Privacy Policy

As of: 15 July 2026 · Version 2026-07-15

Unofficial English translation. The German version is the authoritative legal text.

This policy provides information under Articles 12 to 14 General Data Protection Regulation (GDPR) about processing of personal data when using Parlant Agents. It covers the website, user accounts, orders, managed Agent instances, backups, and support.

1. Controller

Parlant GmbH Gürtelstraße 25/Etage 4 10247 Berlin Germany

Email: [email protected]

Managing Director authorised to represent the company: Lukas Rieder

No data protection officer has been appointed. Privacy enquiries may be sent to the email address above.

2. Data we process

Depending on use, we process the following categories:

1. Connection and security data: IP address, date and time, requested URL, HTTP status, transferred data volume, browser and device data, technical identifiers, and security events.
2. Account and authentication data: email address, encrypted or hashed login tokens, account status, and login or confirmation timestamps.
3. Contract and payment data: order, product, price, currency, billing status, Stripe customer, Checkout and subscription identifiers, and invoicing and tax data. Parlant does not receive full card or bank details; Stripe processes them.
4. Acceptance and evidence data: accepted versions and cryptographic digests of the Terms and Privacy Policy and the declaration timestamp. For data minimisation, we do not store an IP address for this evidence.
5. Infrastructure and operational data: hostname, technical provider identifiers, server and backup status, digests, backup size, error and recovery data, and encrypted instance credentials.
6. Customer Content: files, messages, prompts, responses, configuration, logs, and other data processed by the Customer or Agent on the Customer instance.
7. Support and communications data: content, sender, time, and technical metadata of emails, support authorisations, withdrawals, cancellations, and abuse reports.
8. Optional AI usage data: with managed model access, particularly the selected model, usage, credit, and inputs sent by the Agent to OpenRouter and the selected model provider and outputs received from them.

Data generally comes from the Customer, the Customer's device or Agent, or our service providers. In security or abuse cases, reports may also come from affected persons, providers, or authorities.

3. Purposes and legal bases

Purpose	Data	Legal basis
Securely deliver the website, prevent attacks, resolve errors	Connection and security data	Art. 6(1)(f) GDPR; legitimate interest in secure and stable operation
Create an account and permit email login	Account and authentication data	Art. 6(1)(b) GDPR
Prepare, provide, bill, cancel, and withdraw from a contract	Account, contract, payment, and infrastructure data	Art. 6(1)(b) GDPR
Comply with commercial, tax, consumer, and security law	Contract, evidence, and communication data	Art. 6(1)(c) GDPR
Evidence acceptance of Terms and notice of the Privacy Policy and defend claims	Evidence data	Art. 6(1)(f) GDPR; interest in legally reliable documentation
Operate, back up, and recover the Customer instance	Infrastructure and Customer Content	Art. 6(1)(b) GDPR; for third-party data, processing under Art. 28 GDPR
Send transactional email and provide support	Account and communication data	Art. 6(1)(b) GDPR; for security communications also Art. 6(1)(f) GDPR
Provide managed AI access on request	Optional AI usage data and Customer-selected content	Art. 6(1)(b) GDPR; for third-party data, on Customer instruction
Prevent abuse, protect rights, and handle legal claims	Security, contract, infrastructure, and communication data; content only where necessary	Art. 6(1)(c) and (f) GDPR and Art. 9(2)(f) GDPR where special categories are required for legal claims

We do not use Customer Content for our advertising and do not train our own AI models with it.

4. Hosting, isolation, and access

1. The control application, database, Customer instances, persistent live files, and encrypted backups are currently hosted on Hetzner infrastructure in Germany. Each Agent instance receives an isolated virtual compute instance and its own volume. Backup archives are encrypted on the Customer instance before transfer to Hetzner Object Storage.
2. Browser and administration traffic to the Customer instance passes through Cloudflare Tunnel. Cloudflare therefore processes connection data and may technically process transported content as part of network delivery. Files are not thereby stored as permanent content with Cloudflare; permanent primary storage remains on the Hetzner instance.
3. Parlant personnel have no permission to inspect Customer Content during normal operations. Access is permitted only following express, documented support authorisation or, exceptionally, for a specific security threat, technical incident, mandatory legal duty, or necessary legal defence. Permissions are limited to selected persons and what is required.
4. Because Parlant operates the managed service, credentials, and recovery, technical administrative access exists. We therefore do not promise a “zero-knowledge” architecture. Unauthorised inspection is organisationally prohibited.

5. Recipients and partners

Hetzner Online GmbH (Germany)

Hetzner provides compute, volumes, network, and Object Storage in Germany and processes account, infrastructure, connection, and encrypted backup data as a processor. Customer Content at rest generally remains on isolated Hetzner infrastructure. Information: Hetzner Privacy Policy.

Cloudflare, Inc. and affiliates (United States/EU)

Cloudflare provides DNS, TLS, DDoS protection, access protection, and tunnels. It processes IP addresses, connection and security data, and requests transmitted through the tunnel. Cloudflare is a US company. Where applicable, transfers rely on the adequacy decision for the EU-US Data Privacy Framework and additionally on EU Standard Contractual Clauses. Information: Cloudflare Privacy and Data Protection.

Stripe Payments Europe, Limited and the Stripe corporate group (Ireland/United States/worldwide)

Stripe provides Checkout, payment processing, fraud prevention, subscriptions, and invoicing. Stripe processes email, contact, device, payment, and transaction data partly as processor and partly as independent controller, particularly for regulatory and fraud-prevention purposes. Data may be sent to Stripe entities, banks, payment networks, and providers outside the EEA; Stripe uses the safeguards described in its privacy terms. Information: Stripe Privacy Center.

rapidmail GmbH (Germany)

We use rapidmail's German SMTP infrastructure to send necessary login, contract, cancellation, withdrawal, and support messages. Data includes recipient address, subject, message content, sending time, and delivery status. Customer Content from the Agent instance is not routinely sent to rapidmail. Information: rapidmail privacy information.

OpenRouter, Inc. and model providers (United States/other countries; optional)

Only where the Customer chooses managed OpenRouter access or configures the Agent accordingly are inputs and outputs sent to OpenRouter and the selected model provider. OpenRouter is based in the United States and forwards content to model providers. Storage location, retention, and possible use for model training also depend on the selected model provider and routing. OpenRouter describes adequacy decisions and Standard Contractual Clauses for EEA transfers. Customers should not send sensitive or third-party data before reviewing the legal basis and provider terms. Information: OpenRouter Privacy Policy and provider routing.

Services connected by the Customer

Hermes can be connected to additional models, messengers, websites, APIs, and tools. The Customer selects these recipients. Their terms and privacy information apply additionally; Parlant does not control these transfers.

6. Third-country transfers

Under the current configuration, Hetzner primary storage and backups are located in Germany. Third-country transfers nevertheless occur particularly through Cloudflare, Stripe, and optionally OpenRouter and model providers. Depending on the recipient, we use an adequacy decision under Article 45 GDPR, particularly the EU-US Data Privacy Framework for certified US companies, or appropriate safeguards under Article 46 GDPR, particularly Standard Contractual Clauses. Copies or information about safeguards can be requested at [email protected]; trade secrets may be redacted.

Processing exclusively in Germany cannot be guaranteed because of network, payment, and optional AI services. Permanent Customer file storage and encrypted backups remain separately on Hetzner infrastructure in Germany.

7. Retention

1. Account: for the contract term and afterwards where needed to identify open contracts, provide backup export, perform billing, or defend legal claims.
2. Contracts, payments, and invoices: after the contract ends for statutory commercial and tax retention periods; depending on the document, generally six, eight, or ten years.
3. Evidence of document acceptance and contract declarations: until potential claims and statutory evidence periods expire, followed by deletion or anonymisation.
4. Live Customer Content: until deletion by the Customer or destruction of the instance. Deletion from rotating backups occurs with a technical delay.
5. Backups: during active service according to the displayed backup cycle; after subscription end, generally until seven days after the paid period ends unless a legal duty, hold, or ongoing recovery prevents deletion.
6. Login tokens: until use, expiry, or replacement according to security-related token periods.
7. Technical security and error data: only while needed for operation, abuse prevention, or legal claims, followed by deletion or aggregation.
8. Support communications: until the request is closed and afterwards according to statutory retention and limitation criteria.

Service-provider periods additionally follow their terms. Deletion is temporarily suspended where statutory retention, preservation of evidence, or third-party rights require it; processing is then restricted.

8. Cookies and local storage

We use no advertising or analytics cookies.

• _agents_key: technically necessary signed session cookie for navigation, login, and CSRF protection; generally for the browser session.
• _agents_web_user_remember_me: only when “stay logged in” is selected; signed login cookie, currently no more than 14 days.
• Theme setting: stored locally in the browser to preserve the selected appearance.
• Cloudflare security identifiers: Cloudflare may set technically necessary cookies or similar identifiers to prevent bots and attacks.

Storage or access is strictly necessary for the expressly requested service or its secure transmission and therefore occurs without a consent banner under section 25(2)(2) German Telecommunications Digital Services Data Protection Act (TDDDG). If optional analytics or marketing technology is introduced later, we will first obtain any required consent and update this policy.

9. Requirement to provide data

Email address, legally required declarations, and payment and contract data are required for registration or contract conclusion. Without them we cannot provide the account or service. Optional support content and managed AI access are voluntary; without them the corresponding support or AI function is unavailable.

10. Automated decisions

Parlant makes no solely automated decisions producing legal or similarly significant effects within Article 22 GDPR. Stripe and security providers may carry out their own automated fraud or abuse checks; their information applies.

11. Data-subject rights

Subject to statutory requirements, data subjects have rights to:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR),
• withdraw consent with future effect (Art. 7(3) GDPR), where processing is based on consent.

A message to [email protected] is sufficient to exercise these rights. We may request proof of identity where necessary to protect data.

Objection: Where we process data on the basis of legitimate interests, the data subject may object at any time on grounds relating to their particular situation. We then cease processing unless we demonstrate compelling legitimate grounds or processing serves legal claims. Direct marketing may be opposed at any time without reasons; we currently conduct no direct marketing based on service data.

12. Right to complain

Data subjects may lodge a complaint with a data-protection supervisory authority. The authority particularly responsible for Parlant is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59–61 10555 Berlin www.datenschutz-berlin.de

The right to contact another authority competent under Article 77 GDPR remains unaffected.

13. Security and changes

We use technical and organisational measures including isolated instances, restrictive firewalls, encrypted transport, encrypted backups, access restrictions, and security updates. No internet-based service is absolutely secure.

We update this policy when processing or law changes. We notify existing Customers of material changes through an appropriate contact channel. Earlier versions remain archived in the repository for evidence.