Privacy Policy

Summary

• We collect what we need to run the Service, bill you, and improve the product. Nothing more.
• We do not sell your personal information. Ever.
• We use anonymized aggregated usage data to improve Parley, including to train and refine models that make Parley better. Your consent to this use is part of our Terms of Service.
• You can export all of your data or delete your account at any time from the dashboard.
• We use industry-standard security practices and rely on a small set of vetted sub-processors (listed below).

What we collect

Account information

When you sign up, our identity provider (WorkOS) collects and stores your name, email address, and (if you use a social login) your provider's user identifier. We mirror your user identifier, name, and email into our database so we can associate your sessions with your account.

Billing information

When you upgrade to a paid plan, our payment processor (Stripe) collects and stores your billing address, payment card details, and transaction history. We never see or store your full payment card details. We do store the Stripe customer identifier and the plan you're on so we can enforce plan limits and surface invoices to you.

Service content

When you use Parley, you create planning sessions ("parleys") in which you describe a product idea and answer questions about it. We store:

• The session's working title, summary, and design-axis answers
• The epics and features Parley proposes and you confirm, edit, or drop
• The drafted issue content (titles, descriptions, labels, priorities)
• Convention overrides you make per session
• Code anchors you attach during a session
• Linear identifiers for any project, milestone, or issue Parley creates on your behalf

We store these so Parley can resume sessions across chats, drive the four-phase lifecycle, and write the right data to your Linear workspace.

Integration credentials

When you connect a Linear workspace, you authorize Parley via Linear's OAuth flow. We store the resulting access token and refresh token, encrypted at rest with AES-256-GCM. We use these tokens only to perform actions you authorize during your sessions. You can revoke our access at any time from Linear's OAuth apps settings; once revoked, we can no longer read or write to your workspace.

If you connect a private GitHub repository for your conventions (after we ship that feature), we store the GitHub App installation identifier. We do not store your GitHub user credentials.

Outcome telemetry (Linear webhooks)

When you connect a Linear workspace, Parley subscribes to webhooks for issues tagged with the plan label (issues Parley wrote). We receive and store events about those issues only: creation, updates, label changes, state transitions, assignee changes, and comments. We use this telemetry to give you a view of what happened to issues Parley planned, and to compute aggregated anonymized signals about planning quality.

We do not subscribe to webhooks for issues Parley did not write. We do not receive events about your team's other Linear activity.

Usage telemetry

We collect application telemetry to operate and improve the Service:

• MCP tool calls (which tools, when, how long they took, success vs error, identity of the caller)
• API request logs (timestamps, request paths, status codes, response sizes)
• Audit log entries for security-relevant actions (workspace connection, token issuance, account deletion, etc.)
• Error reports (stack traces, request context) sent to Sentry for diagnosing crashes
• IP address of clients calling the MCP endpoint (for security and abuse prevention; rolled up daily)

Aggregated anonymized analytics

We compute aggregated, anonymized signals from all of the above. These signals do not contain your organization identifier, user identifier, or any free-text content from your sessions. They contain structural fingerprints of planning patterns and outcomes that we use to improve Parley and, where applicable, to train or refine models that make Parley better.

Your consent to this use is documented in our Terms of Service. We do not sell these signals, and we do not share them with any third party.

How we use what we collect

We use the information we collect to:

• Provide the Service: run your sessions, write to your Linear workspace, enforce your plan, and let you sign in
• Bill you: process payments, send receipts, manage your subscription
• Improve the product: analyze how Parley is used in aggregate, find bugs, and refine features
• Train and refine models: use aggregated anonymized signals (as described above) to make Parley a better planning partner over time
• Communicate with you about the Service: critical product announcements, security notices, billing emails, and (if you've consented) product updates
• Provide support: respond to your questions and resolve issues you report
• Protect the Service: detect, prevent, and respond to abuse, fraud, and security threats
• Comply with the law: respond to lawful requests and enforce our Terms of Service

Who we share information with

We share information with a small set of vetted sub-processors that help us run the Service. We do not sell your personal information to anyone.

