Privacy policy

Plain-language policy for the design-partner phase; a counsel-reviewed version will replace it before general availability.

Roles

For the website and console accounts, Paraph is the controller. For the run content your agents send (messages, tool calls, decisions), your organisation is the controller and Paraph is a processor acting on your instructions — a data processing agreement is part of every pilot.

What we collect

  • Account data — name and email, via WorkOS sign-in.
  • Workspace content — exactly what your agents send to the record, plus the approvals, notes, and exports your team creates. You control what goes in; ingestion caps field sizes.
  • Operational logs — security-relevant actions (exports, credential changes) in your workspace’s own audit log; minimal server logs for reliability.
  • Website — no advertising trackers. We use Vercel Web Analytics: cookie-less, aggregate page counts with no cross-site identifier. If you request a pilot through the form, we store exactly the fields you typed — nothing captured behind your back, no IP address kept.

Why (legal bases)

To provide the service you asked for (contract); to secure it and keep honest records of security-relevant actions (legitimate interest); to meet legal obligations. We don’t sell personal data, run advertising, or train models on your content.

Where it lives

See Trust & security for the current hosting map and subprocessor list — including the honest state of our EU migration. Where data is processed outside the EU/EEA today, transfers rest on standard contractual clauses with the named subprocessors.

Retention & erasure — inside a tamper-evident record

Records are kept for as long as your workspace needs them; retention terms are set per agreement. Erasure requests are honoured by tombstoning: the content is deleted, while the event’s hash and chain linkage are preserved — so your record satisfies the right to erasure and still proves nothing was silently removed. We think that’s what both laws actually want.

Your rights

Access, rectification, erasure, restriction, portability, and objection — write to hello@paraph.ai. For workspace content, we’ll route requests to your organisation (the controller) and execute their instruction. You may also complain to your supervisory authority.

Last updated 13 July 2026.