Privacy Policy

This Privacy Policy, version 1, explains how WEYD Industries Limited (“we”, “us”) handles personal data in Parlabase and on this site (the “Service”).

This Policy covers this site, host accounts, live sessions and your dealings with us; it does not cover third-party sites we do not control. Read it with our Terms of Service and, if you host sessions, our Data Processing Terms. What this site and the product store on your device is in What we store on your device.

1. Who we are and how to reach us

The Service is provided by WEYD Industries Limited, a company registered in England and Wales with company number 17004092. Registered office: Unit A, 82 James Carter Road, Mildenhall, England, IP28 7DE. Parlabase is a trading name of WEYD.

Data protection questions, requests and complaints go to hello@parlabase.com, or to the registered office above.

2. Roles

Website, interest-form, account, and billing data. For this site and the interest form, and for host accounts, billing and the emails you asked us for, we are the controller.

Session content on behalf of a host. When a host runs a session, the host (or their organisation) is the controller of what is spoken into it and of the text produced from it; we process it as their processor, under our Terms of Service and Data Processing Terms.

Guests. Guests join without an account. We process limited technical and session data as controller to deliver the join experience and secure the Service. If a guest asks us for a copy of a session by email, we process the address they give us for the host, to send what the host offered, and we decide for ourselves how long it is kept and how it is removed, so for those rules we are the controller — Retention says what we do with it and how to have it removed.

Our Data Processing Terms are the Article 28 contract for that processing; What you are responsible for there sets out the host’s duties.

Where an event includes minors, the host is responsible for notices, consents and safeguarding.

3. Data we process

Depending on how you use the Service, we may process:

3.1 Account and contact data (hosts and enquirers)

• Name, email address, organisation name, and similar details you give us;
• Contact details you give us for other people you want us to correspond with about your account, used only for that;
• Your enquiries and correspondence with us.

If we correspond with you about someone else’s account, we hold your name, your email address, and the account they relate to, and we were given them by the account holder who asked us to write to you. We use them for that correspondence and nothing else, and you can ask us to stop at any time.

3.2 Billing and subscription data

• Plan, trial and payment status, and the allowances and usage that drive billing.

3.3 Session and technical data

• Session identifiers, codes, links, and configuration (for example scheduled start time, language settings);
• Device and log data such as IP address, browser type, timestamps, and diagnostic logs;
• Guest join events, without a guest account;
• An email address a guest gives us for a copy of a session, the language they asked for, the fact and time of the request, and a pseudonymised form of the connection address the request came from, kept with the record of it.

3.4 Audio, speech, transcripts, and translations

• Audio from a live session and the text produced from it, which can include personal data about speakers and anyone spoken about — see Audio, transcripts, and translations.

4. How we use data

We use personal data to:

• provide, operate, and secure the Service — accounts, live sessions and join links, and the translated text shown to people who join;
• measure session minutes, apply plan limits, and process trials, subscriptions, and payments;
• reply to interest-form and contact enquiries, communicate with you about the Service and support, and, if you asked to be told about related features, email you about them;
• prevent abuse, diagnose faults, and keep the Service reliable;
• comply with law and enforce our Terms.

Automated decisions. Translation is produced by machine. We do not profile you, and we make no decision about you by automated means that has legal effects for you or similarly significantly affects you. If something automatic under your agreement with us looks wrong — a charge, or access ending — contact us: a person will look at it, you can put your side of it, and you can challenge the outcome.

If you submit the interest form, we use your details to follow up on that request. We do not use a first-time enquiry address for other marketing. If you choose the option to be kept updated, that is your consent to email you about related features; you can withdraw it at any time by replying to any such email, or contact us.

5. Legal bases

We rely on these bases, each for the processing named against it:

• Contract — running your host account, trial or paid plan and billing you; replying to your enquiries and supporting you; and taking steps at your request before a contract;
• Legitimate interests — for guest access to a session, and for keeping the product working and honest. The interests we pursue are:
  • giving a guest access to a host’s session;
  • corresponding with the people you nominate to deal with your account and billing;
  • keeping the Service available and secure, including this website;
  • preventing fraud and abuse of the Service;
  • enforcing our Terms and protecting our rights, our users and the public, including acting on reports and on misuse of the Service; and
  • understanding how the product performs, so that we can fix and improve it.
• Legal obligation — where we must keep or disclose data to meet law, tax, or regulatory duties;
• Consent — for the emails you asked for when you chose to be kept updated about the product; and for an email address a guest gives us for a copy of a session, given by asking for the copy and confirmed by the link we email. You may withdraw consent at any time; for a guest address, by asking us to remove it, and every email we send to it carries a way to do so.

Do you have to give us your data? No law requires it. To hold a host account you must give us the details sign-up requires and confirm your email address — a requirement of our contract with you; without them we cannot create the account.

6. Your right to object

Where we rely on legitimate interests, you can object at any time to that processing; we will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for a legal claim. You can object to direct marketing at any time, and we will stop. To object, email hello@parlabase.com.

7. Audio, transcripts, and translations

While a session is running, audio from the host’s feed is processed in near real time to produce the text guests read.

• We do not record session audio.
• The live transcript is temporary. Annex 1, Retention, of the Data Processing Terms states how long it survives the session; while it is there, the host and anyone holding the join code can read it.
• A transcript of the session is kept. It stays until the host deletes it or the account closes — Annex 1, Retention and Deletion and return of the Data Processing Terms state the commitment. A guest can ask the host for a copy, or ask for it by email where the host offers that.
• We use the audio and text only to provide the Service, and not to train our models — Processing only on your instructions, in the Data Processing Terms, is the commitment.
• Some speech-recognition providers keep what they receive and use it to improve their own models, as controllers in their own right. Their names, locations and what each keeps are on our sub-processor list.

Special category data. What is said may reveal it. The host is its controller and holds the Article 9 condition (What you are responsible for in the Data Processing Terms); we use it only to produce and display the translation.

8. Who we share data with

We share personal data only as needed to run the Service or where the law requires it. Our providers are:

• Speech recognition and machine translation — they receive the audio and the text, and some keep what they receive (Audio, transcripts, and translations); our sub-processor list gives each one’s location;
• Our payment processor — it sees card and billing data;
• Cloud hosting and email delivery — email we send can carry a transcript a guest asked for;
• Identity and authentication;
• Service telemetry, on servers in the European Union — a record of how a broadcast performed, carrying no session content, no name, no email address, no user identifier and no IP address. We use it under the legitimate interest named in Legal bases.

The providers that may process session content are named on our sub-processor list; we will tell you who the others are if you ask us. We may also share personal data with:

• Hosts, for the sessions they run;
• Professional advisers (legal, accounting) where needed;
• Authorities or other parties where the law requires it, or — for account and contact details only — to protect rights, safety or the Service. The content of a session goes only where we are legally compelled (Processing only on your instructions, in the Data Processing Terms); and
• A buyer or successor if we are involved in a merger, acquisition, or asset sale, subject to appropriate safeguards.

9. International transfers

The Service is hosted in the United Kingdom. Speech recognition and machine translation run in the European Economic Area and the United States, and, where a provider offers no regional endpoint, wherever that provider processes; account, billing, support and enquiry data may be processed by providers outside the United Kingdom. Our sub-processor list gives the location of each provider that may process session content; for the others, ask us.

Where the destination is covered by UK adequacy regulations we rely on those; otherwise we rely on the transfer agreements and safeguards set out in International transfers, in the Data Processing Terms. For a copy of the transfer agreement we rely on for a particular destination, contact us.

10. Retention

We keep personal data only as long as needed for the purposes above, including:

• Interest-form and enquiry data — while we handle your request, and no longer than 24 months after our last contact about it;
• Account data — for the life of the account, and no longer than 12 months after it closes, so that we can settle disputes and security questions;
• Billing and payment records — for as long as tax law requires us to keep them, and no longer than 7 years from the end of the financial year they relate to;
• Support and correspondence — no longer than 24 months after the query is resolved;
• Logs and security data — 30 days, unless a particular log is held longer for a specific investigation;
• Session content and transcripts — Annex 1, Retention, of the Data Processing Termsstates what we undertake for each;
• An email address a guest gives us for a copy of a session — removed when the guest asks us, and in any event when no more than 365 days pass with no further request; Annex 1, Retention, of the Data Processing Terms states the confirmation window;
• Session and technical data — with the account record above, except where it forms part of a billing record;
• Audio and text held by speech-recognition providers — under each provider’s own retention practice, stated on our sub-processor list.

Where we act as processor for a host, deletion and return of processor-held data are governed by Deletion and return in our Data Processing Terms.

11. Security

The measures we use to protect personal data are described on Security.

12. Your rights and complaints

You have rights under the UK GDPR, including to:

• access personal data we hold about you;
• correct inaccurate data;
• erase data in certain circumstances;
• restrict or object to certain processing;
• data portability for data you provided to us as controller; and
• withdraw consent at any time where processing is based on consent; withdrawing does not affect what we lawfully did on that consent before you withdrew it.

To exercise them, email hello@parlabase.com; we may need to verify your identity. Where we hold data only as a host’s processor we will direct you to that host, or help them answer you.

You have the right to complain to us. Section 164A of the Data Protection Act 2018 gives you that right. Send it to hello@parlabase.com or the registered office address in Who we are and how to reach us. We will acknowledge it within the 30 days the law allows and respond without undue delay, telling you the outcome.

You may also complain to the Information Commissioner’s Office at ico.org.uk, without complaining to us first.

13. If your voice was captured

If you spoke at an event where Parlabase was used, or were named by someone who did, this section is for you.

The organisation running the event is the controller of what was spoken into it; we only process it for them. The duty to tell you about it, and the decision on any request to access, correct, erase, restrict or object, is theirs, not ours. Ask them first.

If you cannot identify or reach them, email hello@parlabase.com and we will help you find the host and pass your request on. We will not answer on the substance of what was said at someone else’s event.

Your audio was not recorded. A transcript of the session is kept until the host deletes it or the account closes — ask the host for a copy. Annex 1, Retention, of the Data Processing Termsstates the commitment.

14. What we store on your device

This section covers this website and the Parlabase product. The Privacy and Electronic Communications (EC Directive) Regulations 2003 restrict storing or reading information on your device; everything below falls within an exception that needs no consent, so we show no consent banner. The exact keys and lifetimes are on How Parlabase handles data.

• Staying signed in. Cookies that keep you signed in to the product and to the sign-in service, and, on this site, a check of whether you are signed in so each page shows the right link. How long the sign-in cookies last is set by your organisation’s sign-in policy. Nothing here lasts longer than 365 days. Strictly necessary: authenticating you.
• Protecting the sign-in exchange. Short-lived cookies that guard sign-in against forgery and record that you have just confirmed who you are. They last minutes. Strictly necessary.
• Fraud prevention on payment pages. Our payment processor, Stripe, sets cookies on the product’s billing pages to tell a genuine payment from a fraudulent one; they last up to about a year, and Stripe lists them in its own privacy documentation. Strictly necessary.
• Recording your enquiry once. A one-time reference sent with your enquiry so a resubmit is recorded once; it identifies the enquiry, not you. Removed when the enquiry is sent, or when you clear it with the button below. Strictly necessary.
• The appearance you chose. Whether you chose light or dark, stored separately by this site and by the product. If you have not chosen, we follow your device setting and store nothing. Kept until you change it, refuse it below, or clear site data. An appearance you chose.
• Your settings and selections in the product. A host’s audio preferences; the language a guest chose to read a session in, together with an email address the guest gave for a copy of the session; and, in the host console, a marker so the console can resume after you sign in again. Kept until you change or clear them. Strictly necessary: a record of settings and selections you put in.

Neither this site nor the product uses advertising cookies or anything that tracks you across other sites, and nothing either stores measures how you use it. Apart from an email address a guest chooses to give for a copy of a session, none of it identifies you by name or email.

Strictly necessary means the storage is needed for something you asked for — signing in, paying, recording your enquiry once, and keeping the settings you made. No consent is needed for it.

An appearance you chose means the storage only holds a preference you set and adapts how the site or the product looks to it. That needs no consent either, provided we tell you what it is for and give you a simple, free way to refuse it. You are entitled to refuse, and this is how.

Use device appearance makes this site follow your device colour-scheme setting; choosing a theme again stores it again. Forget my enquiry reference removes the enquiry reference, after which sending the same enquiry twice may record it twice. If the buttons do not run — scripts blocked, for example — clearing cookies and site data for parlabase.com covers this site and the product together.

In the product. Its own appearance setting returns you to your device setting and removes the stored preference.

15. Changes

We may update this Policy; the version and date at the top show the current one, and for material changes we will give reasonable notice where appropriate.