Sub-processors

Per Anthropic's API terms, data submitted to Anthropic's API is not used to train Anthropic's models.

We commit to giving you at least 14 days' notice before we add a new sub-processor or change the role of an existing one. See our Data Processing Agreement for the full sub-processor commitments.

Legal and safety

We may share information when we believe in good faith it is necessary to:

• Comply with applicable law, legal process, or a binding government request
• Enforce our Terms of Service
• Detect, prevent, or respond to fraud, security, or technical issues
• Protect the rights, property, or safety of Vyntric, our users, or the public

Business transfers

If Vyntric is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred to the successor entity. We will notify you before your information becomes subject to a different privacy policy.

Your rights and choices

You have the following rights regardless of where you live. If you are in the European Economic Area, the United Kingdom, Switzerland, or California, the same rights are afforded to you by law (GDPR, UK GDPR, FADP, CCPA, and CPRA).

Access and portability

You can download a complete export of your data at any time from Settings, Export my data in the dashboard. The export includes all service content associated with your organization, formatted as JSON.

Deletion

You can delete your account at any time from Settings, Delete account in the dashboard.

• If you are the owner of your organization, deleting your account deletes the entire organization, cancels any active Stripe subscription (no refund for the current period), and removes the organization from WorkOS. All organization data is permanently deleted from our primary database within 24 hours.
• If you are not the owner, deleting your account removes only your personal user record and revokes your access tokens. The organization and other members are not affected.

Some data may remain in backups for up to 30 days after deletion before being expunged. Aggregated anonymized signals derived from your data (which by definition do not identify you) are not affected by account deletion.

Correction

You can edit your name, email, and timezone at any time from Settings in the dashboard. To correct any other information, email privacy@vyntric.com.

Objection and restriction

You may object to or restrict our processing of your information at any time by cancelling your account. While your account is active, our processing is necessary to provide the Service you've subscribed to.

Marketing preferences

We do not currently send marketing email. If we begin to do so, every message will include a clear unsubscribe link.

How to exercise your rights

Most rights are exercisable from the dashboard. For anything not covered there, email privacy@vyntric.com from the email address associated with your account. We will respond within 30 days.

If you live in the European Economic Area or the United Kingdom and believe we have not handled your information correctly, you have the right to lodge a complaint with your local data protection authority.

Data retention

We retain your information for as long as your account is active or as needed to provide the Service. After account deletion:

• Primary database: all organization data is deleted within 24 hours
• Backups: data is purged within 30 days of deletion
• Billing records: retained per applicable tax and accounting law (typically 7 years)
• Aggregated anonymized signals: retained indefinitely (these do not identify you)

Security

We use industry-standard security practices to protect your information:

• TLS 1.2 or higher for all data in transit
• AES-256-GCM encryption for sensitive credentials at rest (Linear OAuth tokens, GitHub App tokens)
• Network-level isolation via Vercel and Neon
• Role-based access controls limit which Vyntric personnel can access production systems
• Audit logging of all administrative actions
• Sentry error tracking with PII scrubbing on stack traces
• Regular dependency vulnerability scanning

No method of transmission or storage is 100% secure. While we strive to protect your information using commercially reasonable means, we cannot guarantee absolute security. If we become aware of a security breach that affects your information, we will notify you and the appropriate authorities as required by applicable law.

International data transfers

Parley is operated from the United States, and our sub-processors are primarily based in the United States. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States.

For users in the European Economic Area, the United Kingdom, and Switzerland, we rely on the Standard Contractual Clauses (SCCs) and equivalent transfer mechanisms to lawfully transfer personal data. See our Data Processing Agreement for the relevant transfer commitments.

Children

Parley is not directed to anyone under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, email privacy@vyntric.com and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the Last updated date at the top of the page and, for material changes, notify you by email or through the dashboard. Continued use of the Service after a change indicates your acceptance of the updated policy.

We keep a version history of this policy. Past versions are available on request from privacy@vyntric.com.

Contact

For any privacy question, request, or complaint:

• Email: privacy@vyntric.com
• Postal: Vyntric, Inc., (mailing address available on request)

For general support questions, email support@vyntric.com.