Privacy Policy

1. Scope and roles

This Privacy Policy applies to (a) our websites and marketing properties (the "Websites") and (b) our software and related services, including Navigator and any meeting assistant/bot, integrations, and APIs (the "Services").

For personal data collected via the Websites, In Parallel Oy is the controller. For data we process in the Services on behalf of a business customer ("Customer Content"), the Customer is the controller and In Parallel is the processor. Our Data Processing Addendum ("DPA") forms part of our contract with customers.

2. The data we process

Depending on how you interact with us, we may process:

• Account & Profile: name, email, password hash or SSO identifier, role, organization.
• Customer Content (Services): meeting transcripts and summaries, action items, topics and decisions captured by Navigator or the meeting bot—controlled by your organization's admin settings and integrations.
• Usage & Telemetry: pages visited, features used, device, browser, IP address, session IDs.
• Marketing: contact details submitted through forms, event sign-ups, or content downloads; campaign-performance data from cookies and tracking pixels (see Cookie Policy).
• Communication: messages you send us via support, chat, or email.
• Third-party integrations: data synced through calendar, project-management, or messaging integrations that your organization connects to In Parallel.

3. Purposes and legal bases

We process personal data for these purposes and on these legal bases:

• Providing and operating our Services: performance of contract (Art. 6(1)(b) GDPR)
• Improving and developing the platform: legitimate interest (Art. 6(1)(f))
• Meeting capture and transcript processing: legitimate interest of the customer's business operations plus the customer's obligation to obtain participant consent where required by applicable law
• Marketing, analytics, and advertising cookies: consent (Art. 6(1)(a))
• Complying with legal obligations: legal obligation (Art. 6(1)(c))
• Protecting our rights and preventing fraud: legitimate interest (Art. 6(1)(f))

4. Automated decision-making

We do not make decisions with legal or similarly significant effects solely based on automated processing.

5. Meeting capture and transcripts

If your admin—or you—enables meeting capture, our assistant may join calls to record audio and generate transcripts/summaries.

Consent should be obtained from all participants before allowing In Parallel to access the meeting. Once added, the assistant announces its presence and links to its privacy notice in the meeting chat (where supported).

Your organization is responsible for providing all legally required notices and securing consent. Admins can configure defaults for recording/transcripts and set retention.

6. Third-party processors and integrations

We use trusted subprocessors (e.g., cloud hosting, storage, logging, transcription/LLM providers) to operate the Services under written contracts that meet GDPR Article 28.

An up-to-date list of subprocessors is available upon request. We will notify customers of material subprocessor changes in advance.

7. Google user data

When you sign in with Google or connect a Google account (for example Google Calendar) to In Parallel, we access only the Google user data covered by the permissions you grant on Google's consent screen. Depending on what you connect, this can include your name, email address and profile picture, the list of calendars you subscribe to, and calendar events (titles, times, descriptions, attendees and meeting links).

How we use it. We use Google user data only to provide and improve the user-facing features you enabled: signing you in, showing your upcoming meetings, sending the In Parallel meeting assistant to the meetings you choose, and linking meeting notes, briefings and follow-ups to the right calendar events.

With whom we share, transfer or disclose it. We do not sell Google user data, and we do not share it with advertisers, data brokers or information resellers. We share, transfer or disclose Google user data only with:

• Your own organization: meeting details derived from your calendar are visible to the members of the In Parallel workspaces those meetings belong to, according to your organization's sharing settings.
• Our infrastructure and AI subprocessors: Amazon Web Services (cloud hosting, storage and AI model processing through Amazon Bedrock, in the EU by default), and the meeting assistant infrastructure that uses a meeting's link and time to join it. These subprocessors process the data only on our instructions, to operate the Services, under written data processing agreements, and may not use it for their own purposes.
• When required by law: where necessary to comply with applicable law, a valid legal process or governmental request, or to protect the security of our Services and users.
• In a business transfer: as part of a merger, acquisition or sale of assets, subject to this policy, with notice to affected users.
• With your consent: in any other case, only with your explicit prior consent.

We do not use Google user data for advertising, to determine creditworthiness, or to develop, improve or train generalized AI or machine-learning models. Our staff do not read Google user data unless you ask us to (for example for support), it is necessary for security purposes or to comply with law, or the data has been aggregated and anonymized.

In Parallel's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect your Google account at any time from your In Parallel settings or from your Google Account permissions page. To have Google user data we hold deleted, contact info@in-parallel.com.

8. International data transfers

Some subprocessors are based outside the EEA. For each transfer we rely on one or more of: EU adequacy decisions, Standard Contractual Clauses, the EU-U.S. Data Privacy Framework.

Customer Content is stored in the EU by default; alternative residency options may be available by agreement.

9. Security

Technical and organizational measures include encryption at rest and in transit (TLS 1.2+), access controls, least-privilege principles, audit logging, vulnerability management, and incident-response procedures.

We hold ISO 27001 and ISO 42001 certifications and conduct annual external audits and penetration tests.

10. Retention

We retain personal data only as long as needed for its purpose or as required by law.

Customer Content retention defaults are set by the customer's admin. Marketing data is retained until consent is withdrawn. Website analytics data is retained in anonymized/aggregated form.

When data is no longer needed, it is securely deleted or anonymized in accordance with our retention schedule.

11. Your rights (EEA/UK)

Under GDPR you have the right to:

• Access: obtain a copy of your data.
• Rectification: correct inaccurate data.
• Erasure: request deletion ("right to be forgotten").
• Restriction: limit processing in certain cases.
• Portability: receive your data in a structured, machine-readable format.
• Object: object to processing based on legitimate interest.
• Withdraw consent: at any time for consent-based processing (e.g., cookies, marketing emails).
• Lodge a complaint: with your local supervisory authority.

To exercise any of these rights, contact us at info@in-parallel.com or through the means listed below. We will respond within 30 days.

12. Data Protection Officer

Name: Kristian Luoma
Email: info@in-parallel.com

13. Contact

In Parallel Oy
Salomoninkatu 17 B 4
00100 Helsinki, Finland
info@in-parallel.com

14. Changes

We may update this policy from time to time. Material changes will be communicated via email or in-product notice. The "Effective" date at the top shows the latest version.