Privacy Policy

Emcie Co Ltd. (registration number 516987971) ("Company", "we", "us" or "our") respects your privacy and is committed to protecting the personal information we collect and process. This Privacy Policy explains how we collect, use, share, and safeguard your data when you visit our website (at: emcie.co, parlant.io and dashboard.parlant.io) and use our service (the “Service”). This Privacy Policy covers our production services only: parlant.io, dashboard.parlant.io, our production APIs and the public documentation assistant at lighthouse.parlant.io, including access through the command-line tool. It does not cover development or staging environments, including platform.emcie.xyz.

We are committed to complying with guiding global privacy laws, including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable regulations.

1. Information we collect

We may collect the following categories of personal data:

a. Identifiers

• Name, email address, mailing address, professional details, IP address, unique identifiers (account ID, cookie ID) and other details when you register or contact us.

b. Account and authentication information

• Sign-in details provided through your login provider, account preferences, login history. Customers currently sign in through supported third-party login providers (Google and GitHub). We receive the account information that the provider supplies for sign-in, including your email address and name, and we keep account and profile preferences and authentication-session records. Email-and-password sign-in is not currently a supported sign-in method.

c. Commercial information

• Purchase information, including payment details and purchase history and subscription information (such as plan, billing period, invoices and payment status) (via third-party payment processors). Payments are currently collected only through Stripe, our payment service provider, which handles your payment details under its own terms and privacy notice. For the avoidance of doubt, we do not store your full payment card number or card security code (CVC). In the current integrated card payment flow, you enter your sensitive card details in Stripe-hosted payment fields and our application receives the resulting payment-method identifier. We do handle limited information about your payment method that the provider makes available to us, such as a provider identifier, the card brand, the last four digits and the expiry month and year of a card (or, for a bank account, the bank name, the last four digits, the account type and the type of account holder), together with your billing details. An invoice shows the billing details and purchase information for that charge.

d. Internet or network activity

• Browser type, operating system, device type, pages viewed, links clicked, session times, referral URLs, mobile carrier, Internet service provider. If analytics is on for your account, this also includes analytics events and session replays (see Section 8).

e. Geolocation data

• Approximate location derived from IP address. We use the country derived from your IP address to apply the regional analytics rule described in Section 8. The first time we detect your use from the EEA, the United Kingdom or Switzerland, even if you have used the Service from other countries before, we keep a record of that country, the time of that use (UTC) and the policy version, without storing your IP address in that record. When a person chats with a customer’s agent, we also derive an approximate location (for example a city or region) from that person’s IP address, save it with the session and show it to the customer’s team and to our staff. The customer is responsible for the notices to its own end users.

f. User-generated content

• Information and data you submit via the Service (which may include information of your customers), as well as messages and data you submit through forms or chat features. Feedback you submit about the Service (such as a rating, a note and the component or page it concerns) is stored with your user ID, email address, display name and the project concerned, so that we can understand, respond to and improve the Service. Feedback is linked to your account and is not anonymous statistics. We keep feedback for 24 months after the last activity in the Workspace concerned to improve the Service, then delete it, and delete it earlier on a valid request sent to [email protected]. Any license to use feedback that the Terms of Service give us is subject to a valid request to delete feedback that is your personal data. Feedback may be read by our company administrators and designated support and safety staff, who are our own personnel and not roles in your Workspace. If you use the public documentation assistant (Lighthouse) or its command-line tool, the question, context and client details that you send are stored with the answer, after pattern-based redaction of secrets, for review by our staff; redaction does not guarantee that the stored text is free of personal data. You can use the public documentation assistant anonymously, without a dashboard account. If you supply optional authentication and it is verified, the saved record may also carry your user ID and name and your workspace (tenant) ID and name. We use this identity information for proactive support and troubleshooting, to attribute queries to a user or workspace, and to remove your records when you ask. A record made without verified authentication does not carry them. We keep these records for 24 months after the last activity on the record (the date of the query), and then delete them, and they may be read by our company administrators and designated support and safety staff. Because free text and identity details may contain personal information, we do not treat these records as anonymous. The service returns a request ID for each saved query, which is one way to locate a record. We may also be able to locate records using other information that you give us, such as the user or workspace identity on an authenticated query, but we cannot promise to find every record that relates to you. We will honor requests to delete records that we can identify once the request is verified. For suitable answers, the assistant also rewrites the answer into a general question and answer with request-specific details removed, creates embeddings and saves it for reuse for other users; a link to the source record is kept. This is not model training, and we do not describe it as anonymous.

