Privacy Policy

1. Introduction

Welcome to Parchai.ai ("we," "our," or "us"). At Parchai, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service").

This policy explains what we collect and why. Where we rely on your consent, for example to import phone-book contacts, we ask for it separately and you can withdraw it at any time. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

We collect several types of information from and about users of our Service in the past 12 months:

• Personal Identifiers: Name, email address, phone number, unique device identifiers, and IP address collected directly from you during registration and usage.
• Contact and Event Information: Information about your contacts (with their permission) and events you create or participate in through the Service, collected from your interactions with our platform.
• Commercial Information: Records of credit and subscription purchases, payment methods, billing address, and transaction history for billing and receipt purposes. For purchases made inside the mobile apps, Apple or Google is the seller and holds your payment details; we keep only the record of the purchase and the credits it granted.
• Internet/Electronic Activity: Information about your interactions with our Service, including features used, content viewed, search queries, and AI conversation logs.
• AI Training Data: Aggregated and anonymized interaction patterns used to improve our AI systems' recommendations and user experience (no personal data is used for AI training without explicit consent).
• Inferences: Profiles reflecting your preferences, characteristics, and behaviors derived from your usage patterns to provide personalized event recommendations.
• User-Uploaded Content: Images, music, and other media files you upload to Parchai Occasions or other services. This content is stored securely and used only to provide the invitation and event services you request. Photo contest entries are kept in private storage and shown only through expiring links to the people the host shares the contest with. They are never analyzed by AI, their location and camera data are removed before upload, and they are deleted when removed from the contest or when the account that entered them is deleted.
• Party Card Game Choices: In The Room Where It Happens, the private choices players make (votes, “I have” or “Never” answers, guesses, It’s Mutual picks, and Go public or Keep it private decisions) are wiped from the game when they are counted or matched, and no screen or host can see who chose what. A one-sided It’s Mutual pick is never revealed, and a match is shown only if both players choose Go public. When a player taps “That’s me,” that choice is shown to the table and kept with the game’s results. Pants on Fire answers and The Little Birdie retellings are shown to the table with their authors after the reveal or replay and kept with the game’s results; a Little Birdie rumor shows real names from the table but is made up by the game. Each player’s nickname is kept for the game’s 30 days. If you confirm you’re 18 or older to play Scandalous cards, the time you confirmed is saved on your account so you aren’t asked again.
• Private Record of Game Transactions: Parchai keeps a private record of game transactions for future game development. Details are completely private and never shared outside Parchai.

Sources of Information: We collect this information directly from you, automatically through your use of our Service, from third-party authentication providers (with your consent), and from publicly available sources when you choose to connect social media accounts.

3. How We Use Your Information and AI Processing

We use the information we collect for the following business purposes:

• Service Provision: Provide, maintain, and improve our AI-powered event planning Service
• Event Management: Process and manage event planning, coordination, and AI-generated recommendations
• AI Processing: Train and improve our AI systems to provide personalized event suggestions and smart scheduling (using only aggregated, anonymized data)
• Communication: Send you event notifications, service updates, and promotional messages (with opt-out options)
• Analytics: Analyze usage patterns to enhance user experience and develop new features
• Security: Detect, prevent, and address technical issues, fraud, and security threats
• Legal Compliance: Comply with applicable laws, regulations, and legal processes
• Image Processing: Analyze uploaded images using AI to extract color palettes and styling suggestions for your invitation designs (Parchai Occasions)

Legal basis (GDPR): we process your account details, events, guest lists and payments to provide the Service you have signed up for. That is performance of a contract (Article 6(1)(b)). Security, fraud prevention, analytics and service improvement rely on our legitimate interests (Article 6(1)(f)). Contacts import relies on your consent (Article 6(1)(a)), described in section 6. Where we must keep records for tax or legal reasons, the basis is legal obligation (Article 6(1)(c)). Providing your name, phone number and email is necessary to create an account; without them we cannot provide the Service.

AI Processing Disclosure: We use artificial intelligence systems to analyze your event preferences and provide personalized recommendations. For Parchai Occasions, we use AI to analyze uploaded images for color extraction and styling suggestions. This AI processing is performed on our secure servers. Uploaded images are not used for AI training purposes and are only processed to provide the services you request.

4. How We Share Your Information

We may share your information in the following circumstances:

• With Your Consent: We may share your information when you direct us to do so.
• Event Participants: Information about events you create may be shared with participants you invite.
• Service Providers: We work with third-party service providers to perform functions on our behalf, such as hosting, data analysis, and customer service. A full list of our sub-processors is in the next section.
• Legal Requirements: We may disclose your information if required by law, such as in response to a court order or subpoena.
• Business Transfers: If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Sub-processors

We use the following third-party processors to provide the Parchai service. Each processor receives only the data necessary for their specific function, under that provider's standard data processing terms.

For processors located in the United States, we rely on Standard Contractual Clauses (SCCs) and supplementary measures to protect data transferred from the European Economic Area, United Kingdom, or Switzerland.

Detailed retention periods and deletion procedures for each processor are described in the "Data Retention" and "Your Privacy Rights" sections below.

6. Contacts Import (Mobile App)

If you use the Parchai mobile app, you can choose to import phone-book contacts during onboarding to make guest-list building easier. When you opt in, we ask for your device's Contacts permission and read the following for each contact you select:

• First name, last name
• Phone number(s)
• Email address(es)

Where this goes: imported contacts are stored in our database as your private address book. Only you can see them. They are never shared with other users or used for marketing.

If you do not opt in, contacts stay on your device and are never read by us.

Legal basis (GDPR): consent (Article 6(1)(a)). You can revoke by clearing imports in Account → Contacts, or by deleting your account (which wipes all imports).

