Parter App Privacy Policy

This Privacy Policy applies to your use of the Parter application. For the parter.ai website, see the Website Privacy Policy.

Effective date: 1 November 2026 · Version: 1.0

1. Who we are and what this policy covers

1.1 This policy explains how Parter Inc., a Delaware corporation with offices at 1412 Broadway, New York, NY 10018, USA ("Parter", "we"), collects and uses personal data when you visit parter.ai, create an account, or use the Parter platform (the "Service").

1.2 For your account, billing and usage data, Parter decides how and why the data is processed (we are the "controller"). For personal data inside content you upload, such as a supplier contact name in a BOM, we process it only on your instructions (we are the "processor"); the Data Processing Addendum ("DPA") governs that processing, not this policy. Some providers we work with, such as our payment processor and sign-in providers, also process your data for their own purposes (fraud prevention, security, legal compliance) under their own privacy policies.

1.3 This policy is part of the Terms of Service. Capitalized terms have the meaning given there.

2. Data we collect

You give us

• Account data: name, work email, password (hashed), organization name, role, profile picture if you add one.
• Billing data: billing address, tax ID if you provide one. Card numbers go directly to Stripe; we see only the card brand, last four digits and expiry.
• Content: BOMs, part lists, files, notes and settings you upload or create. These may contain personal data you choose to include.
• Communications: support requests, emails, survey answers and feedback.
• Marketing preferences: whether you have opted in to marketing email.

We collect automatically

• Usage data: pages and features used, searches run, buttons clicked, time spent, error logs.
• Device and connection data: IP address, browser, operating system, screen size, language, referring page.
• Cookies and similar technologies: see clause 8.

We receive from others

• Payment status from Stripe.
• Authentication data from your identity provider if you sign in with Google, Microsoft or single sign-on.
• Business contact details from public sources and data providers, used for sales and marketing to companies that fit our product (see clause 3.4).

2.1 We do not knowingly collect sensitive personal data (health, biometrics, racial or ethnic origin, political or religious beliefs, sexual orientation) and ask you not to include it in content you upload.

3. How we use data

3.1 To provide the Service: create and secure your account, run searches and BOM analyses, send alerts, process payments, and provide support.

3.2 To improve the Service: understand which features are used, fix errors, test changes, and measure performance. We use usage data for this. We may look at your content to support you or fix a problem in your account, as the Terms allow (clause 8.1). We do not use your content to improve the Service for other customers unless clause 3.7 applies.

3.3 To communicate with account holders: service and billing emails (part of the Service, you cannot opt out while you have an account), and marketing emails only if you opt in. Every marketing email has an unsubscribe link.

3.4 To reach prospective business customers: separately from opted-in marketing, we may contact people in their business role at companies that fit our product, using business contact details from public sources and data providers. We do this only where applicable law allows business-to-business outreach without prior consent, we identify ourselves and explain where we got your details in the first message, and every message has a way to opt out. You can ask us to stop at any time and we will add you to a suppression list.

3.5 To protect Parter and others: detect abuse, enforce the Terms, and meet legal obligations.

3.6 We do not sell personal data, and we do not share it with advertising networks for cross-context behavioural advertising. Our analytics provider processes data only on our behalf (clause 8).

3.7 AI processing. The Service uses AI models to generate outputs such as risk scores, alternatives and chat answers, which means your content is processed by those models (including third-party model providers under contract, see clause 5.1) to serve you. That is processing, not training: our main model provider does not use your content to improve its products or general models. Its published policy allows it to retain prompts and responses for up to 55 days for abuse monitoring, policy enforcement and legal compliance, to have authorized staff review content flagged as abusive, and to train models used only for policy enforcement on that logged data. We do not use your content, or outputs generated from it, to train models unless your organization's admin turns that option on; if they do, only de-identified data is used (Terms, clause 8.2). Searches you run, prompts you type and error logs may contain fragments of your content; we treat them as content and do not use them to improve the Service for other customers. Session recordings mask typed input and do not capture the content of requests to our servers.

4. Legal bases (EU, UK and similar laws)

• Performing our contract with you: clause 3.1 and service emails in 3.3, where you are the account holder.
• Our legitimate interests: clauses 3.2, 3.4 and 3.5, including in-product analytics (clause 8); processing data of employees who use the Service under their employer's account; keeping our business secure. We balance these against your rights and you may object.
• Your consent: marketing emails to account holders and optional AI training (clause 3.7). You can withdraw consent at any time.
• Legal obligation: tax, accounting and responding to lawful requests.

5. Who we share data with

5.1 Service providers that help us run the Service, under contracts that limit them to our instructions: cloud hosting, database and search infrastructure, authentication, product analytics, email delivery, customer support and CRM tools, AI model providers that generate Outputs (bound not to train on your content), and a web-search provider that receives short part queries only. Some providers also act for their own purposes under their own policies: our payment processor (Stripe) for fraud prevention and payment regulation, and your sign-in provider (Google, Microsoft or your SSO) for authentication. Business customers can see the current provider list in the DPA; anyone can request it at support@parter.ai.

5.2 Your organization: if you use the Service under an organization account, its admins can see your name, email, role and activity in the Service.

5.3 Legal and safety: when law requires, to protect rights or safety, or to enforce the Terms.

5.4 Business transfers: if Parter is involved in a merger, acquisition or sale of assets, personal data may transfer with the business. We will tell you before your data becomes subject to a different privacy policy.

