the NDB scheme.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice via email to the address associated with your account before the changes take effect. Non-material changes (such as clarifications or formatting updates) may be made without prior notice. We encourage you to review this page periodically. Your continued use of Parvl after changes take effect constitutes acceptance of the updated policy.

14. Contact

For privacy-related questions, concerns, or to exercise your data protection rights, contact us at: