Privacy Policy — Palanae

1. Two kinds of information, two roles

• Account and billing data— information about you as a user and about your organization's subscription. For this data we are the controller: we decide how it is used, as described in this policy.
• Customer Data — everything your organization and its users put into Palanae: contacts, organizations, notes, documents, transcripts, action items, and anything AI features derive from them. For Customer Data we are a processor, acting on your organization's instructions under the Terms of Service and its Data Processing Addendum. Your organization is responsible for the privacy of the people whose information it stores in Palanae, including giving them any notices the law requires.

2. Account data we collect

• Email address — used to sign you in (email link or password) and to send account messages.
• Sign-in and session records — session cookies and the time and origin of sign-ins, to keep your account secure.
• Billing status— your organization's plan, invoices, and payment state. Card details are entered directly with Stripe, our payment processor, and never touch our systems.
• Operational logs — error and activity logs needed to run and secure the service, including an audit trail of which user performed which action.

Palanae uses essential cookies only — the ones required to keep you signed in and remember your preferences. There are no advertising or tracking cookies and no third-party analytics.

3. How we use account data

To provide the service, sign you in, bill your organization, respond to support requests, keep the service secure, and meet legal obligations. We send transactional email (sign-in links, invitations, billing notices) and no marketing email without your consent.

4. Customer Data

We process Customer Data only to provide, support, and secure the service for your organization and as its documented instructions direct. We do not use Customer Data to train AI models, and we configure our AI providers so they do not use it to train theirs. AI features propose values for a person to review; the service marks what was AI-proposed versus human-entered, and proposals do not become records without confirmation.

5. Service providers (subprocessors)

The companies that help us run Palanae and may handle Customer Data are listed at www.palanae.ai/subprocessors. As of this policy's date they are Supabase (database and storage hosting), Vercel (application hosting), Stripe (billing), Resend (transactional email), Anthropic (AI model inference), and Deepgram (speech-to-text). We give organizations 30 days' notice before adding one. We do not sell or share personal information for advertising.

6. Retention and deletion

Account data is kept while your account is active and for as long afterward as our legal and accounting obligations require. When an organization's subscription ends, Customer Data stays available for export for 30 days, is deleted from active systems within 60 days, and is purged from backups within 90 days, unless the law requires us to keep it. Individual users can be removed by their organization's administrator at any time.

7. Security

Data is encrypted in transit. Each organization's data is isolated at the database level (row-level security). Administrative access requires multi-factor authentication. We keep routine backups. If we confirm a breach affecting Customer Data, we notify the affected organizations without undue delay with the information they need for their own notices.

8. Where data is stored

Palanae is hosted in the United States. If your organization stores information about people in the EU or UK, the Data Processing Addendum in the Terms of Service covers the required transfer terms.

9. Your rights and choices

You can update your email and preferences in the app. To access, correct, or delete account data, or to ask about Customer Data held about you by an organization using Palanae, email legal@strainge.org; where the request concerns Customer Data we will pass it to the organization that controls it and help them respond.

10. Children

Palanae is a business tool and is not directed at children under 13; we do not knowingly collect their information.

11. Changes

We will post any material change here, update the date at the top, and notify organizations at least 30 days before a change that reduces their rights.