Your data in Pally is yours. This policy explains, simply, what we collect and how we use it. Questions? Email privacy@pally.com.
1. Your Data, Your Control
You can view, edit, and delete your data at any time. Ask Pally what it remembers, tell it to forget something, disconnect any account, download your data, or delete your account.
2. What We Collect
What you give us
- Account details, such as your phone number, email, and name
- Your conversations with Pally, including messages, media, and calls
- What you ask Pally to remember, and the work it does for you
- Traveler details for bookings, such as date of birth, gender, nationality, and passport or driver details when a booking needs them
- Messages you send our support team
- Website logins you save to the password vault
- A card you save to Pally's card vault: card number, expiry date, cardholder name, billing postcode, and country, and the security code you enter to approve one purchase
- Your shipping address, t-shirt size, and t-shirt fit, if you ask for Pally merch
What we collect automatically
- How you use Pally, including its actions and tool activity
- Device, browser, and diagnostic information, such as your IP address and general location
- Cookies and similar technologies on our website
What we get from others
- Accounts you connect, such as Gmail or Google Calendar, when Pally needs them to help you
- Purchase, booking, delivery, billing, and refund details from an email account you connect, including older messages that can show money you are owed
- Balances, transactions, and recurring charges from a bank account you link
- Courses, assignments, due dates, grades, and announcements from school portals you connect, and events from calendar feed links you add
- Payment status from our payment providers
- Ad and referral details, such as which campaign or invite link brought you to Pally
When you come to Pally from a link or our website, we record the page, campaign tags, referring site, and device type, and link that record to your account when you sign up, to understand which links and channels bring people to Pally. For this, we store nothing on your device: no cookie, local storage, or identifier. We remove the link to your account when you delete your account.
California Notice at Collection
Under the CCPA/CPRA, we collect the categories below. Each line gives examples, why we use them, and who receives them. Categories can overlap, and what we collect depends on the features you use, the accounts you connect, and what you or others share with Pally.
- Identifiers: names, phone numbers, email addresses, account IDs, IP addresses, and cookie IDs; to run and secure your account, deliver messages, handle RSVPs, and measure website use and ads; shared with hosting, messaging, AI, analytics, and payment providers, advertising partners (cookie IDs and IP addresses only, never phone numbers), people, businesses, or event hosts you ask us to share with, official unclaimed-property search sites when you ask Pally to search them (your name, and your city or state when needed), and other Pally users in an introduction you accept.
- Customer records (California Civil Code section 1798.80(e)): contact, shipping, t-shirt size and fit, traveler, bank, and payment details; to carry out requests, fulfill merch, and handle transactions and billing; shared with hosting, AI, app-connection, payment, banking, and booking providers, our support team for merch, and people or businesses you authorize. A card you pay with through Link or AgentCard stays with that wallet, and Pally never sees its full number. A card you save to Pally's card vault is never shared with AI providers.
- Protected characteristics: age, date of birth, gender, or nationality you provide; to complete bookings and enforce age limits; shared with hosting and AI providers as needed, and booking providers and airlines for bookings.
- Commercial information: purchases, including those recorded from your email receipts, bookings, recurring charges, payment status, and transaction summaries; to complete and track transactions, answer money questions, warn you before renewals, find money you may be owed back, including from settlements and unclaimed property, and meet accounting obligations; shared with hosting, AI, app-connection, browsing, payment, banking, booking, and parcel-tracking providers, and merchants or people you authorize.
- Internet or other electronic network activity: website use, referral and campaign details, device and browser details, tool activity, and diagnostics; to operate, secure, support, and improve Pally and measure website use and ads; shared with hosting, AI, app-connection, messaging, browsing, and analytics providers, advertising partners, and connected services needed for your tasks.
- Geolocation data: general location and location you choose to share; to help with nearby suggestions, reminders, travel, and other location-based requests; shared with hosting, messaging, AI, research, and task-specific providers, and people or services you authorize.
- Audio, electronic, visual, or similar information: messages, email, media, files, and call audio or transcripts; to understand and answer requests, deliver communications, and provide support; shared with hosting, messaging, email, call, AI, app-connection, browsing, and media-creation providers, and people or services you authorize.
