Estos documentos se publican en inglés. These documents are published in English.

Privacy Policy

Version: 2026-10-07

Effective 2026-10-07. Supersedes the version of 2026-10-06: section 12 now says the website is hosted on Cloudflare and runs no analytics script; the Vercel Web Analytics and Speed Insights it described before were removed with the move. The 2026-10-06 version superseded 2026-09-25: section 3.2 now says that numbers can be registered automatically through the access PIN and that a prepaid account keeps the one number allowed to use it, and section 3.3 no longer lists a "fallback engine" field, since a single interpretation engine runs today. The 2026-09-25 version superseded 2026-09-09: sections 5, 7 and 11 now match how interpretation actually runs - separate AI providers for speech recognition, translation and speech synthesis, one of which operates outside the United States - and the subprocessors page describes providers by category, with the named list available to customers on request. The 2026-09-09 version superseded 2026-08-06: sections 3.4, 5 and 6 no longer describe a recording-consent practice the system never carried out. Call audio is never recorded (3.3, unchanged), so there was never anything to get consent to record; the earlier text spoke as if recording sometimes happened, which was wrong. The 2026-08-06 version superseded 2026-08-04: section 12 described the website measurement added when the site went live on Vercel.

1. Who we are

Parlaya LLC ("Parlaya", "we", "us"), a New Mexico limited liability company located at 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA, provides real-time AI phone interpretation to businesses.

This policy describes the personal information we handle and why. It is written to describe what our systems actually do, not what they might do one day; section 12 covers the website itself, including what it measures and what it does not do at all.

2. Two different roles

We handle personal information in two capacities, and which one applies changes who you should contact.

As a business in our own right, for people who contact us, our business customers, and their staff. This policy governs that handling.
As a service provider to our business customers ("tenants"), for the personal information of the people they call. The tenant decides what is collected and why; we act on their instructions under our Data Processing Agreement, which controls over this policy where the two conflict. If you were on a call handled by one of our customers, contact that customer first; we assist them in answering you.

3. Information we process

3.1 People who contact us about the service

When you submit the contact form on our site, or when we research a business as a possible customer, we hold: your name, your business email address, a business phone number where you provided one, the company you represent, the sector you selected, and the message you wrote, kept exactly as you wrote it. We also keep a record of the business emails we send you and any reply.

Do not put confidential client information, case details, or anyone else's personal information in that message. It is a sales enquiry and it is not protected by any professional privilege.

3.2 Customer account and billing information

For a business customer we hold: the company name, its sector, its plan and rate, its billing status, the phone numbers it authorizes to place calls (including a number registered automatically the first time someone enters the account's PIN from it, and, for a prepaid account, the one number allowed to use its credit), a salted hash of its access PIN (never the PIN itself), and its Stripe customer identifier. Payment card details are held by Stripe and never reach our systems.

Where an account was created through Stripe Checkout, we keep the customer details Stripe returns to us with the record of acceptance described in 3.4.

3.3 Calls

During a call we process the audio of both parties in transit in order to interpret it. Call audio is never recorded or stored. It exists only for as long as it takes to interpret it and is then gone.

What we store about a call is: an internal call identifier, the telephony provider's call identifier, which customer the call belongs to, the language pair, which interpretation engine ran, the state the call reached, whether the disclosure was played, timestamps, duration, and the amounts computed for billing.

We do not store the phone number of either party to a call. The numbers pass through our telephony provider to connect the call and are not written to our database. The only phone numbers we store are the ones a customer registers as authorized to use its account (3.2) and a business contact number you give us yourself (3.1).

We do not store transcripts. Our systems have no place to put them. If we ever offer stored transcripts, it will be as a feature a customer switches on, subject to consent captured on the call, and this policy will say so before the feature exists.

3.4 Compliance records

For each call we record that the AI disclosure was played, with a timestamp. We do not have a recording-consent record to keep: since call audio is never recorded (3.3), there is nothing to consent to recording, and we do not ask for or log that consent. Separately we record acceptance of our Terms of Service: the email address and name of the person who accepted, the time, the version and the SHA-256 of the exact text they were shown, and the evidence our payment processor returned.

3.5 Technical records

Our servers write operational logs containing IP addresses and request metadata. These are used to keep the service running and secure. They live in our hosting provider's logging system and are not joined to customer records.

4. Where the information comes from

From you directly: the contact form, email, and information you give us while setting up or using an account.
From your organization: if your employer is a customer, it may register your work phone number as authorized to place calls.
From publicly available business sources: for outbound sales research we use publicly listed business contact details. We do not buy personal information from data brokers.
From our providers: our payment processor returns billing details, and our telephony provider returns call metadata.

