Privacy Policy

Last edited:

1. Who we are and what this policy covers

Parahelp is operated by Copilot Labs, Inc., 431 Bryant St, San Francisco, CA 94107, United States ("Parahelp", "we", "us" or "our"). Copilot Labs, Inc. is the data controller for the personal information described in this policy. Our Danish subsidiary, OWND ApS, Nyhavn 14, st., 1051 Copenhagen, Denmark, supports our sales, marketing and engineering work, processes personal information on our behalf and under our instructions, and is our point of contact in the EU. Wherever you are, you can reach us about anything privacy-related at security@parahelp.com.

This policy covers parahelp.com and its subpages (the "Website"), the marketing emails we send, and the sales and demo conversations that start from the Website.

It does not cover the Parahelp platform at app.parahelp.com or the customer support conversations our customers run through Parahelp. That data is processed on our customers' instructions and is governed by our customer agreements and Data Processing Addendum. Our security and compliance documentation is available at trust.parahelp.com.

2. Information we collect

2.1 Information you give us

  • Demo requests and sales conversations. When you book a demo or contact us, we collect your name, work email address, company, job title, phone number if you provide it, the time slot you choose and anything you tell us about your support setup or requirements.

  • Emails and messages. If you email us or message us on social media, we keep the correspondence.

  • Newsletter and updates. If you sign up for product updates, we collect your email address and, if you give them, your name and company.

  • Job applications. If you apply for a role, we collect the information in your application (CV, links, answers to application questions). The job posting or application form may give you additional information.

2.2 Information collected automatically

When you visit the Website, we and the providers listed in section 4 collect device and usage information: your IP address and the approximate location derived from it (country, region, city), browser type and version, operating system, device type and screen size, language, the page that referred you, the pages you view, the links and buttons you click, how long you stay, and identifiers stored in cookies or similar technologies.

Depending on the choices you make in our cookie banner, this also includes:

  • Session recordings (Analytics). PostHog may record how you interact with a page (mouse movement, scrolling, clicks, and the page content shown to you) so we can see where visitors get stuck. Text you type into forms is masked in recordings.

  • Advertising measurement (Marketing). The LinkedIn Insight Tag and Google Ads tags let LinkedIn and Google record that a browser visited our Website, which pages it viewed, and whether it arrived from one of our ads.

  • Visitor identification (Marketing). Unify collects your IP address, the pages you view and browser identifiers so that it can work out which company you are visiting from.

None of these optional technologies run until you accept the relevant category in the cookie banner. See section 4 and our Cookie Policy.

2.3 Information from other sources

  • Company and contact matching (Unify). If you have accepted Marketing cookies, Unify matches your IP address and browser identifiers against business databases operated by Unify and its data providers (for example reverse-IP registries and business identity graphs) and may return the name, size and industry of your employer and, in some cases, your business contact details such as your name, job title, work email address and LinkedIn profile. We use this to decide which companies our sales team should reach out to.

  • Advertising platforms. LinkedIn and Google give us aggregated reports about the visitors who arrive from our campaigns (for example job function, seniority, industry and company size). These reports do not identify individuals.

  • Public and business sources. When we are in contact with you, we may add publicly available business information about you or your company (for example from your company website or your public LinkedIn profile) to prepare for a conversation.

  • Referrals and partners. Occasionally a customer, partner or investor introduces us to you and shares your business contact details.

3. How we use information, and our legal bases

We use the information described above for the purposes below. Where the GDPR or UK GDPR applies, the legal basis for each purpose is given after it.

  • Operate, secure and maintain the Website (hosting via Framer, content delivery and bot protection via Cloudflare, system logs, debugging). Uses device and usage information, IP address and security cookies. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR) in running a secure, reliable website.

  • Respond to demo requests and enquiries, schedule and hold demos, follow up, and manage our relationship with you and your company. Uses your contact and company details, correspondence and meeting notes. Legal basis: steps you ask us to take before entering into a contract (Art. 6(1)(b)), and our legitimate interests in business-to-business sales.

  • Understand how the Website is used and improve it, including with session recordings. Uses usage information, analytics cookies and session recordings. Legal basis: your consent (Art. 6(1)(a)), given when you accept Analytics cookies.

  • Measure our LinkedIn and Google advertising and show Parahelp ads to people who have visited our Website. Uses IP address, pages viewed, browser and device information and advertising cookies. Legal basis: your consent (Art. 6(1)(a)), given when you accept Marketing cookies.

  • Identify the companies visiting our Website and prioritize sales outreach. Uses IP address, pages viewed, browser identifiers, and the company and contact data Unify returns. Legal basis: your consent for the tracking on our Website (Art. 6(1)(a)); our legitimate interests in business-to-business sales for the outreach that follows, subject to your right to object.

  • Send product news and marketing emails. Uses your email address, name and company. Legal basis: your consent, or our legitimate interests where the law allows us to email existing customers and business contacts without consent. Every email has an unsubscribe link.

  • Recruit. Uses your application data. Legal basis: steps taken at your request before entering into a contract, legal obligations, and our legitimate interests in hiring.

  • Comply with the law, respond to lawful requests, enforce our terms, protect our rights and those of others, and prevent fraud and abuse. Uses whatever information is relevant to the matter. Legal basis: legal obligation (Art. 6(1)(c)) and our legitimate interests.

We do not use information collected through the Website to make automated decisions that have legal or similarly significant effects on you.

4. Cookies, consent and tracking technologies

When you first visit the Website, a cookie banner asks whether you want to allow optional cookies and similar technologies. Until you make a choice, only strictly necessary technologies run: hosting, content delivery and security, the storage of your consent choice, and Framer's cookieless site statistics. You can choose Accept all, Reject all, or Customize to pick categories:

  • Analytics: Google Analytics and PostHog, including PostHog session recordings.

  • Marketing: the LinkedIn Insight Tag, Google Ads tags, and Unify visitor identification.

You can change your mind at any time through the Cookie settings link in the footer of every page. Your choice is stored in your browser and remembered until you change it or clear your browser data. If we add a new provider that needs consent, we will ask you again.

Global Privacy Control. We honor the Global Privacy Control (GPC) signal. If your browser sends it, we treat it as a decision to reject Marketing cookies and, if you are a California resident, as a request to opt out of the sale and sharing of your personal information. We do not respond to "Do Not Track" signals, for which there is no common standard.

The providers below receive information from your browser when you use the Website:

  • Framer B.V. (Netherlands). Necessary. Hosts and serves the Website, shows the cookie banner and stores your consent choice. Framer's built-in site statistics count page views, referrers, estimated country and device type without cookies or persistent identifiers. Receives your IP address (to serve the page and estimate country), browser information and pages viewed.

  • Cloudflare, Inc. (United States). Necessary. Content delivery, DDoS mitigation and bot protection. All traffic to the Website passes through Cloudflare. Receives your IP address, request headers and security cookies.

  • Cal.com, Inc. (United States). Necessary, only on the Book a demo page. Powers the booking widget so you can pick a time. Receives the details you enter to book, your time zone and browser information.

  • Google LLC (United States), via Google Tag Manager. Analytics. Google Analytics 4 produces statistics about how the Website is used. Google Analytics does not log or store IP addresses. Tags load through Google Tag Manager with Google consent mode set to "denied" until you accept. Receives pages viewed, referrer, approximate location, browser and device information, and a random client ID stored in a cookie.

  • PostHog, Inc. (United States), data hosted in PostHog's EU cloud (Frankfurt, Germany). Analytics. Product analytics (page views, clicks) and session recordings of how you interact with pages, with form inputs masked. Receives pages viewed, clicks, scrolling and mouse movement, browser and device information, IP address, and a random visitor ID stored in a cookie.

  • LinkedIn Corporation (United States); for EU/EEA and Swiss members, LinkedIn Ireland Unlimited Company. Marketing. The LinkedIn Insight Tag measures whether our LinkedIn ads lead to visits and demo bookings, lets us show Parahelp ads on LinkedIn to people who visited our Website (retargeting), and gives us aggregated reports about visitors' professional characteristics. If you are logged in to LinkedIn, LinkedIn can connect the visit to your LinkedIn profile under its own privacy policy. Receives IP address, page URL, referrer, browser and device information, timestamp and LinkedIn cookies.

  • Google LLC (United States), Google Ads. Marketing. Measures whether our Google ads lead to visits and demo bookings and lets Google show Parahelp ads to people who visited our Website. Receives IP address, page URL, browser and device information and advertising cookies.

  • Unify (unifygtm.com, United States). Marketing. Visitor identification. Matches your IP address and browser identifiers against business databases run by Unify and its data providers to identify the company you are visiting from and, in some cases, your business contact details, so our sales team can follow up. Unify may combine this with information from other sources. Receives IP address, page URL and title, referrer, campaign (UTM) parameters, clicks and form interactions, and browser identifiers.

The Cookie Policy lists the individual cookies each provider sets, how long they last, and how to opt out directly with each provider.

5. How we share information

  • Service providers. Companies that process information on our behalf and on our instructions: website hosting and content delivery (Framer, Cloudflare), analytics (Google, PostHog), demo scheduling (Cal.com), our CRM and email tools, cloud infrastructure, and professional advisers. They may only use the information to provide their services to us.

  • Advertising and sales intelligence partners. LinkedIn, Google Ads and Unify receive information from your browser only after you accept Marketing cookies. They also use that information for their own purposes: LinkedIn and Google to operate their advertising platforms, and Unify to run and improve its identity databases, including by combining information from many sources. Because of this, disclosing identifiers and browsing activity to them may count as "selling" or "sharing" personal information under California law even though no money changes hands. You can opt out at any time (section 9). We do not sell personal information for money.

  • Our subsidiary. We share information with OWND ApS, our Danish subsidiary, which supports our sales, marketing and engineering work and processes it on our behalf under an intercompany agreement.

  • Legal, safety and corporate. We disclose information when the law requires it, to respond to lawful requests from public authorities, to enforce our terms, to protect the rights, property or safety of Parahelp, our customers or others, and to our insurers and advisers. If Parahelp is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction.

6. International transfers

We are based in the United States and several of our providers are there too, while our subsidiary OWND ApS is in Denmark. If you are in the EU/EEA, the UK or Switzerland, your information will therefore be transferred to the United States, which does not provide the same level of data protection as your home country. When that happens we rely on an adequacy decision (including the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, where the recipient is certified) or on the European Commission's Standard Contractual Clauses (and the UK Addendum) together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at security@parahelp.com.

7. How long we keep information

  • Demo requests, sales correspondence and CRM records: for as long as we are in contact with you or your company and for up to 24 months after our last interaction. If your company becomes a customer, for the duration of the relationship and as required afterwards for legal and accounting purposes.

  • Marketing email list: until you unsubscribe, or after 24 months without any engagement from you.

  • Google Analytics data: up to 14 months.

  • PostHog: session recordings for up to 30 days; analytics events for up to 12 months.

  • LinkedIn, Google Ads and Unify: retained by those providers under their own privacy policies. We keep the company and contact information Unify returns to us for as long as it is relevant to our sales pipeline, and no longer than the CRM retention above.

  • Consent records: for as long as your consent is valid, plus the period needed to demonstrate that consent was obtained.

  • Job applications: for the duration of the recruitment process and up to 6 months afterwards, unless you agree to be kept on file for longer.

  • Server and security logs: up to 12 months.

We may keep information for longer where we need it to comply with a legal obligation, resolve disputes, or establish, exercise or defend legal claims.

8. Security

We protect information with technical and organizational measures appropriate to the risk, including encryption in transit, access controls, logging and staff training. Parahelp maintains a SOC 2 program; our security documentation is available at trust.parahelp.com. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your rights and choices

9.1 Choices available to everyone

  • Cookie settings. Change or withdraw your consent at any time through the Cookie settings link in the footer.

  • Global Privacy Control. Turn on GPC in your browser and we will treat it as described in section 4.

  • Marketing emails. Use the unsubscribe link in any email, or email us.

  • Provider controls. You can opt out of LinkedIn retargeting in your LinkedIn ad settings, manage Google ad personalization at adssettings.google.com, and block Google Analytics with the Google Analytics opt-out add-on.

  • Ask us. You can ask what information we hold about you, ask us to correct or delete it, or object to how we use it, by emailing security@parahelp.com. This includes information about you that Unify has returned to us.

9.2 If you are in the EU/EEA, the UK or Switzerland

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing (including the right to object to direct marketing at any time), to receive it in a portable format, and to withdraw consent at any time without affecting processing that took place before withdrawal. To exercise these rights, email security@parahelp.com. We will respond within one month, extendable by two further months for complex requests, and we may ask you to confirm your identity. You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work. In Denmark, where our subsidiary OWND ApS is based, this is the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk). UK residents may contact the Information Commissioner's Office (ico.org.uk).

