Privacy Policy

Parleon ("Parleon", "we", "us") is an AI-readiness platform for car businesses. This policy explains how we handle personal data across two things: the marketing website at parleon.ai, and the Parleon service we provide to businesses under a subscription.

Who we are: Parleon, PO Box 100, Murrysville, PA 15668, United States, is the operator of record for the website and the service described here.

Our two roles: controller and processor

Parleon is a business-to-business product. Our customer is the business, which is a business. Whether we are a "controller" or a "processor" of personal data depends on whose data it is:

We are the controller for the personal data of our own business contacts: business staff who create or use an account, prospects who ask for a demo or run the public readiness check, partners and resellers, and visitors to parleon.ai. We decide why and how that data is used, and this policy governs it.
We are a processor (a service provider) for the personal data of car shoppers that flows through the AI concierge we run on a business's behalf. In that relationship the business is the controller: it decides why the data is collected and it owns the customer relationship. We process that data only to provide the service, under the business's instructions and our agreement with them. If you are a shopper and want to exercise a right over that data, the business is your first point of contact, and we assist them.

Information we process

Information from customers, prospects and site visitors (we are controller)

Contact and account details: name, work email, phone, company, role, and the login and configuration details of a Parleon account.
Billing details: subscription plan, billing contact and billing history. Card payments are handled by our payment processor, Stripe. We do not store full card numbers on our own systems.
Sales and support communications: emails, demo requests and messages you send us.
Public readiness checks: when someone runs the AI-Readiness Score tool, the website domain that was entered is sent to us so we can run and improve the check. The marketing form does not ask for, and does not collect, an email address.

Customer business data (provided by the customer)

Catalogue and merchandising: products and services, pricing, photos, status, item detail and specification data, prices, offers and promotions.
Brand knowledge: content indexed from the business's own website, such as hours, departments, staff listings, and service, parts, financing and warranty policies, used to keep the AI answers on-brand and accurate.

Shopper data through the AI concierge (we are processor)

Conversation content: the questions a shopper asks the AI concierge on a business's surfaces and the answers given.
Lead details: when a shopper chooses to submit a lead, the information they provide, which can include name, email, phone and the product or service or deal they are interested in. Leads are passed to the business's systems.

How we use information

To provide, operate, secure and improve the Parleon service and website.
To make business catalog, offers and knowledge readable and answerable to AI assistants, and to capture and route leads to the business.
To set up accounts, process subscriptions and take payment through Stripe.
To respond to sales and support requests and to run the public readiness check.
To measure how AI assistants and automated agents interact with a business's surfaces, and to produce conversation analytics for the business about what shoppers asked and where an answer fell short.
To detect, prevent and address fraud, abuse, security issues and technical problems, and to comply with law.

We do not sell personal data, and we do not use shopper conversation content to advertise to shoppers.

AI processing

Parleon uses artificial intelligence to generate responses, summaries and structured data. To do this we send queries and relevant content to third-party AI service providers that run the underlying models. We contract with these providers to process data on our and the business's behalf and not to use it to train general-purpose models where that option is available to us. We do not publicly name the specific model vendor.

Business reviews and public business information

To help represent a business accurately, we process publicly available business information about it, including Google Business Profile reviews, review content and business ratings. Today this is sourced through third-party data providers. In the future a business will be able to authorize a direct connector, using an authorization flow the business controls, so that this information is drawn with the business's permission. We process this business information to power AI answers and analytics about the business, not to profile individual reviewers.

Legal bases (EEA and UK)

Where the EU General Data Protection Regulation or the UK GDPR applies to our own controller processing, we rely on these legal bases:

Contract: to set up and run accounts, subscriptions and billing.
Legitimate interests: to operate, secure, measure and improve the service and site, to run the public readiness check, and for direct business-to-business outreach, balanced against your rights.
Consent: where we ask for it, for example for certain marketing.
Legal obligation: to comply with laws that apply to us.

For shopper personal data, the business is the controller and determines the legal basis; we process it under our agreement with the business.

We do not sell personal data. We share it only with service providers that help us run Parleon, each bound to handle it only for us and only for these purposes:

Stripe, our payment processor, for subscription billing.
Cloud and edge infrastructure providers that host and serve the platform.
Third-party AI service providers that run the models used to generate responses and summaries.
Third-party data providers that supply publicly available business information, including business reviews and ratings.

We may also disclose information to comply with law, enforce our agreements, protect rights and safety, or as part of a corporate transaction such as a merger or acquisition. A current list of subprocessors is available to business customers on request.

Cookies and the marketing site

The parleon.ai marketing site is deliberately light. It does not set advertising cookies and does not run third-party analytics or tracking scripts. The only client storage it uses is a single local preference that remembers whether you chose light or dark mode; that stays in your browser and is not sent to us. See the Cookie Policy for detail. The Parleon service delivered to businesses may use strictly necessary cookies or tokens to keep an authenticated session working.

Data retention

We keep personal data only as long as needed for the purpose it was collected, then delete or anonymize it. Account and billing records are kept for the life of the relationship and for the period afterward required for tax, accounting and legal reasons. Shopper conversation and lead data is retained according to the business's instructions and our agreement with the business, since the business is the controller of it. As a general matter, we keep personal data for as long as your account is active and as needed to provide the service, then delete or anonymize it within a reasonable period unless a longer period is required by law (for example for tax, accounting or legal-hold reasons).

Security

We use technical and organizational measures appropriate to the data we handle, including encryption in transit, access controls, and reputable infrastructure and processing providers. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security, but we work to protect data against loss, misuse and unauthorized access.

Your privacy rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy in a portable form, to object to or restrict certain processing, and to withdraw consent. To exercise a right over data we control, email privacy@parleon.ai and we will respond as the law requires. We will not discriminate against you for exercising a right.

If your request is about shopper data processed through a business's AI concierge, the business is the controller of that data, so please contact the business. We will support the business in honoring your request.

California privacy rights (CCPA and CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you rights over personal information we collect as a business. In the past twelve months we have collected the categories described above, which can include identifiers, contact and commercial information, and internet or device activity related to using our site and service. We collect it for the business purposes described in this policy.

You can request to know the personal information we have collected about you.
You can request that we delete it, subject to legal exceptions.
You can request that we correct inaccurate personal information.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. Where we handle personal information to provide the Parleon service to a business, we act as that business's service provider and use the information only to perform the service. To make a request, email privacy@parleon.ai. You may use an authorized agent, and we will verify requests as the law allows.

EEA, UK and international transfers

Some businesses may receive traffic from the European Economic Area or the United Kingdom. Where the GDPR or UK GDPR applies, the rights and legal bases above apply, and you may lodge a complaint with your local supervisory authority. Parleon operates from the United States, so personal data may be processed in the United States and other countries whose laws differ from yours. Where required, we use appropriate safeguards for international transfers, such as Standard Contractual Clauses. Business customers who need a data processing agreement can request one from us.

Children

Parleon is a business tool for car businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as the product and the law evolve. When we do, we will change the "Last updated" date at the top, and for material changes we will provide a more prominent notice where appropriate.

Contact us

For privacy questions or to exercise a right, email privacy@parleon.ai. Postal address: Parleon, PO Box 100, Murrysville, PA 15668, United States.