5.5 With your direction: for example when you connect a third-party tool or share a report.

6. International transfers

6.1 We are based in the United States and process data there and in other countries where our service providers operate. If you are in the EU, UK or Switzerland, your data (whether you are a website visitor, a prospect or a user) is transferred to the United States under the EU Standard Contractual Clauses and the UK Addendum, which form part of our agreements with the providers that process it, plus the safeguards in clause 9. You can request a copy of the clauses, with commercial details removed, at support@parter.ai. Business customers find the full transfer terms in the DPA.

7. How long we keep data

• Customer Content (BOMs, files, notes): exportable while you have access and for 30 days after your paid subscription, trial or Free plan ends; deleted within 60 days after that window, except content you keep under a valid Free plan after a downgrade (Terms, clause 16.4).
• Account records (name, email, organization, plan history): kept while your account exists; deleted within 60 days after you close it, except the minimum needed for the records below.
• Billing records: 7 years under our record-keeping policy, which follows common tax and accounting requirements.
• Usage and analytics data: up to 24 months in identifiable form, then aggregated or deleted.
• Support communications: 3 years after the ticket closes.
• Prospect contacts (clause 3.4): deleted after 24 months without engagement, or when you ask.
• Suppression list: only the email address needed to honour your opt-out, kept for as long as the opt-out should apply.
• Backups: encrypted copies are retained for disaster recovery with restricted access. If we restore from a backup, we re-apply deletions made since that backup, so deleted data does not return to live systems.
• Deletion requests: handled under clause 10 within the legal deadlines, regardless of the periods above, except where law requires us to keep the data.

8. Cookies and analytics

8.1 We use cookies and local storage for three purposes:

• Essential: sign-in, security, remembering your settings. These cannot be turned off.
• Analytics: understanding how the Service is used. Inside the Service we use PostHog (US-hosted) to record pages viewed, features used, performance timings, device type and approximate location from IP. It also records sessions: the pages shown and where you click. Typed input is masked and the content of requests to our servers is not captured; text already displayed on the page, such as part numbers in a BOM table, may appear in a recording. Because recordings can contain Customer Content, they follow the Customer Content deletion rules in clause 7, not the longer usage-data period. Analytics runs only inside the Service, after you have signed in and accepted the Terms and this policy; it does not run on our public website. We do not ask for separate consent before it starts; the controls in clause 8.2 let you stop it.
• Marketing: we do not currently use advertising or campaign-measurement cookies on the website or in the Service. If we add any, we will update this policy first.

8.2 You can stop analytics by sending a Global Privacy Control signal from your browser, by using a content blocker, or by asking us at support@parter.ai to exclude your account. Blocking essential cookies will stop the Service from working.

8.3 We treat a Global Privacy Control signal as an opt-out from any "sale" or "sharing" under US state law, and we also voluntarily treat it as declining analytics and marketing cookies.

9. Security

9.1 We encrypt data in transit and at rest, limit staff access to what their role needs, log access to production systems, and test our defences. No system is fully secure; tell us at support@parter.ai if you believe your account has been compromised.

9.2 If a security incident affects personal data we hold as controller (your account, billing or usage data), we tell you without undue delay after we become aware of it and notify regulators where law requires. For personal data inside a customer's content, we notify that customer under the DPA and they decide how to inform the people concerned.

10. Your rights

10.1 Everyone. You can access, correct, export and delete your account data in Settings, and unsubscribe from marketing in any email. For anything else, email support@parter.ai. We respond within the deadline the applicable law sets (one month under the GDPR and UK GDPR, 45 days under California law), and if we need an allowed extension we tell you within that period and explain why. Our internal target is 30 days. We may ask you to verify your identity.

10.2 US state residents (California, Colorado, Connecticut, Virginia, Texas and others). You have the right to know what personal data we hold, to delete it, to correct it, to obtain a copy, and not to be discriminated against for exercising these rights. We do not sell personal data or share it for cross-context behavioural advertising, so there is currently no sale or sharing to opt out of. We still treat a Global Privacy Control signal as an opt-out, and you can decline analytics as described in clause 8.2. California residents may use an authorised agent. If we deny a request, you may appeal by replying to our decision.

10.3 EU, UK and Switzerland. You have the rights of access, rectification, erasure, restriction, portability, and to object to processing based on legitimate interests, including direct marketing. You may withdraw consent at any time. You may complain to your local data-protection authority; we would appreciate the chance to resolve the issue first. We have assessed that we are not currently required to appoint an EU or UK representative and will appoint one if that assessment changes.

10.4 Organization accounts. If you use the Service through your employer, some requests (for example deleting your content) go to your organization's admin, who controls that data. We help them respond.

11. Children

The Service is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email support@parter.ai and we will delete it.

12. Changes to this policy

We post changes here with a new effective date. For material changes we email account owners at least 30 days before they take effect and, because this policy is part of the Terms, we ask you to accept them under clause 17 of the Terms. Where a new use of your data needs your consent or another legal basis, we obtain it; posting or emailing a revised policy does not by itself authorize that use. Earlier versions are kept at parter.ai/policies/app-privacy-policy.

13. Contact

Parter Inc., 1412 Broadway, New York, NY 10018, USA · support@parter.ai