Your brief. Your information.

Version dated 2 October 2026. Paloren privacy questions to hello@paloren.ai.

Who we are.

Paloren decides why and how the personal data described on this page is used, which makes us the data controller for visitors in the UK and the European Economic Area. We do not have a statutory data protection officer; the founders handle privacy questions personally.

What you send us.

When you use the inquiry form or Paloren character, we collect your name, work email, company, role, a brief description of what should work better, and any budget and timing information you provide. If you attach files, we accept up to three PDF or Word documents, 2 MB each, 3 MB total.

Where it goes.

Your inquiry is emailed to hello@paloren.ai and stored in HighLevel, the CRM we use to manage inquiries and client relationships. Cloudflare processes the website submission and holds a private delivery copy for up to 90 days. That website copy expires automatically; the 90-day limit does not apply to our email or CRM records. Attachments stay in private delivery storage and the emailed brief. Only their filenames are included in the CRM, not public download links.

What we do with it.

We review your brief and aim to reply within one business day. We use it to understand your priorities, recommend an approach and manage the conversation or an agreed engagement. We do not sell your information. An inquiry alone does not subscribe you to marketing. When you separately choose email ideas, that permission covers ideas tailored to your brief followed by weekly Paloren emails. You can unsubscribe at any time without affecting your inquiry. We retain email and CRM records while needed for the inquiry, relationship and applicable record-keeping obligations. You can ask us to access, correct or delete your information by emailing hello@paloren.ai.

Optional live AI calls.

The live-call option is separate from the scripted character and written brief. Your microphone is requested only when you start a call. The call is recorded and transcribed for the Paloren team to review. We save the transcript, AI-generated summary, questions, business context, recording reference and any confirmed appointment against your CRM record. Please do not share passwords, payment details or sensitive personal information. AI summaries can contain mistakes; the transcript and team review are the reference. We use the call to handle your inquiry, not as permission for unsolicited telephone calls or marketing.

Why we are allowed to use it.

We use your brief because you asked us to reply to it (steps you take before entering a contract) and because we have a legitimate interest in answering enquiries about our services. You can withdraw at any time by asking us to delete the brief. If we later work together, the engagement agreement becomes the basis for the records it needs.

Who processes it for us.

Cloudflare hosts the website, processes inquiries and stores the 90-day delivery copy. HighLevel manages CRM records and appointments. Google Workspace handles team email. Google Analytics (Google LLC) and Microsoft Clarity (Microsoft Corporation) measure site use under your analytics choice, with Clarity masking every typed field. If you choose a live call, Vapi coordinates the call, Daily transports the browser audio, Deepgram transcribes speech, OpenAI generates responses and Inworld produces Paloren's voice. Relevant audio, text and the brief you provide are processed by these services for the call. The usual scripted character uses pre-produced audio and does not send your typed answers to a voice provider. Cloudflare Turnstile checks live-call requests for automated abuse. These suppliers operate in the United States and other countries.

Where it travels.

Because those suppliers are outside the EEA, your data is transferred internationally. For EEA and UK visitors we rely on the suppliers’ standard contractual clauses and their published security commitments. Ask us if you want a copy of the safeguards we rely on.

How long we keep it.

• Website delivery copy (Cloudflare): deleted automatically after 90 days.
• Emailed brief and attachments: kept while we handle the enquiry and, if we work together, for the life of the engagement plus the record-keeping period the law requires.
• CRM record (HighLevel): kept while the enquiry or relationship is live; enquiries that go nowhere are closed and deleted within 24 months of the last contact.
• Readiness scorecard answers and training enquiries: treated exactly like a brief, above.

Analytics and tracking.

This site has no advertising trackers or cross-device visitor identification. Google Analytics 4 and Microsoft Clarity measure visits under one analytics choice: in the EU, EEA, UK and Switzerland only after you accept in the consent banner (before that Google receives cookieless, anonymous signals only and Clarity does not load); everywhere else from your first visit until you decline, which stops both. With analytics on, we measure page use and progress through our forms and calls using field names and chosen options, never the text you type or your contact details. Clarity session replays mask every typed field. If you accepted analytics before a live call, our server reports the call outcome (duration, whether a meeting was booked) against the anonymous analytics identifier, never audio or transcripts. See the cookies page. We save the page where you submit your inquiry so the team knows its context. Optional live calls load the call transport and security-check software needed to provide that feature. Security logs and short-lived hashed request identifiers help prevent abuse and limit paid call usage; they are not used to identify your browsing for marketing.

Company context.

If you give us a company website, we may review its public business information to prepare for your inquiry and tailor the ideas you requested. We retrieve public pages directly or through Jina Reader. The reader receives the website address, not your name, email, call recording or private brief. We record the source and research date and distinguish published facts from suggestions. We do not use this to investigate private individuals, infer sensitive traits or claim access to your internal systems.

Your rights.

You can ask us for a copy of what we hold, ask us to correct or delete it, object to our using it, or ask us to stop contacting you. Email hello@paloren.ai; we reply within one business day and act within a month. If you are in the EEA or UK you can also complain to your data protection authority. We would rather hear from you first.

Children.

This site is for businesses. We do not knowingly collect data from anyone under 18; if you think we have, tell us and we will delete it.

Changes.

When this page changes, the version date at the top changes with it. Material changes to how we use existing enquiries will be emailed to the people affected.

Contact.

Paloren. hello@paloren.ai. See also the legal notice, terms of use, cookies and tracking and AI disclosure.