Parlario
ES EN
Log in See plans

Privacy Policy

Last updated: October 13, 2026

1. Data controller

Parlario is a web application owned and operated by Bridgeware Technologies; references to “Parlario”, “we” or “us” in this policy mean Bridgeware Technologies.

Parlario is a unified social CRM and AI agent for WhatsApp, Instagram and Telegram, operated, in its platform mode, by Bridgeware Technologies (bridgewaretech.com), who acts as the data controller for the data described in this policy. If you signed up for Parlario as a customer of an organization (business) that uses the platform, that organization is responsible for its own contacts' data; Bridgeware Technologies acts as a data processor on behalf of that organization and provides the infrastructure the service runs on.

Bridgeware Technologies is responsible for operating the platform, encrypting connection credentials at rest, and isolating data between organizations. It is not responsible for the content of messages a customer organization sends to its own contacts, nor for that organization's compliance with WhatsApp's, Instagram's or Telegram's policies, or its contacts' consent — see the full detail in Terms and Conditions, section 2.

2. What data we collect

Depending on how you use Parlario, we process the following categories of data:

  • Account data: name, email address and password (stored hashed, not in plain text) of the people who access the CRM, their preferred interface language and, if the organization's owner restricts it, which connected WhatsApp numbers or Instagram accounts each person can access.
  • Organization data: business name, branding (logo, accent color), subscription status, and the name the business gives each WhatsApp number or Instagram account it connects.
  • WhatsApp and Instagram contacts and conversations: phone number (WhatsApp contacts) or Instagram identifier and username (Instagram contacts), contact name, internal notes, and the content of exchanged messages (inbound and outbound, including AI-agent-generated replies when enabled). Contacts can also be added by the organization itself: by importing a CSV file (only name and phone number) or, if it connects a WhatsApp number that stays on the WhatsApp Business app on its phone (“Coexistence”), from that app's address book — the name the business saved for each phone number, used to name contacts that already exist and, only if the organization chooses so when connecting, to create the rest. In that mode, the messages the business sends from the app after connecting are also stored, like any other outbound message. The organization is responsible for having a lawful basis for the contacts it imports. Imported or synced contacts receive no message and don't enter the sales pipeline because of it.
  • Telegram contacts and conversations (optional): for each person who messages your organization's Telegram bot: their numeric Telegram user ID, their @username if they have one, the first and last name shown on their Telegram profile, and the content of the exchanged messages (inbound and outbound, including AI-agent-generated replies when enabled). We don't receive their phone number — Telegram doesn't give it to bots — nor delivery or read receipts. Photos, voice notes and files are not downloaded or stored: only a short text placeholder (for example 📷) and the caption, if any, are kept. Only private 1:1 chats are processed — never groups, channels or broadcasts — and a bot can never write first: Parlario only replies to people who already messaged the bot.
  • Sales pipeline: leads, funnel stage and activity associated with each contact and, on the Business and Advanced plans, which team member (salesperson) each lead is assigned to — determined automatically by who on your team first replied in person to that conversation — for the internal sales-conversion-by-salesperson report.
  • Meta Ads campaign attribution (optional): if a contact messages you from a “Click to WhatsApp” or “Click to Instagram” ad, we store the originating ad's identifier and headline and a click identifier (ctwa_clid) that Meta attaches to the first message — used to show which campaign the contact came from and, if your organization connects Meta Conversions API (Settings → Meta Ads), to report to Meta when that contact converted into a sale (see the detail of that transmission below, under “Who we share data with”).
  • WhatsApp connection credentials: the WhatsApp Business Account (WABA) access token of each WhatsApp number you connect, encrypted at rest (AES-256-GCM); only its last 4 characters are ever shown in the interface, never the full value.
  • Instagram connection credentials (optional): the Page access token of each professional Instagram account you connect, encrypted at rest (AES-256-GCM) using the same method as your WhatsApp token; only its last 4 characters are ever shown in the interface.
  • Telegram connection credentials (optional): the bot token of the bot your organization creates with Telegram's @BotFather and pastes into Parlario (Settings → Channels → Telegram), encrypted at rest (AES-256-GCM) using the same method as your WhatsApp token; only its last 4 characters are ever shown in the interface, and it never reaches the browser or application logs. The secrets that authenticate Telegram's webhook calls to Parlario (a secret URL segment and Telegram's secret-token header) are stored only as SHA-256 hashes.
  • Your own AI key (optional): if you connect your own key from OpenRouter, OpenAI, or Google Gemini (Settings → AI), it's encrypted at rest (AES-256-GCM) using the same method as your WhatsApp token; only its last 4 characters are ever shown in the interface.
  • Meta Ads credentials (optional): if your organization connects its Meta Conversions API Pixel/Dataset (Settings → Meta Ads) to report purchases and calculate ROAS, the Pixel ID and access token are encrypted at rest (AES-256-GCM), same method as your WhatsApp token; only their last 4 characters are ever shown in the interface.
  • Google Calendar credentials and appointments (optional, Business and Advanced plans): if your organization's Owner connects the business's Google Calendar (Settings → Extensions → Integrations), the access token (refresh token) is encrypted at rest (AES-256-GCM), same method as your WhatsApp token; only its last 4 characters are ever shown in the interface. When an appointment is booked, we store its date and time, and the contact's name is used as the title of the event created on that calendar.
  • Shopify store data (optional, Business and Advanced plans): if your organization connects its Shopify store (Settings → Extensions → Shopify), Parlario receives the events that store sends when an order is paid and when it ships, so the business can tell that customer on WhatsApp what is happening with their purchase. Of the customer we use only their name and phone number — what it takes to know who to message and how to greet them — together with the order number, the order total and the shipment's tracking number. Shopify's event carries its full order payload, which contains more fields than that: we keep it as received for at most 90 days so a delivery can be traced if something goes wrong, after which its content is deleted automatically and only the record that the event happened remains. We never use the customer's email address or postal address. The messages already delivered stay in the conversation, like any other message. The secret of the app you create in Shopify, your store's webhook signing key and the access token are encrypted at rest (AES-256-GCM), same method as your WhatsApp token, and never shown again.
  • WooCommerce store data (optional, Business and Advanced plans): if your organization connects its WooCommerce store (Settings → Extensions → WooCommerce), Parlario receives the orders that store sends through the two webhooks you create in it, and every 15 minutes reads recent orders from the store to recover any a webhook didn't deliver. It connects with WooCommerce's Read access only, and only to stores served over HTTPS. As with Shopify, of the customer we use only their name and phone number, together with the order number, what was bought, the order total and, if a plugin on your store saves it, the tracking number. The order arrives with more fields than that — including the customer's email and address — and we keep it as received for at most 90 days, after which its content is deleted automatically; we never use the email or the address. The store's access keys and the webhook signing secret are encrypted at rest (AES-256-GCM) and never shown again.
  • Knowledge base and templates: content you upload for the AI agent to answer with on WhatsApp, Instagram and Telegram (question/answer pairs, context blocks) and the WhatsApp message templates you register with Meta (Instagram and Telegram have no equivalent template mechanism).
  • Laboratorio test runs: transcripts and verdicts generated when evaluating the AI agent in simulated conversations (never against your real WhatsApp number, real Instagram account or real Telegram bot).
  • Billing data: Stripe customer and subscription identifiers (customer ID, subscription ID). Parlario never receives, processes or stores your card number or other payment data — that's handled directly by Stripe on its hosted checkout page.