Retention: until you delete them individually or delete your account.

We do NOT send your contact list to OpenAI, Stream.io, or any other processor. Contacts are used only to populate your guest-list suggestions within Parchai.

7. Error Monitoring

To keep Parchai functioning reliably, we collect technical error reports when something goes wrong in your browser or device while using Parchai. These reports are stored on our own servers. We do not use a third-party error monitoring service for this data.

What is recorded in an error report:

• Your Parchai account identifier (a unique ID generated at signup) and, if you've provided them, your email address and display name
• The masked last four digits of your phone number as a support handle (e.g., "***-1234"), never your full phone number
• The error message and the technical location in our code where it occurred
• The URL you were on when the error occurred (with sensitive parameters such as invite tokens, authentication tokens, and verification codes removed before saving)
• Your browser type, version, and viewport size
• A short breadcrumb trail of your recent actions in Parchai (pages visited, buttons clicked) in the seconds leading up to the error

What is NOT recorded:

• Your full phone number (only the masked last-four digits as described above)
• Content of your events, guest lists, or messages
• Payment or billing information
• Cookies or authentication tokens

Why we include identifiers: With identifiers, we can see when the same person hits an error repeatedly and help them faster. When you contact support about an error, we can immediately find the matching report and investigate without asking you for technical details.

Legal basis (GDPR): legitimate interest (Article 6(1)(f) GDPR), namely our interest in maintaining a reliable and secure service and in providing responsive support to you. We have conducted a Legitimate Interest Assessment concluding that the benefits to both operational quality and to you as a user outweigh the minimal impact of this pseudonymous identification.

Data location: Same as our primary database. Our error monitoring system runs on the same infrastructure and is not exposed to any third party.

Retention: Error reports are automatically deleted after 90 days.

Deletion on request: When you delete your Parchai account, we also delete all error reports associated with your account identifier as part of the same deletion process.

8. AI-Assisted Features

Parchai offers AI-assisted features for hosts. For example, suggested follow-up messages to guests who haven't responded to an invitation, or suggested event design defaults. To generate these, we send limited information to OpenAI (operated by OpenAI, LLC, 3180 18th Street, San Francisco, CA 94110, USA).

What is sent to OpenAI:

• Guest first names (from your guest list)
• Event titles
• The domain portion of guest email addresses (e.g., "gmail.com"), not the full email address

What is NOT sent to OpenAI:

• Full guest email addresses
• Phone numbers
• Payment data
• Your own personal information beyond your name

Legal basis (GDPR): legitimate interest (Article 6(1)(f) GDPR), because you benefit from higher-quality AI assistance when we provide context. You can object to this processing at any time by emailing privacy@parchai.ai.

Retention: OpenAI deletes API request data after 30 days under our enterprise terms. We do not use OpenAI data for model training.

Data location: United States.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit and at rest, row-level access controls on every database table, authenticated access to all account data, and documented incident response procedures.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

10. Your Privacy Rights (CCPA, GDPR, and State Laws)

Depending on your location, you may have the following rights regarding your personal information:

California Consumer Privacy Rights (CCPA/CPRA):

• Right to Know: Request disclosure of categories and specific pieces of personal information collected
• Right to Delete: Request deletion of personal information (subject to certain exceptions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information
• Right to Limit: Limit the use and disclosure of sensitive personal information
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your rights

European Privacy Rights (GDPR):

• Right of Access: Obtain confirmation of processing and access to your personal data
• Right to Rectification: Correct inaccurate or incomplete personal data
• Right to Erasure: Request deletion of personal data under certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Lodge a Complaint: File a complaint with your local data protection authority (per Article 77 GDPR)

How Account Deletion Propagates to Our Processors

When you delete your account, we automatically:

• Delete or anonymize your data in our own systems (this includes our in-house error monitoring and your stored push notification tokens)
• Delete your customer record at Stripe
• Delete your SMS history at Twilio
• Delete your account and conversations at Stream.io, if you used chat in the mobile app
• Confirm the deletion in our internal audit log

Our other processors hold your data only briefly and delete it on their own schedule: Twilio (SMS logs) and SendGrid (email delivery logs) after 30 days, and OpenAI after 30 days under our enterprise terms. If you would like us to raise a deletion request with a specific processor, email privacy@parchai.ai and we will do so.

Deletion is processed within 30 days of your request. You will receive an email confirmation when deletion is complete.

What We Keep After Deletion

Events you created are kept but anonymized, with your name, email address and the venue's street address removed, because the guests you invited hold their own record of attending. We also keep a record that the deletion took place.

Other Choices:

• Account Settings: Update your profile information
• Location Services: Control precise location sharing through device settings (mobile app)
• Communication Preferences: Essential service emails (receipts, security alerts, account notifications) cannot be disabled, as they are records required to operate the service. For anything else, see the next item or email privacy@parchai.ai
• Billing and Promotional Email Opt-Out: Every billing or promotional email we send includes an unsubscribe link, and your browser or mail client may also offer a one-click unsubscribe. Opting out stops that category of email; transactional messages (receipts, security alerts) continue, as they are required records
• AI Personalization: Object to AI-based personalization at any time by emailing privacy@parchai.ai
• Data Export: Request a copy of your personal data through the Data tab in your account settings

11. Data Retention

We retain personal data for the periods listed below. When a retention period ends, we delete or anonymize the data.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We implement appropriate safeguards including:

• Standard Contractual Clauses for EU data transfers
• Adequacy decisions where applicable
• Additional security measures for sensitive data

13. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email and in-app notifications. Continued use after changes constitutes acceptance.

14. Contact Information