Palaba Privacy Notice
Last updated: August 26, 2026
This Privacy Notice explains how Parsonos Corporation (“Parsonos,” “we,” “us,” or “our”) handles personal information in connection with the Palaba website, application, services, support, and business relationships (collectively, “Palaba”).
Parsonos Corporation is a Delaware corporation at 131 Continental Drive, Suite 305, Newark, Delaware 19713, United States.
1. Scope and our role
This Notice applies when Parsonos determines why and how personal information is processed, including website, account, authentication, billing, support, security, product-analytics, legal, and business-contact information. For those activities, Parsonos acts as a controller, business, or similar responsible organization under applicable privacy law.
When a professional or publisher customer submits a manuscript, recording, project file, or related personal information and directs Palaba’s processing, that customer ordinarily acts as controller or business and Parsonos acts as its processor or service provider. The customer’s privacy notice governs its collection and use. Parsonos handles that data under the applicable service agreement and data processing addendum.
If a narrator, author, performer, contractor, or other person asks us about data controlled by a customer, we will verify enough information to route the request without confirming confidential project details. We will notify and assist the customer and act on its documented instruction, unless law independently requires us to act.
2. Personal information we collect
The information collected depends on how you interact with Palaba.
2.1 Account and identity information
We collect email address, authentication identifier, account status, tenant membership, assigned role, and, where provided, name. For enterprise users, we may receive organization and identity-provider information needed for SSO and MFA.
2.2 Customer and billing information
We collect the business-use representation and Terms acceptance record, purchase instructions, plan or usage information, invoice and payment status, billing contacts, billing country, tax information, and limited payment-method information supplied by our payment provider. Parsonos does not intend to receive full payment-card numbers.
2.3 Customer Content and project information
At a customer’s direction, Palaba processes manuscripts, scripts, PDFs, recordings, project titles and identifiers, instructions, project membership and permissions, and customer-specific outputs such as DAW sessions, pickup-package summaries, proofing reports, and script-preparation reports. These materials may contain information about narrators, authors, performers, characters, staff, contractors, or other people, including sensitive information chosen by the customer.
Palaba’s ordinary self-service workflows do not use voice recordings to identify or authenticate a person. Whether a voice recording is regulated as biometric or other sensitive information depends on the content, use, and applicable law.
2.4 Device, network, and operational information
We collect information reasonably needed to operate and secure Palaba, such as IP address, browser and device characteristics, request time, authentication and security events, system and application events, error information, job status, performance measurements, billable actions, user and tenant attribution, and signed-link or download events where logged.
We call this information “personal information” whenever it can reasonably be linked to a person, account, device, tenant, or project. Pseudonymous identifiers are not automatically anonymous.
2.5 Analytics and cookies
Palaba uses necessary technologies for authentication, security, session continuity, and user choices. We may use a service provider for first-party product analytics.
We will not place or activate non-essential analytics technologies before obtaining consent where applicable. You may withdraw consent through the available preference control. Withdrawal does not affect processing already lawfully completed. We do not use analytics for cross-context behavioral advertising.
2.6 Support and communications
We collect messages, contact details, issue descriptions, and response records when you contact us. Support email is intended to contain no manuscripts, recordings, credentials, or project files and to identify a project by title at most. A project title is still confidential project metadata. If sensitive project material is needed, we will provide an approved secure channel.
2.7 Legal, consent, and compliance records
We collect records of Terms acceptance, privacy choices, project permissions, material authorizations, complaints, privacy requests, rights concerns, security incidents, legal demands, and enforcement action where applicable.
3. Sources
We obtain personal information:
- directly from you or the customer that invited or engaged you;
- from a tenant administrator, project manager, publisher, narrator, or other rights holder;
- automatically from your browser, device, and use of Palaba;
- from identity, payment, analytics, hosting, speech-processing, email, and support providers;
- from public or government sources where needed for compliance or claims; and
- by deriving limited status, usage, security, and performance information from the operation of Palaba.
4. Why we process information
We process personal information to:
- create and authenticate accounts; manage tenants, roles, and project access; and provide requested workflows and deliverables;
- process purchases, usage, invoices, taxes, cancellations, and account administration;
- provide support, troubleshoot a customer’s issue, communicate about Palaba, and respond to requests;
- maintain reliability, measure service health and performance, diagnose errors, prevent abuse, and protect customers and Palaba;
- understand first-party feature usage and improve usability using permitted analytics and non-content telemetry;
- establish, exercise, or defend legal rights; enforce agreements; handle rights and acceptable-use reports; and comply with law;
- maintain business records and communicate with prospective and current professional customers; and
- perform any other purpose disclosed when information is collected, with consent where required.
Parsonos does not use Customer Content to train, fine-tune, evaluate, or improve a generalized or shared model or algorithm, or for generalized testing, unless the customer gives prior express permission for a defined purpose. We do not permit a provider to use Customer Content for its independent model training or unrelated product improvement. Limited human access for the customer’s requested support, troubleshooting, quality investigation, security, or legal compliance is not generalized testing and remains purpose-limited and confidential.
5. Legal bases for EEA and UK processing
Where the EU GDPR or UK GDPR applies and Parsonos acts as controller, we rely on the following legal bases as appropriate:
- contract: where you are the individual business customer, to create and administer your account, provide requested service, and process charges;
- legitimate interests: to administer accounts and authentication for an organizational customer, secure and maintain Palaba, prevent fraud and abuse, provide ordinary business support, keep appropriate records, and improve non-content service usability, after considering the affected person’s interests and rights;
- legal obligation: to comply with tax, accounting, privacy, intellectual property, law-enforcement, and other binding requirements;
- legitimate interests in legal protection: to establish, exercise, or defend legal claims and, for special-category information, the corresponding legal-claims condition where applicable; and
- consent: for optional analytics or another activity where we specifically request consent. Consent can be withdrawn at any time.
Where a customer controls project data, the customer determines its lawful basis. Parsonos processes that data on documented instructions and does not choose the customer’s basis for it.
We do not use solely automated decision-making that produces legal or similarly significant effects about account users.
6. When we disclose information
We disclose information only as reasonably necessary for the purposes above:
- customer organizations and authorized users: tenant administrators, authorized project managers, members, and project-scoped guests receive information permitted by their roles;
- service providers and subprocessors: providers support hosting, application databases, identity and authentication, payments, analytics, communications, text or speech processing, and related operations. Some act as subprocessors when they process customer-controlled personal data; the current Subprocessor List identifies those providers;
- professional advisers: lawyers, accountants, auditors, insurers, and security advisers may receive information subject to confidentiality duties;
- corporate transactions: a legitimate buyer, investor, lender, or successor may receive appropriately limited information under confidentiality safeguards during a financing, reorganization, merger, acquisition, or sale;
- legal and safety recipients: courts, regulators, law enforcement, rights holders, emergency recipients, or other parties where disclosure is required by law or reasonably necessary to protect rights, safety, and service integrity; and
- at your direction: a recipient you or the controlling customer authorizes.
Parsonos remains responsible for selecting and instructing its processors as required by applicable law and contract.
7. Sale, sharing, and targeted advertising
Parsonos does not sell personal information for money. Parsonos does not share personal information for cross-context behavioral advertising and does not process it for targeted advertising as those terms are defined by applicable U.S. state privacy laws. We do not knowingly sell or share personal information of people under 18.
We will honor a legally applicable opt-out preference signal, including Global Privacy Control, for any processing subject to such an opt-out. If our practices change, we will update this Notice and provide the required choices before beginning the changed activity.
8. International processing
Parsonos is based in the United States. Personal information may be processed in the United States and in other countries where our service providers operate. Current processing countries for subprocessors handling customer-controlled personal data are identified on the Subprocessor List.
Different countries may provide different privacy protections. For customer-controlled transfers subject to the EU GDPR, UK GDPR, or Swiss law, the applicable Data Processing Addendum provides the relevant contractual transfer mechanism, such as the European Commission Standard Contractual Clauses and UK Addendum, together with any required transfer assessment and supplementary measures. The 2021 EU Standard Contractual Clauses apply only where the transfer falls within their legal scope; where the data importer’s relevant Processing is itself subject to the EU GDPR, another legally available transfer mechanism will be used if Chapter V requires one. For a restricted transfer of controller information to one of our providers or another recipient, Parsonos uses an applicable adequacy decision or approved contractual clauses and supplementary measures as required. Contact privacy@parsonos.com for information about the mechanism relevant to a transfer and a copy of applicable safeguards, subject to lawful redactions. We do not claim participation in the EU-U.S. Data Privacy Framework or another certification unless expressly stated after verification.
9. Retention
We keep personal information only for the period reasonably necessary for the applicable purpose, subject to the following baseline schedule:
| Record | Baseline retention |
|---|---|
| Active account and profile | While active; delete or anonymize within 30 days after account closure unless another rule below applies |
| Customer Content and Customer Deliverables | For the active project and retrieval period, until a valid deletion instruction, and thereafter through the documented deletion and backup lifecycle under the applicable agreement |
| Detailed operational logs | 90 days, unless attached to an investigation |
| Security and authentication logs | 12 months |
| Identifiable product analytics | No more than 12 months; longer-term metrics must be aggregated or legally deidentified |
| Routine support email | Two years after the issue is resolved |
| Contracts, Terms acceptances, Order Forms, invoices, payment records, and material consent records | Seven years after the relevant relationship or transaction |
| Privacy-request records | Three years after closure of the request |
| Security incidents, intellectual-property and other rights matters, serious acceptable-use matters, and legal-enforcement records | Seven years after closure of the matter |
| Tax records | The period required by applicable tax law |
Project deletion removes information from active systems and then from backups as they are overwritten under the documented backup lifecycle. Backups are isolated from ordinary use. If a recovery copy containing previously deleted information must be restored, we will reapply recorded deletion instructions before the affected information returns to ordinary production use where reasonably feasible.
A legal hold, dispute, fraud review, unpaid amount, or binding legal requirement may extend retention only for the information and period reasonably necessary. Information retained for those reasons is access-restricted and not repurposed for marketing or product improvement.
10. Security
We use administrative, technical, and physical safeguards designed for the nature of the information and the size and operation of Palaba. These include individual accounts, multi-factor authentication for privileged accounts, restricted personnel and network access, encrypted transmission, tenant-scoped authorization, time-limited signed links, full-disk encryption and locking on work devices, controlled secrets, security monitoring, and confidential personnel obligations.
No system is completely secure.
11. Your privacy rights
Depending on where you live and the law that applies, you may have rights to:
- know whether and how we process your personal information;
- access or receive a copy of it;
- correct inaccurate information;
- delete information;
- receive portable information in an appropriate format;
- restrict or object to certain processing;
- withdraw consent;
- opt out of sale, sharing, targeted advertising, or qualifying profiling;
- appeal our refusal of a request; and
- complain to a privacy regulator.
Send a request to privacy@parsonos.com or use an authenticated privacy control made available in Palaba. Describe the right and the account or interaction involved. We will verify identity proportionately and may request information needed to prevent unauthorized disclosure. An authorized agent may submit a request where applicable; we may verify the agent’s authority and, where permitted, confirm the request with you.
We will respond within the period required by applicable law. If we deny a request, we will explain why and provide an appeal method where required. An appeal may be sent to privacy@parsonos.com with “Privacy Appeal” in the subject. We do not discriminate against a person for exercising a privacy right.
Some information may be exempt, such as information we must retain for security, billing, legal compliance, another person’s rights, or claims. Where Parsonos acts only for a customer, we will route the request as explained in Section 1.
EEA and UK individuals may complain to the supervisory authority where they live, work, or believe a violation occurred. This does not limit the right to contact Parsonos first.
12. Children and project material involving minors
Palaba accounts are for people aged 18 or older, and Palaba is not directed to children. If we learn that a minor has operated an account, we will investigate and take appropriate action.
An adult customer may lawfully submit a manuscript mentioning minors or a project containing a minor performer’s information where the customer has the required guardian permissions, performer agreements, lawful basis, and other authority. We do not delete an otherwise lawful customer project merely because it refers to or includes a minor. Illegal or exploitative content involving minors is prohibited and handled under the Acceptable Use Policy and applicable law.
13. Changes
We may update this Notice to reflect changes in Palaba, providers, or law. We will post the revised date and provide additional notice or request consent where required. A material change will not retroactively authorize an incompatible use of information collected under an earlier notice.
14. Contact
Parsonos Corporation
131 Continental Drive, Suite 305
Newark, Delaware 19713, United States
Privacy: privacy@parsonos.com
Legal: legal@parsonos.com
Security: security@parsonos.com