Privacy Policy

This Privacy Policy explains how Spendbase (“Spendbase”, “we”, “us”), the operator of Parley (the “Service”), collects, uses, shares, and protects personal information, and the rights and choices you have. The controller of your personal data is the Spendbase entity you contract with, based on your location:

• Spendbase Ltd., registered in England and Wales under company registration number 14725974, with its registered office at 41 Luke Street, London, England, EC2A 4DP, United Kingdom — for users in the United Kingdom, the European Economic Area, or any country outside the Americas; or
• Spendbase Inc., a Delaware, USA corporation under company registration number 61-2064269, with its registered office at 16192 Coastal Highway, Lewes, DE 19958, USA — for users in the United States, Canada, or elsewhere in the Americas.

We aim to collect only what is needed to operate the Service. By using the Service you acknowledge this Policy. It should be read together with our Terms & Conditions.

Depending on how you use the Service, we collect:

• Account information — such as your name, work email, organization, and authentication identifiers from our identity provider.
• Negotiation content — the Briefs, target prices, notes, and documents you provide, and the negotiation history and outcomes generated in the Service.
• Email & inbox data — vendor-related messages (and their relevant attachments) accessed from a mailbox you connect, and the replies drafted or sent through the Service (see “Email and inbox data” below).
• Billing information — plan and transaction details processed by our payment provider; we do not store full card numbers.
• Usage and device data — such as log data, IP address, approximate location derived from IP, timestamps, and how you interact with the Service, used to operate, secure, and improve it.
• Communications — messages you send us, for example support requests.

We collect information you provide directly (account and Brief details), automatically as you use the Service (usage and device data, security-activity logs), and from third parties that help us operate — for example our authentication provider, our payment provider, and, if applicable, our sign-up/CRM tooling. When you connect a mailbox, we collect email data through your provider’s secure OAuth authorization.

When you connect a mailbox, the Service accesses incoming vendor-related messages to identify negotiation opportunities and, once you enable sending, to send replies you configure or approve. We request the minimum access needed — read-only to begin, and send permission only when you explicitly grant it. Email credentials are never stored; we hold only the OAuth tokens needed to operate the connection, encrypted at rest, and you can revoke access at any time.

Limited Use. Parley’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically: we use Google user data only to provide and improve the user-facing features of the Service; we do not use it for advertising; we do not sell it; we do not transfer it to others except as necessary to provide or improve the Service, for security or legal reasons, or as part of a merger or acquisition with appropriate safeguards; and we do not allow humans to read Google user data unless we have your consent for specific messages, it is necessary for security or to comply with law, or the data has been aggregated and anonymized. Equivalent principles apply to data accessed from Microsoft accounts.

We use personal information to:

• provide and operate the Service — classifying vendor emails, drafting replies, sending approved or auto-mode replies, and tracking renewals, savings, and outcomes;
• authenticate you, secure the Service, prevent abuse, and keep a record of sensitive account activity;
• process payments and manage subscriptions;
• provide support and respond to your requests;
• improve the Service and develop new features (using service and usage data, not the content of your emails, to train generalized AI models);
• comply with legal obligations and enforce our Terms.

To classify emails and generate Drafts, relevant content (including vendor message text and your Brief) is sent to our AI model provider for processing. We instruct our AI provider not to retain this content beyond what is needed to return a result and not to use it to train its models. We do not use the content of your emails or Briefs to train generalized or foundation AI models.

If you are in the European Economic Area or the United Kingdom, we process personal data on these legal bases: performance of our contract with you (to provide the Service); our legitimate interests (to secure, operate, and improve the Service and prevent abuse), balanced against your rights; your consent where required (for example when you grant mailbox access or where consent is otherwise legally required); and compliance with legal obligations. Where we rely on consent, you may withdraw it at any time.

We do not sell your personal information. We share it only with service providers (sub-processors) that help us run the Service, each bound by appropriate confidentiality and data-protection obligations, and only as needed. Typical categories include:

• cloud hosting and database infrastructure;
• our AI model provider (to generate classifications and Drafts);
• authentication and identity management;
• payment processing;
• sign-up and customer-relationship tooling;
• your connected email provider (Google / Microsoft), to read and send messages you authorize.

We may also disclose information where required by law, regulation, legal process, or governmental request; to protect the rights, safety, and security of Spendbase, our users, or the public; to enforce our Terms; and in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this Policy or notify you of material changes.

We may process and store information in countries other than where you are located. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism.

You control how long your data is kept. In your account settings you can retain data for as long as your account is active, or set an automatic deletion window (for example 30, 60, 90, or 180 days, or one year). Negotiations and email content older than your chosen window are deleted automatically. We may retain limited information for longer where necessary to comply with legal obligations, resolve disputes, or enforce our agreements. You can request deletion of your account and associated data at any time from within the Service.

We use industry-standard technical and organizational measures to protect personal data. Email credentials are never stored — only the OAuth tokens needed to operate your connection, which are encrypted at rest. Sensitive account actions are logged with their originating location so you can review recent security activity, and access can be revoked at any time. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Subject to applicable law, you have the right to access, correct, delete, or receive a portable copy of your personal data; to restrict or object to certain processing; and to withdraw consent where processing is based on consent. To exercise these rights, contact us at privacy@parley.deal. You also have the right to lodge a complaint with your local data-protection supervisory authority. [If applicable, our EU/UK representative is: [representative name and contact].]

If you are a US resident, you may have rights under laws such as the California Consumer Privacy Act (as amended by the CPRA): to know and access the personal information we collect, to request its deletion, to request correction, and to not be discriminated against for exercising your rights. We do not sell your personal information and do not “share” it for cross-context behavioral advertising as those terms are defined under California law. To exercise your rights, contact us at privacy@parley.deal; we will verify your request as required by law, and you may use an authorized agent.

We use cookies and similar technologies that are strictly necessary for authentication, security, and core functionality of the Service. We do not use non-essential advertising or cross-site tracking cookies without your consent. You can control cookies through your browser settings, though disabling essential cookies may affect the Service.

The Service uses AI to classify emails and prepare Drafts, and — in Auto mode — to send replies subject to the safeguards described in our Terms. These features assist your decisions and remain under your control; we do not use them to make decisions producing legal or similarly significant effects about you without human involvement.

The Service is intended for business users and is not directed to children. We do not knowingly collect personal data from anyone under 18 (or the age of digital consent in your jurisdiction). If you believe a child has provided us personal data, contact us and we will delete it.

We may update this Policy from time to time. If a change is material, we will provide notice through the Service or by email. Questions, requests, or privacy concerns can be sent to Spendbase at privacy@parley.deal.