9.3 If you are a California resident

This section supplements the rest of this policy and applies to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together the "CCPA"), applies to us.

Categories of personal information. In the 12 months before the date of this policy we have collected the following categories of personal information about Website visitors. Categories marked as sold or shared are disclosed to LinkedIn, Google Ads (cross-context behavioral advertising) and Unify (visitor identification) only after you accept Marketing cookies, and only until you opt out.

  • Identifiers (name, work email, phone, IP address, cookie and device identifiers). Sources: you, your browser, Unify. Disclosed to service providers: yes. Sold or shared: yes (IP address and cookie identifiers, to LinkedIn, Google Ads and Unify).

  • Professional or employment information (company, job title, industry). Sources: you, Unify, public sources. Disclosed to service providers: yes. Sold or shared: no.

  • Commercial information (demo requests, interest in our products, correspondence). Source: you. Disclosed to service providers: yes. Sold or shared: no.

  • Internet or other network activity (pages viewed, clicks, referrer, session recordings, interaction with our ads). Source: your browser. Disclosed to service providers: yes. Sold or shared: yes (to LinkedIn, Google Ads and Unify).

  • Geolocation (approximate) (country, region or city derived from IP address). Source: your browser. Disclosed to service providers: yes. Sold or shared: yes (as part of the IP address, to LinkedIn, Google Ads and Unify).

  • Inferences (likely interest in Parahelp, company fit). Source: derived by us. Disclosed to service providers: yes. Sold or shared: no.

  • Sensitive personal information: none. We do not collect sensitive personal information through the Website.

We use these categories for the business and commercial purposes in section 3 and keep them for the periods in section 7. We do not knowingly sell or share the personal information of consumers under 16. We do not offer financial incentives in exchange for personal information.

Your rights. You have the right to know and access the personal information we have collected about you, its sources, the purposes, and the categories of third parties we have disclosed it to; the right to delete personal information we have collected from you, subject to legal exceptions; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of your personal information; the right to limit the use of sensitive personal information (not applicable, as we do not collect it through the Website); and the right not to be discriminated against for exercising any of these rights.

How to exercise your rights.

  • Opt out of sale or sharing: open Cookie settings in the footer of any page and turn off Marketing. That stops the disclosures described above for that browser. You can also enable the Global Privacy Control signal in your browser, which we honor automatically and treat as an opt-out.

  • Access, deletion and correction: email security@parahelp.com with "California privacy request" in the subject line. We will verify your request by matching the information you provide with information we hold, and may ask for additional details. We respond within 45 days and may extend once by a further 45 days where reasonably necessary, in which case we will tell you.

  • Authorized agents: you may use an authorized agent. We will ask for proof of the agent's authority and may ask you to confirm your identity directly.

  • Downstream deletion: if you also want us to delete company or contact information about you that Unify has returned to us, say so in your email and we will delete it.

Shine the Light. California Civil Code section 1798.83 allows California residents to request certain information about the disclosure of personal information to third parties for their direct marketing purposes. To make such a request, email security@parahelp.com.

9.4 If you are in another US state

Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) may have rights to access, correct, delete and obtain a portable copy of their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects. To the extent these laws apply to us, you can exercise these rights using the methods in section 9.3, and you can opt out of targeted advertising through the Cookie settings link or the Global Privacy Control signal. If we decline a request, you may appeal by replying to our response; we will answer your appeal within 45 days and, if we still decline, tell you how to contact your state Attorney General.

10. Children

The Website is aimed at businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, email security@parahelp.com and we will delete it.

11. Links to other websites

The Website links to other websites and services, including LinkedIn, X and the Parahelp platform. Their privacy practices are governed by their own policies.

12. Changes to this policy

We will update this policy when our practices or the law change. We will post the new version here with a new "last updated" date and, for significant changes, tell you through the Website or by email where we have your address. Where a change concerns processing based on your consent, we will ask for your consent again.

13. Contact us

Email: security@parahelp.com

Copilot Labs, Inc., 431 Bryant St, San Francisco, CA 94107, United States

EU contact: OWND ApS, Nyhavn 14, st., 1051 Copenhagen, Denmark