We may also collect inferred or derived information (preferences or interests based on usage).

2. How we collect information

We collect information:

• Directly from you (account creation, support inquiries, form submissions and the user-generated content we receive from you within the Service).

• Automatically, through cookies, web beacons, pixel tags, and similar tracking technologies. Where we or our service providers use cookies, you can control them through your browser settings, but note that disabling cookies may limit your ability to use certain features of the Service.

• From third-party services, such as analytics providers, payment processors, and authentication tools.

3. Purposes for collecting information, and standards of processing it

We collect and process your data for the following purposes:

• To provide, maintain, and improve our Service.

• To understand how the Service is used and to find errors and confusing steps (optional analytics and session replay; see Section 8).

• To personalize user experience and customize content.

• To manage accounts and enable login functionality.

• To process payments, manage subscriptions, renewals and plan changes, and fulfill transactions.

• To respond to customer service inquiries.

• To detect and prevent fraud, abuse, and security incidents.

• To comply with legal obligations and respond to lawful requests.

• To send administrative information (such as security updates).

• To send marketing communications (if legally permitted or with your consent).

Where we process, on behalf of our customers, personal data that they submit through the Service, the processing is done in compliance with Company’s Data Processing Addendum. We do not use the content that customers submit to the Service (Customer Data) for the purposes above, except as set out in the Terms of Service, the AI Terms and the Data Processing Addendum. Session replays of the dashboard mask the conversation area and personal data; see Section 8.

Our roles. Company acts as a controller for the personal information that we collect and use for our own purposes, such as creating and managing accounts, billing and subscriptions, support, security, service analytics and marketing, as described in this Privacy Policy. Where a customer uses the Service to process personal data of its own end users, customers or other individuals, the customer is the controller of that data and Company acts as its processor, on the customer’s instructions. Where a customer itself acts on behalf of another business, Company acts as that customer’s subprocessor. If you are an end user of a Company customer, please direct requests about data processed on that customer’s behalf to that customer, which is responsible for the notices and the lawful basis for that processing; we may refer your request to the customer.

Information received indirectly. We may receive personal information about you from others, for example from a customer that uses the Service with your data, or from your employer or organization that creates an account for you. In that case we obtain it from that customer or organization, and the categories of information are as described in this Privacy Policy.

Providing information. Some information, such as your email address, is needed to create an account and to provide the Service. For paid plans, billing details are needed to take payment and to provide the paid Plan. If you do not provide the information that is needed, we may be unable to open the account or provide the Service.

4. Sharing and disclosure of information

We may disclose your information to:

a. Service providers

Third parties who are providers or subcontractors of certain components of the Service or who assist us in related services such as hosting, IT support, analytics, customer service, payment processing, and email delivery. Any information shared with or otherwise collected by such service providers may be subject to their privacy policy. We are responsible for choosing our service providers and, where they process personal information on our behalf, for that processing as the law requires. A provider that collects information for its own purposes, such as a payment provider, is responsible for that processing under its own privacy notice.

b. Business transfers

If our business is sold, merged or transferred, your data may be transferred as part of that transaction, as permitted by law and/or contract.

c. Legal and regulatory authorities

When required by law or to protect our legal rights, users or third parties.

We do not sell personal data as defined under the CCPA.

5. Your privacy rights

Depending on your jurisdiction, you may have the following rights:

• Request access to and portability of your personal information;

• Request correction or rectification of your personal information where it is inaccurate or incomplete;

• Request deletion of your personal information (the “right to be forgotten”), which is a separate request from withdrawing consent or turning off analytics (see below);

• Request to opt out of the sale or sharing of your personal information;

• Request restriction of or object to our processing of your personal information;

• Withdraw your consent to our processing of your personal information (including your choice on optional analytics, which you can change at any time in your account Profile settings), and such withdrawal will take effect for future processing; it does not by itself delete information that was collected before the withdrawal, and it does not affect the lawfulness of the earlier processing (see below);

• Request to limit use of your sensitive personal data.

To exercise these rights, please contact us at [email protected]. We may request verification of your identity. To help us find your information, please tell us the email address of your account, the Workspace or Project concerned if you know it, and what you are asking us to do. If you act for someone else or for a Workspace, we may also ask for proof of your authority. A request to delete a user’s own data must come from that user’s registered email address. Only an Owner of the affected Workspace may authorize our handling of a request to delete shared Workspace data; we do not return Workspace data on request. These rules do not change the exports available in the dashboard or your individual rights under applicable law. The staff who handle requests are our own personnel and are separate from the Admins of a customer’s Workspace. We will let you know if we need more information. When a session is no longer shown in the Service, a Workspace is deleted, or analytics is switched off, this is not by itself a completed deletion request, and it does not by itself mean that every copy, including copies held by our service providers and in backups, has been deleted. We handle requests without undue delay and within the time limits that applicable law sets. When we have finished handling your request, we will email you to confirm what we deleted and to identify anything that we retained and the reason for retaining it. You also have the right to lodge a complaint with the data protection authority in your country of residence or place of work, or where the alleged infringement occurred. If your request concerns data that we process on behalf of a customer, we may refer it to that customer.

Turning analytics off and deleting earlier data. Turning off analytics or session replay (for example in your account Profile) or withdrawing your consent stops the capture of new analytics and replay data from that point. A choice made on one device may not take effect immediately on your other devices. Turning analytics off does not delete replays or other analytics data that were already collected and sent to our analytics provider. To ask us to delete that earlier data, contact us at [email protected]. To find the analytics records that relate to you, we may use the account identifier that we send to the analytics provider in place of your name or email, and we may ask you for the email address of your account and the Workspace or Project concerned. We handle requests without undue delay and within the time limits that applicable law sets. We use Microsoft Clarity under its standard terms. We cannot offer selective deletion of individual recordings through the controls that Clarity makes available, and we cannot commit to a custom arrangement with Microsoft. If you ask us to delete earlier analytics data, we will consider your request under applicable law and tell you what we can and cannot do. Earlier data is kept for the periods described in Section 7.

6. International transfers of personal information

We may process and store your information in countries outside your own. Where required, we use safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission or rely on adequacy decisions to legitimize cross-border transfers. You may contact us at [email protected] to obtain more information about the safeguards we use. Our standard Service does not include a commitment to store or process data only in a particular country or region; a data-residency commitment applies only where our separate written agreement with an Enterprise customer expressly provides for it.

7. Retention of personal information

Except where this Section describes a different company rule, we retain your personal information only as long as necessary for the purposes stated in this Privacy Policy, or to comply with legal obligations (tax, audit, accounting). We apply appropriate deletion procedures when data is no longer needed. Session history in the Service is available according to the retention limits of the subscription plan (by age and number of sessions). That limit applies to session history in the Service. It does not set how long analytics or session-replay data is kept by our analytics provider, which keeps that data on the provider’s own schedule. When a session is no longer available in the Service, related data may be retained or deleted as described in our Data Processing Addendum. Plan history and retention limits govern what you can see in the Service; they do not guarantee that data is physically deleted. We keep full conversations and related logs internally for 24 months after the last activity in the Workspace concerned, for usability improvements and safety purposes, and then delete them, and we do not describe this content as anonymized or reduced; the same applies to session data from the Starter plan. A “not private” label on the Starter plan does not by itself permit public disclosure or additional use such as model training, and it is not an exemption from privacy law or from your privacy rights. Information is not personal data only if it is genuinely anonymous, so that it no longer relates to an identifiable person. The content we retain internally may be accessed by our company administrators and designated support and safety staff, who are our own personnel and not roles in a customer’s Workspace. We will delete retained content on a valid, explicit privacy-deletion request sent separately to [email protected] (for shared Workspace data, authorized by an Owner of the Workspace, see Section 5); this internal purpose does not override such a request. Expiry of a plan’s history limit, clicking Delete project in the dashboard and an explicit request to delete retained data are different things, and only the last is a request that we delete retained content. Feedback is also kept for 24 months after the last activity in the Workspace concerned, and records of queries to the public documentation assistant for 24 months after the last activity on the record, as described in Section 1, and are deleted on a valid request subject to the conditions stated there.

8. Legal basis for processing (GDPR)

If you are located in the European Economic Area (EEA), we rely on the following legal bases:

• Consent (marketing emails; and optional analytics and session replay where we ask for your choice - see below)

• Contractual necessity (providing the Service)

• Legitimate interest (improving the Service; securing our platform)

• Legal obligations (maintaining transaction records).

