This policy explains how KMDR Holdings Ltd (“ParlioTec”, “we”) collects and uses personal data. We are registered with the Information Commissioner’s Office (ICO) under registration number 00015465911. Contact: [email protected], 124-128 City Road, London, England, EC1V 2NX.
1. Who this policy covers
- Website visitors — people using parliotec.com, including the “Hear it live” demo and the contact form.
- Customers and their team members — people who create or use a ParlioTec account.
- Callers and contacts of our customers — people who phone, message or chat with a business that uses ParlioTec. For this data the business is the controller and we are the processor; their privacy notice applies, and section 7 explains how we handle it on their behalf.
2. Data we collect as controller
| Context | Data | Purpose & lawful basis |
|---|---|---|
| Website | IP address, browser and device information, pages viewed (server logs; analytics only if you accept cookies) | Run and secure the site; legitimate interests. Analytics with consent. |
| Contact form | Name, email, company, phone, your message | Reply to your enquiry; legitimate interests / steps prior to a contract. |
| “Hear it live” demo | Your voice during the demo call, a transcript, an anonymous visitor identifier, IP address, any name you type | Provide the demo, prevent abuse (rate limits), improve the demo assistant; legitimate interests. Do not share sensitive personal data in the demo. |
| Account | Name, email, phone, company, role, login and security data (2FA, sessions), billing details | Provide the Service under our contract; legal obligations (accounting); security (legitimate interests). |
| Product usage | Dashboard actions, audit log, support tickets and help questions | Operate, support and improve the Service; legitimate interests. |
| Marketing | Email, preferences | Product news and offers to business contacts; legitimate interests with easy opt-out, or consent where required. |
3. How long we keep it
- Contact-form enquiries: 24 months from last contact.
- Demo recordings and transcripts: 30 days, then deleted.
- Account data: for the life of the account plus 30 days; billing records 6 years (HMRC).
- Server and security logs: 90 days.
4. Who we share it with
Service providers acting on our instructions: cloud hosting (UK regions), telephony carriers, speech-to-text, text-to-speech and language-model providers, email/SMS delivery, payment processing and analytics. The current list with locations is in the sub-processor schedule of our DPA. We may disclose data where required by law. We do not sell personal data.
5. International transfers
We host in the UK. Where a provider processes data outside the UK we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum, with additional safeguards where needed.
6. Your rights
You can ask for access to, correction or erasure of your data, object to or restrict processing, request portability, and withdraw consent at any time by emailing [email protected]. You can complain to the ICO (ico.org.uk, 0303 123 1113), but we would appreciate the chance to resolve concerns first.
7. Callers and contacts of our customers (processor role)
When you call, message or chat with a business using ParlioTec, we process your voice, phone number, messages, transcripts, summaries and any details you give (such as name, address or appointment preferences) on that business’s instructions. Calls may be recorded and are announced where the business has enabled it. The business decides retention and can export or delete your data on request; please contact them directly. Our processing is governed by our Data Processing Agreement with them. We do not use this data to train general AI models, and platform staff access it only for support with the business’s permission, logged in an audit trail.
8. Google user data (Google Calendar integration)
The ParlioTec application (the dashboard at app.parliotec.com) offers an optional connection to Google Calendar through Google Sign-In / OAuth 2.0. This section describes, for the purposes of the Google API Services User Data Policy, exactly what Google user data ParlioTec accesses, how it is used, stored, shared and deleted. Nothing in this section applies until a customer chooses to click “Connect Google Calendar” and grants consent on Google’s consent screen.
8.1 What Google user data we request
| Google scope | Data it gives access to | Why ParlioTec needs it |
|---|---|---|
https://www.googleapis.com/auth/calendar.readonly | The list of calendars on the account and the free/busy status of events on the calendar the customer selects | To let the customer choose which calendar to book into, and to work out which appointment slots are free when a caller asks to book |
https://www.googleapis.com/auth/calendar.events | Create, update and delete events | To create the appointment event when a caller books, and to move or cancel that event if the caller reschedules or cancels |
openid, email | The Google account’s email address and account identifier | To label the connection in the dashboard (“Connected as [email protected]”) and to match a refreshed token to the right connection |
8.2 How we use it
- Availability: when a caller asks for an appointment, ParlioTec queries the Google Calendar free/busy endpoint for the selected calendar within the customer’s configured booking window (for example the next 14 days) and offers only the free slots that fit the customer’s booking rules.
- Booking: when the caller accepts a slot, ParlioTec creates a calendar event on that calendar containing the appointment time, the service requested, and the caller details the customer has asked us to capture (typically name, phone number, address and a short description of the request).
- Changes: if the caller reschedules or cancels through ParlioTec, we update or delete that same event. We never modify events that ParlioTec did not create.
- Dashboard: bookings ParlioTec created are shown to the customer’s team in the Bookings and Schedule screens of the dashboard.
We read only the start and end times and the free/busy status of the customer’s existing events. We do not read, display or store the titles, descriptions, attendees, locations or attachments of any event that ParlioTec did not itself create.
8.3 What we store, and for how long
- The OAuth refresh token and short-lived access token, encrypted at rest (authenticated AES encryption) in our UK-hosted database, used solely to make the calendar requests above on the customer’s behalf.
- The connected Google account email address and the identifier of the calendar the customer selected.
- The identifiers, times and booking details of events that ParlioTec created, so they can be shown in the dashboard and updated or cancelled later.
- Free/busy results are used in memory to calculate available slots and are not retained after the call or booking session ends.
Tokens are deleted immediately when the customer disconnects the calendar or when the account is closed. Booking records are kept for the life of the customer’s account plus 30 days (section 3), or for the retention period the customer configures, whichever is shorter.
8.4 Sharing of Google user data
We do not sell Google user data. We do not share it with advertisers, data brokers or any other third party. Google user data is transmitted only between ParlioTec’s servers and Google’s APIs, except that appointment details (time, service, caller details) are, on the customer’s instruction, sent to the customer’s own connected tools (for example a CRM or field-service system) and stored by our UK cloud hosting provider as part of running the Service. We do not use Google user data for advertising, for profiling, for market research, or to develop, improve or train generalised artificial-intelligence or machine-learning models.
8.5 AI and machine-learning services
ParlioTec uses third-party AI services (speech recognition, large language models and text-to-speech) to hold the conversation with a caller. Google user data is not sent to these services in raw form. The only Google-derived data an AI model ever receives is the list of free appointment slots computed from the free/busy query (dates and times), so the assistant can offer them to the caller. Event titles, descriptions, attendees, the connected account email and OAuth tokens are never passed to any AI service. The appointment the caller agrees to is created in Google Calendar by ParlioTec’s own servers, not by an AI provider.
The AI providers we use are OpenAI (OpenAI API platform, for the language model), Deepgram (Deepgram API, for speech recognition) and Cartesia (Cartesia API, for text-to-speech). We access each directly through its paid business API, under terms that prohibit the use of API inputs and outputs to train or improve their generalised models, with no opt-in to data sharing; we do not use aggregators, gateways or model hubs, and we do not operate self-hosted or offline models. We do not use raw, aggregated or anonymised Google user data to develop, improve or train any AI or machine-learning model, whether our own or a third party’s. We will update this list before adding or replacing a provider.
8.6 Human access
ParlioTec staff do not read Google user data except (a) with the customer’s explicit permission to resolve a support request, (b) where necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymised for internal operations. All staff access is recorded in an audit log the customer can view.
8.7 Limited Use disclosure
ParlioTec’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
8.8 Revoking access and deleting your data
Customers can disconnect Google Calendar at any time from Integrations → Calendar → Disconnect in the dashboard, which deletes the stored tokens immediately, or revoke ParlioTec’s access from their Google Account at myaccount.google.com/permissions. Events ParlioTec created remain in the customer’s Google Calendar unless they delete them. To have all stored booking records deleted, customers can use the account-deletion option in Settings → Compliance or email [email protected]; we complete deletion within 30 days.
9. Microsoft 365 / Outlook calendar data
Customers may alternatively connect a Microsoft 365 or Outlook.com calendar. We request the Microsoft Graph permissions Calendars.ReadWrite (read free/busy and create, update or delete the appointments we book) and User.Read (the account email address, to label the connection). The same use, storage, sharing, human-access and deletion commitments in section 8 apply. Access can be revoked from the dashboard or from the customer’s Microsoft account settings.
10. Cookies
See our Cookie Policy.
11. Security
Encryption in transit and at rest, role-based access with two-factor authentication, audit logging, PII redaction options, tested backups and a documented incident process. We will notify affected customers and, where required, the ICO within 72 hours of becoming aware of a personal data breach.
12. Children
The Service and website are for businesses and are not directed at children under 16.
13. Changes
We will post updates here and, for material changes, notify account holders by email.