5. How we use it

To answer enquiries and to offer the service to businesses.
To provide interpretation and connect calls.
To measure usage and bill it. Minutes are measured by our own servers, and that measurement is the authoritative record.
To meet legal obligations, including the AI disclosure required by California AB 2905 / SB 243.
To keep the service secure, prevent abuse, and diagnose faults.
To evaluate interpretation quality using fixed test phrases we write ourselves, not customer calls.

We do not use personal information to train artificial-intelligence models of our own.

We do not make decisions about you by automated means that produce legal or similarly significant effects.

6. Legal bases

Where a legal-basis regime applies, we rely on: performance of a contract (providing and billing the service), compliance with legal obligations (the AI-disclosure record described in 3.4), and our legitimate interests in operating, securing and marketing a business service to other businesses. We do not rely on consent as a legal basis for recording calls, because we never record them.

7. Sharing

We share personal information only with the categories of service providers listed at getparlaya.com/subprocessors - telephony, AI speech recognition, translation and speech synthesis, payment processing, database, hosting, transactional email and error monitoring - and only to the extent each needs in order to do its job. That page says what each category receives and where it operates; the name of each provider is available to customers on request and in our Data Processing Agreement.

We may also disclose information where the law requires it, or to establish or defend legal claims.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are used in California law. We have never done so, including in the twelve months before the date of this policy.

8. Retention

We keep personal information for no longer than the periods below.

Call audio: not retained at any point.
Enquiries and business contact records (3.1): up to twenty-four (24) months after our last contact with you, or until you ask us to delete them, whichever comes first.
Customer account records, billing records and records of acceptance of the Terms (3.2, 3.4): up to seven (7) years after the account closes, which is the period our tax and contractual obligations require.
Call records (3.3): while the account is active, and thereafter only as part of the billing record above.
Operational logs (3.5): thirty (30) days. Administrative audit records kept by our hosting provider are retained for four hundred (400) days and cannot be shortened by us.

9. Your rights

Wherever you live, you may ask us to:

tell you what personal information we hold about you, where it came from, why we have it, and who we shared it with;
give you a copy of it;
correct it if it is wrong;
delete it;
limit how we use it.

You will never be treated worse for asking. We do not offer financial incentives in exchange for personal information, so there is nothing to be denied.

Write to privacy@getparlaya.com. We confirm receipt within ten (10) days and answer within forty-five (45) days, extending once by a further forty-five (45) days only where a request is genuinely complex, and we will tell you if that happens. We will ask you for enough information to be sure the request is really yours, and we use what you send for verification and nothing else. An authorized agent may act for you if you confirm it in writing.

If you are the client of one of our business customers and your information reached us through a call, ask that business first: they decide what happens to it, and we help them carry out your request.

10. Artificial intelligence

Interpretation is performed by artificial-intelligence systems. Every call announces this before any interaction takes place. AI interpretation is machine-assisted, may contain errors, and is not certified human interpretation.

11. International transfers

We and most of our providers process information in the United States. Some of the AI processing that interprets a call runs outside the United States: the text of what is said on a call is translated by a provider operating in another country, and speech synthesis may run in more than one country. The subprocessors page lists where each category operates.

12. Cookies, analytics and tracking

Our website sets no cookies and stores nothing in your browser. No cookie, no local storage, no device fingerprint, nothing that survives you closing the tab. We run no advertising trackers, we are not part of any ad network, and we do not build profiles of visitors.

The website runs no analytics script. Nothing on our pages measures you. What we know about traffic comes from our hosting provider, Cloudflare, which counts the requests that reach the site as part of serving them: how many, for which pages, from which countries, and how fast they were answered. Those counts are aggregate. They are made from the request itself, on Cloudflare's side, so nothing runs in your browser and nothing is stored on your device.

Why there is no cookie banner. European cookie rules require your consent before a site stores or reads information on your device. This site does neither, so there is nothing to ask you about. Adding a banner would not give you any additional control; it would only be theatre. If we ever adopt a tool that does store something on your device, the banner appears first and the tool second, not the other way round.

Cloudflare is listed on our subprocessors page for website hosting. If we add any analytics tool, we will publish an updated version of this policy naming it before switching it on.

None of this applies to interpreted calls. Nothing described in this section touches call audio, call content or caller phone numbers, which are governed by the sections above.

13. Children

The service is sold to businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16.

14. Security

Every table in our database has row-level security enabled, and the roles our public interfaces could use have no access to it at all: everything is read and written server-side with credentials that never leave our servers. Access credentials live in environment configuration, never in code or in a browser. PINs are stored salted and hashed. Access is least-privilege.

No system is perfectly secure, and we do not claim ours is.

15. Changes

We may update this policy. When a change is material we will publish the updated version here with a new effective date and, for customers, notify the account contact. The version and effective date at the top of this page identify the text currently in force.

16. Contact

privacy@getparlaya.com for anything in this policy, or support@getparlaya.com for anything else.

Parlaya LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA.