Legal
Parola Privacy Policy
Last updated:
This Privacy Policy explains what Parola collects, why, who we share it with, how long we keep it, and the rights you have. It covers parola.tech, app.parola.tech, and related product emails.
We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) ("DPA") and its Implementing Rules and Regulations. When we offer the Service to people in the EEA or UK, we also apply the core requirements of the GDPR / UK GDPR described below.
1. Who we are
Parola is operated by Nix Eniego, an individual based in the Philippines ("Parola", "we", "us", "our").
Nix Eniego is responsible for account and product data processed by Parola and is the contact for all privacy requests.
- Privacy and support email: nix@parola.tech
We handle privacy requests by email only.
For payment transactions, Paddle.com is the Merchant of Record and handles payment data under its own privacy notice. See Section 5.
2. Information we collect
2.1 Account and workspace data
When you sign up or invite teammates we store: name, email address, password hash (PBKDF2-SHA256; we never store the plain password), organisation/workspace name, role (owner/admin/member), email verification time, alert email opt-out, and related auth tokens (invite, verify, password reset).
2.2 Brand and configuration data
Brand names, keywords, competitor lists, websites and @handles you paste, alert settings, Slack webhook URLs you connect, API keys you create (stored hashed), and similar settings.
2.3 Billing data
We do not store full card numbers. Paddle processes checkout. We store Paddle customer IDs, subscription plan and status, billing interval, checkout session metadata (plan, amount, price id), and verified webhook event records so we can sync access.
2.4 Public mentions (content about or by third parties)
For brands you watch, we collect publicly available posts and pages. A mention record may include source, external id, URL, author name or handle, title, body text, posted time, sentiment/relevance labels, and a raw JSON snapshot from the provider. We do not seek private messages or non-public account content.
2.5 AI processing inputs and outputs
Mention text, brand context, and prompts may be sent to OpenAI gpt-4o-mini for relevance/sentiment QC, entity checks, onboarding helpers, ask-your-data answers, Opportunity Sniper specs, and reply drafts. Drafts stay in your workspace unless you copy them elsewhere. Parola never auto-posts replies.
2.6 Usage, security, and device data
We use Cloudflare for hosting. Cloudflare may process IP addresses, request metadata, and security signals. We may store rate-limit buckets derived from Cloudflare's connecting IP for login, signup, and password-reset abuse prevention. Application session data is described in Section 3.
2.7 What we do not run today
We do not use PostHog or another product-analytics SDK in the app or on the marketing site. We do not run advertising pixels for Parola ads on the app. The marketing site may load fonts from Google Fonts, which can receive standard request data such as IP address from your browser.
2.8 Messages you send us
If you email support, we keep the message and our reply to handle your request.
2.9 Free homepage check
If you use a free check on the marketing site, we process the brand or website you enter to return a sample result. We do not use that input to create an account, and we do not keep check inputs as a customer profile. Short-lived technical caches and IP-based rate limits may apply to keep the tool fast and prevent abuse.
3. Cookies and sessions
| Cookie | Purpose | Duration | Attributes |
|---|---|---|---|
parola_session | Keeps you signed in | 30 days | httpOnly, Secure (on non-local), SameSite=Lax. Raw token in cookie; SHA-256 hash stored in our database |
parola_org | Remembers which workspace you last used | 365 days | Same security attributes as above |
These are strictly necessary for the logged-in product. Checkout may set cookies from Paddle. Cloudflare may set infrastructure cookies. We do not set analytics or advertising cookies in the app today.
4. Why we use data (purposes and legal bases)
| Purpose | Main data | Legal basis (GDPR where it applies) / DPA criteria |
|---|---|---|
| Create and run your account and workspace | Account, config | Contract (Art. 6(1)(b)); legitimate purpose under the DPA |
| Collect and show public mentions you configured | Mentions, keywords | Contract with you; legitimate interests in operating a business listening tool on public data (Art. 6(1)(f)), balanced against the rights of the people involved using the safeguards in Section 6 |
| Billing and access control | Billing identifiers | Contract; legal obligation for tax records (with Paddle) |
| Transactional email (verify, reset, invites, alerts you enable) | Email, alert content | Contract; legitimate interests for security mail |
| Abuse prevention and security | IP-derived rate limits, logs | Legitimate interests in keeping the Service and its users secure |
| Improve reliability (debugging outages) | Limited logs | Legitimate interests |
| Legal compliance | As required | Legal obligation |
Where we rely on legitimate interests, we consider whether our interest is outweighed by your rights and expectations, limit the data to what the feature needs, and let you object (see Section 9).
We do not sell personal information.
We do not use customer mention data to train our own AI models. Data sent to OpenAI through its API is handled under OpenAI's API terms and policies in force at the time of the request.
5. Who we share data with (service providers)
| Provider | Role | Typical data |
|---|---|---|
| Cloudflare (Workers, D1, network) | Hosting, database, TLS, edge security | All service data in the app database and requests |
| Paddle.com | Merchant of Record: checkout, tax, invoices, payment support, refunds where applicable | Name, email, address you give at checkout, payment method (to Paddle), subscription amounts |
| OpenAI | gpt-4o-mini analysis and drafts | Prompt + mention/brand text needed for the feature |
| Bright Data | Public-web / social collection for enabled sources | Search terms; returned public content |
| DataForSEO | Search / YouTube / news / AI-visibility style queries | Keywords, prompts; returned public results |
| Apify | Public social collection for enabled actors (e.g. Facebook keyword search) | Search terms; returned public content |
| Taddy | Podcast episode search (plan-gated) | Search terms; episode metadata |
| Resend and/or MailChannels | Transactional email | Recipient email, message content, delivery status |
Customers may also connect Slack or outbound webhooks; data you send there is under your control and those providers' terms.
We may disclose data if required by law, to protect rights or safety, or in a merger/sale of the business (with notice where required).
6. People who appear in public mentions (not customers)
If you wrote a public post that a Parola customer is watching, we may store a copy of that public content in their workspace so they can see brand conversation.
- We collect from public sources only, through the providers above.
- Customers choose which brands and keywords to monitor. We collect and store matching public content to provide the Service they configured.
- We do not use that content to build marketing profiles of you for sale.
- You can ask us to remove or suppress a specific URL or author string from Parola systems by emailing nix@parola.tech. We will verify and act where feasible, and tell the customer workspace if needed.
- Our basis is typically legitimate interests in understanding public brand discussion, balanced against your rights. You may object. Under the DPA, you may exercise access, correction, blocking, and related rights through the same email.
Customers who export mentions or use them outside Parola are responsible for their own use of that data and for having a lawful basis for it.
7. International transfers
We operate from the Philippines. Our providers process data in other countries, including the United States and other regions where Cloudflare, OpenAI, Paddle, and collection vendors operate. Where the DPA or GDPR requires safeguards for these transfers, we rely on the contractual protections in those providers' terms, such as standard contractual clauses or equivalent mechanisms.
8. How long we keep data
Honesty about the product today:
- There is no automated purge job that deletes old mentions or inactive accounts on a fixed schedule.
- Account and configuration data stay while the account is active.
- Mentions stay while the customer's workspace keeps them, unless removed on request or when the workspace data is deleted.
- Billing identifiers and events we hold are kept as needed to provide access and for accounting; Paddle keeps payment records under its own rules.
- Auth rate-limit buckets expire on short windows (minutes to hours).
- Sessions expire after 30 days (or when you sign out / we revoke them).
When you ask us to delete an account, we aim to delete or anonymise personal account data within 30 days of verifying the request, except records we must keep by law. Mentions tied only to that workspace are removed with it.
9. Your rights
Philippines (Data Privacy Act of 2012)
You may have the right to be informed, to access, to object, to erasure or blocking, to correct, to data portability, to damages, and to complain to the National Privacy Commission (privacy.gov.ph).
EEA / UK (GDPR / UK GDPR)
You may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority. Where we rely on consent, you may withdraw it.
How to ask
Email nix@parola.tech from your account email (or give enough detail to find the data). There is no self-serve account deletion in the app yet; we handle deletion manually. We respond within 30 days (or the longer period the law allows when complexity requires it).
Deleting Parola data does not cancel Paddle billing by itself. Cancel in the Paddle portal first (see the Terms).
10. Security
Measures in use include HTTPS/TLS, PBKDF2-SHA256 password hashing, httpOnly Secure SameSite=Lax session cookies, organisation-scoped database queries, and signature checks on Paddle webhooks. Access to production is limited to the operator.
No online service is perfectly secure. If a personal data breach must be notified under the DPA, we will notify the National Privacy Commission and affected individuals as the DPA and its rules require, including within the required timeframe (generally 72 hours from knowledge of a notifiable breach).
11. Children
Parola is for business users 18+. We do not knowingly create accounts for children. Contact us to remove any that slip through.
12. Changes
We may update this policy. Material changes will be emailed or shown in-app before they take effect where required. The "Last updated" date shows the current version.
13. Contact
Parola, operated by Nix Eniego (an individual, Philippines)
Email: nix@parola.tech