How Pairly handles personal information.
1. Who is responsible
For your account and for how Pairly itself is run, the responsible party (controller) is [OWNER REVIEW: legal entity name], registration number [OWNER REVIEW: company registration number], [OWNER REVIEW: registered and physical address].
Information officer (POPIA) and data protection contact: [OWNER REVIEW: information officer name and contact email; registration with the Information Regulator].
For personal data about your own customers that you put into Pairly, you are the responsible party and Pairly is your operator (processor). [OWNER REVIEW: EU/UK representative under GDPR Art. 27, if one is required]
2. What we collect, why, and on what basis
| Category | What | Why | Lawful basis |
|---|---|---|---|
| Account | Name, email address, password hash or sign-in provider identity (Google, Apple, Microsoft), workspace membership and roles. | To create and secure your account and run the service. | Contract (POPIA s11(1)(b); GDPR Art. 6(1)(b)). |
| Business | The business profile, website content, customer and lead records, documents, mail and agent conversations you put into Pairly. | To provide the service you asked for. For personal data about your own customers we act as your processor and follow your instructions. | Contract; for your customers’ data, your instructions as the responsible party. |
| Integrations | OAuth access and refresh tokens for the accounts you connect, stored encrypted, and the data those accounts return. | To act on your connected accounts on your behalf. | Contract and your consent when you connect the account. |
| Usage and security | Sign-in events, device and browser details, IP address, actions taken, error and performance data. | To keep the service secure, prevent abuse, fix faults and bill for usage. | Legitimate interests (POPIA s11(1)(f); GDPR Art. 6(1)(f)). |
| Mobile app | Your account sign-in (kept in the device’s secure storage), the business content you open in the app (mail, messages, tasks, documents, goals, media and agent activity), and crash and performance reports. The app does not use an advertising ID and does not ask for your location, contacts, camera or microphone. [OWNER REVIEW: the released Android app still declares file storage (Android 12 and below) and draw-over-apps permissions it never uses; their removal is on mobile branch feat/mobile-blocked-permissions (bf08f71, android.blockedPermissions), pending an app release. Once that release is live, state that the app does not access photos or files] [OWNER REVIEW: push notification token, once the app registers one for notifications (the server accepts it; the current build does not send it)] | To run the app and fix faults. | Contract; legitimate interests for crash reports. |
| Support | Messages you send us and the context needed to answer them. | To help you and improve the service. | Contract and legitimate interests. |
| Marketing consent | Whether you agreed to marketing, when, and how. | To send marketing only where you agreed, and to prove it. | Consent, which you can withdraw at any time. |
| Cookies | Pairly’s own cookies only sign you in and keep you signed in: an access token (about an hour [OWNER REVIEW: confirm the live access-token lifetime setting]), a sign-in refresh token and your session details (30 days), the business you are working in (30 days), short-lived cookies while you sign in with Google, Apple or Microsoft (5 minutes), and a marker after a session is resumed (30 seconds). The Pairly app sets no analytics or advertising cookies. When you pay, the checkout is run by Paystack, which may set its own cookies or browser storage under its own policy. Websites that businesses build on Pairly set their own cookies, which that business’s own policy describes. | To operate the app. | Strictly necessary; legitimate interests. |
We do not sell personal information. We do not use the content of your business to train models for anyone else. [OWNER REVIEW: confirm the model providers’ no-training terms before this sentence is relied on]
3. Who receives it
The main ones are Microsoft Azure (hosting, storage and AI models), Sentry (crash and error reports, with no names or email addresses, only an internal account id), AI model providers, email delivery providers, and Paystack for payments. [OWNER REVIEW: Expo for mobile push notifications, once the app registers for them] We do not use Google Firebase, PostHog, Supabase or any advertising or analytics SDK in the Pairly app.
We use a small number of service providers (subprocessors) to run Pairly, for example hosting, AI models, email delivery and payments. Each one, what it receives and where it processes it is listed on the Subprocessors page. We also disclose information where the law requires it.
4. How long we keep it
The following periods are fixed in our systems:
| Data | Kept for |
|---|---|
| Apollo enrichment raw payload (contact enrichment) | 30 days, then deleted by a daily job. |
| Raw provider payloads from connected integrations | 14 days. |
| Consent records | 3 years. |
| Screenshots captured by agents | 30 days. |
When you delete your account, your sign-in details, sessions and memberships are deleted at once. A record that the account existed (its internal id, marked deleted, with no name or email) is kept. The businesses you belong to keep their own records. See Delete your account for what is deleted and what is kept.
Everything else, including account data, business content, mail, finance records and logs: [OWNER REVIEW: retention period for each category; tax and company law may require financial records to be kept for five years or more]
5. Your rights
You may ask us to:
- confirm whether we hold personal information about you and give you a copy;
- correct or delete it (you can delete your account yourself: see Delete your account);
- restrict or object to our processing, including direct marketing;
- move your data to another service (portability), where GDPR applies;
- withdraw consent you gave, without affecting what happened before.
Send the request to [OWNER REVIEW: information officer contact email]. We will respond within the period POPIA requires. We may need to verify who you are first. If your data sits in a Pairly customer’s business, we may refer you to that business, which decides what happens to it.
You can complain to the Information Regulator (South Africa), or, if you are in the EU/EEA/UK, to your local supervisory authority. [OWNER REVIEW: Information Regulator contact details to quote]
6. International transfers
Pairly’s own data is hosted in Microsoft Azure, South Africa North. Some subprocessors process data in other countries. Those are listed, with their locations, on the Subprocessors page. [OWNER REVIEW: transfer mechanism relied on for each (POPIA s72; GDPR standard contractual clauses)]
7. Security
Data is encrypted in transit: the app and the website talk to Pairly only over HTTPS (TLS), and browsers are told to use HTTPS every time (HSTS). Pairly connects to its service providers and to its managed Azure services over TLS. [OWNER REVIEW: connections inside Pairly’s private network (graph database, cache, mail scanners) are not all encrypted, as checked in the repository: fix them, or describe them, before this is published] The database and file storage are encrypted at rest with keys managed by Microsoft Azure. Passwords for connected mailboxes and calendars, and access tokens for connected accounts, are encrypted again by Pairly on top of that. [OWNER REVIEW: Cosmos DB, Service Bus and the virtual machine disks (graph database, mail): Azure encrypts these by default, but our infrastructure code does not set it, so confirm before relying on it]
Connection tokens are stored encrypted, secrets are held in a managed key vault, access is limited by role and by workspace, and agents act only through controlled tools and permissions. No system is perfectly secure. If a breach affects your personal information, we will notify you and the Information Regulator as the law requires.
8. Children
Pairly is not directed at children and we do not knowingly collect their personal information.
9. Changes to this notice
We will update this page when our practices change and give notice of material changes in the app or by email. [OWNER REVIEW: notice period] The date at the top shows when it last changed.