Optional analytics and session replay. We use Microsoft Clarity, a third-party analytics service, to understand how the platform is used and to find errors and confusing steps. We use this analytics only to understand how the platform is used, to investigate bugs and to improve the product; we do not use it for advertising or ad targeting and we do not sell it. It provides usage analytics and session replays, which reconstruct the pages you view and how you use them; a replay is not necessarily a video of your screen. Analytics is optional, and you can refuse it. The conversation area of the platform, personal data and sensitive items such as payment details and secret tokens are masked, so that the content of conversations is not visible in a replay. Masking covers specific areas and is not a guarantee that every other item, such as a secret typed into a field that is not masked, is hidden. Your analytics choice applies to your own account only; it is not an instruction from your Workspace, and it is not a choice or consent given by the people whose conversations appear in the platform. In this Privacy Policy a session means a conversation between a customer’s agent and a person, as defined in the Terms of Service, and a session replay means a reconstruction of a browsing visit; they are different things.

How the regional rule works. Whether analytics runs for your account depends on your choice and on your location. (a) If you have made a choice, it applies everywhere, across all your workspaces and devices, wherever you are. (b) If you have not made a choice and we have never detected your use from the EEA, the United Kingdom or Switzerland, analytics may run by default while your location, derived from your IP address, is verified as outside those regions; you can turn it off at any time in your Profile settings, and no choice is saved for you by the default. (c) If you have not made a choice and your location is in the EEA, the United Kingdom or Switzerland, we ask for your choice before analytics starts. (d) Once we have detected your use from the EEA, the United Kingdom or Switzerland for the first time, we ask for an explicit choice from then on, even if your earlier use was from another country and even if you later return to another country. (e) If we cannot determine your location and you have not made a choice, analytics stays off. The countries listed are a product rule. They do not mean that the GDPR, or any single law, is the only privacy law that applies to you, and this Policy does not state that analytics that run by default are lawful in every other country.

Your choice and our records. You can change your choice at any time in your Profile settings. A change made on one device may take a short time to reach your other devices; it is not an instant switch-off everywhere. For your latest explicit choice we keep the choice itself, the time it was made (UTC) and the version of the notice shown to you. Separately, we keep a record of the country, time (UTC) and policy version of the first time we detected your use from the EEA, the United Kingdom or Switzerland, kept separately from your choice. That record is not a consent and does not mean that you have agreed to anything. Your browser may keep a copy of your choice only to display your current setting; it is not the record of your choice. Whether analytics may run is rechecked with our servers before it starts and then at short intervals, and a copy in your browser is not what permits it. Turning analytics off stops future capture and does not by itself delete earlier data (see Section 5).

9. Children’s privacy

Our Service, including registering for and using an account, is intended for adults aged 18 or over and is not intended for children under age 18. We do not knowingly collect personal information from children for our own purposes. Our customers may use the Service to build and run agents that communicate with their own users. Customers decide who may communicate with their agents, and we do not verify the age of those individuals and do not restrict it, except as the law requires. Where a customer’s agent receives personal data from a child or sensitive information, we process it on the customer’s behalf under our Data Processing Addendum, and the customer is responsible for the notices and lawful basis it requires. If you believe a child has provided us with personal data, please contact us at [email protected] so we can take appropriate steps. If the data was submitted to a customer’s agent, we may refer your request to that customer.

10. Data security

We implement technical, administrative and physical security measures to protect your data against unauthorized access, alteration, disclosure or destruction, including:

• Encryption in transit and at rest;

• Access control and authentication systems;

• Regular security assessments and monitoring.

Despite these efforts, and though we regularly review and update our security practices to adapt to new threats and technologies, know that no system is 100% secure.

11. Updates to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date. Your continued use of the Service and/or our website after we make such changes constitutes acceptance of the updated policy. Where the law requires your consent to a change, we will ask for it. We encourage you to review this page periodically. Material changes are notified as provided in Section 19.7 of the Terms of Service.

12. Contact Us

If you have questions, requests, or complaints regarding this Privacy Policy, you may contact us at: [email protected]

Company: Emcie Co Ltd., registration number 516987971, registered address HaCarmel 16, Ganei Tikva 5591616, Israel.

Last Updated: November 1, 2026