- Professional or employment-related information: work details, professional profiles, and meeting notes and transcripts from recorders you connect; to personalize assistance, prepare meetings, follow up on recorded meetings, coordinate work, and handle RSVPs; shared with hosting, AI, messaging, app-connection, and research providers, and people, services, or event hosts you authorize.
- Education information: courses, assignments, due dates, grades, and announcements from school portals you connect; to answer questions about your classes and keep track of your work; shared with hosting, AI, app-connection, and browsing providers.
- Inferences: remembered preferences, interests, summaries, and relationship notes; to personalize Pally, remember context, and improve response quality; shared with hosting and AI providers, and people or services you authorize.
- Sensitive personal information: government identification numbers, such as passport and driver's license numbers, citizenship or nationality, precise location, health details, sign-in credentials, debit and credit card numbers you save, the security code you enter for one purchase, and private communications from connected accounts; to complete bookings, provide requested features, and secure accounts; shared as needed with hosting, AI, app-connection, messaging, secure sign-in, banking, and payment providers, booking providers and airlines for bookings, and people or services you authorize. Saved card numbers and security codes go only to our hosting provider, our secure browsing provider, and the merchant you pay, never to AI providers.
We do not sell personal information. When our ad measurement tools run, identifiers and internet activity are shared with advertising partners for cross-context behavioral advertising, as described in Cookies and Tracking. Phone numbers and text messaging data are never shared with advertising partners. Any category may also be shared for the legal and business reasons in How We Share It.
The uses, Google-data limits, and retention criteria for these categories are in How We Use It, Google User Data, and Retention.
3. How We Use It
Under EU and UK GDPR, we rely on the legal basis listed for each purpose below.
- To run Pally and do what you ask, including its intelligence features, transactions, product searches, Pally Page RSVPs, and merch requests (contract, Article 6(1)(b))
- To record purchases and money you are owed from your email, and use them for spending summaries, renewal warnings, savings, money back checks, and settlement matches, and to run the unclaimed-property searches you ask for (contract, Article 6(1)(b))
- To match you with other Pally users for a goal you opt in to, and introduce you when everyone accepts (consent, Article 6(1)(a))
- To personalize Pally for you (contract, Article 6(1)(b))
- To support you and send you service messages (contract, Article 6(1)(b))
- To keep Pally safe, and to prevent fraud and abuse (legitimate interests in a secure service, Article 6(1)(f))
- To maintain and improve Pally, including to fix bugs, analyze usage, and build new features (legitimate interests in a reliable, useful service, Article 6(1)(f))
- To train and evaluate our AI models, unless you opt out as described below (legitimate interests in improving our models, Article 6(1)(f))
- To respond to people who message, email, or call your Pally assistant (legitimate interests in delivering those conversations, Article 6(1)(f))
- To use app connections, optional location sharing, and optional diagnostics you authorize, and send optional product or marketing messages (consent, Article 6(1)(a))
- To measure website use and ads (consent where required, Article 6(1)(a); otherwise legitimate interests in understanding usage and measuring campaigns, Article 6(1)(f))
- To measure which links and channels bring people to Pally, including linking the visit that brought you here to your account when you sign up (legitimate interests in understanding how people find Pally, Article 6(1)(f))
- To meet our legal obligations (legal obligation, Article 6(1)(c))
- To enforce our terms (legitimate interests in protecting Pally and our users, Article 6(1)(f))
You can turn off model training with the Help train Pally’s models switch, under Privacy and data in your account at my.pally.com. If you do, we will not use your data to train our models.
We may also turn data into aggregated or de-identified form that no longer identifies you, and use it for any purpose.
Purchases and money you are owed
For each email account you connect, Pally reads its receipts, order confirmations, and renewal notices from about the past 12 months, and then each new one as it arrives. Pally records the merchant, the items, the amount, the date, and when the charge repeats. Pally also reads the recurring charges in a bank account you link. Once, after you connect an email account, Pally also reads its older bookings, delay and cancellation notices, delivery updates, bills, and settlement or refund notices, back as far as a claim can still be open, which is up to six years for some flight claims. Pally uses these records to answer questions about your spending, warn you before a renewal, track what Pally saved you, and check whether you are owed money back, such as for a price drop, a late delivery, a delayed flight, or a class action settlement. Pally compares your purchases with a public list of open settlements on its own systems, and sends nothing about you to do this. If you ask Pally to, it also searches free official unclaimed-property sites, such as state unclaimed-property offices, for money held in your name, and repeats that search about once a year. That search sends your name, and your city or state when needed, to the site, and nothing else. Pally claims money only after you say yes. When you disconnect the email account, Pally deletes the purchases it recorded from it.
Introductions to other Pally users
Pally can introduce you to other Pally users when an introduction clearly helps everyone, such as two founders looking for a cofounder in the same city. This happens only for a goal you opt in to, and you approve a short preview that other users may see. To find matches, Pally compares your goal and any limits you set, such as your city, with the goals other users opted in. An intro offer shows each person only the other members' approved previews. Nothing else about you is shared unless every member accepts that intro. Then Pally starts a group text with the members, which shares your phone number with them. One decline ends the intro for everyone. You can pause or stop matching at any time, and deleting your account deletes your goals and intros.
Shopping links
When you ask Pally to find something to buy, Pally may send your product search, with any price and country filters, to a product catalog partner. It sends no name, phone number, email address, or account ID. Buy links from this partner are affiliate links. When you open one, the partner and the retailer record the click and any purchase under their own privacy policies, and the retailer may pay Pally a commission. You never pay more through these links, and a commission never changes what Pally recommends.
Password vault and payment wallet
When Pally needs to sign in to a website for you, it sends you a secure link to a page hosted by Kernel, our secure browsing provider. There you save your username and password, and your authenticator secret if the site uses one. Kernel keeps them in an encrypted vault for your account only. Pally never sees your password or authenticator secret, never asks for them in chat, and never shows them to you or anyone else. When Pally works on that site for you, Kernel fills them into the sign-in page in Pally's secure browser and keeps the signed-in session, so Pally does not have to sign in each time. When a site sends a one-time code, Pally reads it from your connected email or messages, or asks you for it, and uses it once.
To pay for things, you can connect a Stripe Link wallet on a secure Link page and choose the card to pay with. Your card stays with Link. For each purchase, Link asks you to approve the merchant and amount, then issues a one-time card for that purchase, which Kernel enters on the checkout page. Pally sees only the card brand and last four digits, never the full number or security code.
You can also connect an AgentCard wallet. Your cards stay with AgentCard. For each purchase, AgentCard asks you to approve the merchant and amount, then provides card details for that purchase, which Kernel enters on the checkout page. Pally sends AgentCard the merchant, amount, currency, and checkout website, and sees only the card brand and last four digits.
You can also save a card to Pally's own card vault on a secure page on my.pally.com. Pally stores the card number, expiry date, cardholder name, billing postcode, and country, encrypted with a key that belongs to your account alone. Pally never stores your security code. For each purchase, Pally texts you a secure link that shows the merchant and amount. Entering the security code there approves that one purchase. Pally then enters the card in its secure browser, hosted by Kernel, on that merchant's checkout page. Pally's AI never sees the full card number or security code, and they never appear in chat.
When Pally recognizes an API key you paste into chat, it removes the key from your conversation history and keeps no copy. Because the key passed through your messaging app, rotate it with its provider.
Your dashboard also shows each site with a saved login. You can disconnect a site there or by asking Pally, which deletes its saved login and signed-in session. To change a saved login, ask Pally for a new secure link. You manage Link cards in your Link account and AgentCard cards in your AgentCard account. You can remove a card from Pally's card vault on your dashboard or by asking Pally.
School portals and calendar feeds
When you connect a school portal, such as Canvas, Brightspace, Blackboard, or Moodle, Pally saves your login in its encrypted password vault, signs in through its secure browser, and reads your courses, assignments, due dates, grades, and announcements when it needs them to help you. Google Classroom connects like your other Google apps and gives Pally the same kinds of information. A calendar feed link you add is stored encrypted, and Pally reads its events with your other calendars. Pally only reads school portals and calendar feeds. You can disconnect any of them at any time.
Meeting follow-ups
When you connect a meeting recorder, such as Granola, Fathom, Fireflies, or Plaud, Pally checks it for meetings that just ended and reads their notes and transcripts. Pally then researches questions a meeting left open and texts you the answers, with sources, and the follow-ups you own. To research, Pally sends search queries to its web search providers, and a query can include a question from the meeting. You can turn meeting follow-ups off, or disconnect the recorder, at any time.
Pally groups
When you add Pally to a group chat, Pally reads the messages, photos, voice notes, documents, and videos members send there, so it can answer anyone in the group. Pally keeps what it read, such as a description or a transcript, in the group's history and memory. It does not save group members' files to anyone's personal files. Reading a member's media counts toward the usage limit of the member who asked Pally. Anything you or Pally post in a group, including files you ask Pally to share there and posts from automations you set up, is shared with everyone in it.
5. Google User Data
Pally only reads your Google data, such as Gmail, Google Calendar, and Google Classroom, after you connect your account, and only uses it to provide the features you use. Our use of data from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
We do not sell Google data, use it for ads, or use it to train generalized AI models. People at Pally do not read it unless you ask us to, or we need to for security or to follow the law. You can disconnect Google at any time in Pally or in your Google account settings.
7. Your Choices and Rights
- Turn off model training in your settings at my.pally.com
- Disconnect any account, or ask Pally to forget something
- Stop marketing emails with the unsubscribe link. You will still get emails about your account. Reply STOP to stop texts from Pally.
- Opt out of ad measurement on Your Privacy Choices, or with Global Privacy Control
Depending on where you live, you may also have rights to access, correct, delete, or export your data, to object to or limit how we use it, to withdraw consent, and to opt out of the sale or sharing of personal information. To use them, email privacy@pally.com. We may need to verify your identity first, and we will not treat you differently for using your rights. If you are in the EU or UK, you can also complain to your local data protection authority.
8. Retention
We keep your data while your account is active, and after that only as long as we need it for the reasons in this policy. When you delete your account, we delete your personal data or make it no longer identify you. We may keep some data longer when the law requires it, to resolve disputes, or to prevent fraud and abuse. Copies in backups are removed as the backups expire. A group's history and memory belong to the group. When you delete your account, Pally removes your account from the group, but messages you sent there stay in its history for the other members.
Saved logins and signed-in sessions stay until you disconnect the site or delete your account. Your Link and AgentCard wallet connections stay until you delete your account. A card saved to Pally's card vault stays until you remove it or delete your account. A security code you enter for a purchase is deleted once Pally uses it, or after one hour if it is not used. Deleting your account deletes your whole password vault. A one-time sign-in code is deleted once Pally uses it or it expires.
When you ask for merch, Pally emails your shipping address, t-shirt size, and fit to support@pally.com so our team can order it manually. Pally keeps no separate record of those details beyond your conversation and that email. The request receipt records only your account, the request time, and the email's message ID.
9. Text Messages
This section covers Pally Assistant Text Messages: texts sent to or from a Pally assistant phone number. When someone texts a Pally user's assistant number, Pally collects their phone number and their messages to reply for that user and to tell the user about the conversation. Pally does not download pictures sent in a text; they stay with our messaging provider. Pally deletes these texts when the user deletes their Pally account.
Message frequency varies with the conversation. Message and data rates may apply. Reply STOP to opt out. Reply HELP for help.
We do not share, sell, or provide mobile phone numbers or text messaging opt-in data and consent to third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties.
See how opting in to Pally assistant texts works on our Text Messages page.
10. Security
We encrypt your data in transit and at rest and limit who can access it. No system is perfectly secure.
11. Other Websites and Services
Pally may link to or work with other websites and services. Their own privacy policies apply to what you share with them.
12. Children
Pally is for people 18 and older. If we learn we have data from someone younger, we will delete it.
13. Changes
We may update this policy. If we make significant changes, we will let you know.
14. Contact Us
Pally Technologies, Inc.
Email: privacy@pally.com