3. Legal basis for processing

We process this data to perform the service contract with the organization using Parlario (granting access to the CRM, delivering and receiving WhatsApp, Instagram and/or Telegram messages, charging the subscription) and, in the case of contacts who message via WhatsApp, Instagram or Telegram, on the legitimate interest of the business operating that channel in managing its own commercial relationship with those contacts. Where applicable regulation requires it, we will request the corresponding consent before processing an additional category of data.

4. Who we share data with (data processors)

Parlario is designed around a data sovereignty principle: the list of external services that touch your data at runtime is intentionally short.

  • Meta / WhatsApp Cloud API and Instagram Messaging: the messaging channel. Messages you send and receive over WhatsApp or Instagram pass through Meta's infrastructure as part of those platforms' normal operation; their processing is additionally subject to Meta's own privacy policy. WhatsApp and Instagram connect through two separate Meta apps with their own credentials, but both are subject to this same processing as a sub-processor. If your organization connects Meta Conversions API (Settings → Meta Ads, optional, available for “Click to WhatsApp” and “Click to Instagram” ads), when a lead moves into a “Won” stage we send Meta a purchase event with a contact identifier — the phone number (hashed, never in plain text) for WhatsApp contacts, or the Instagram account ID (IGSID) for Instagram contacts — and the ad click identifier (ctwa_clid) when it exists — so your organization's own Ads Manager can calculate ROAS for its own campaigns. When the sale comes from a connected Shopify store, that event also carries the order's total and currency, which is what lets Ads Manager measure return and not merely count conversions. This isn't Parlario selling or using your data for advertising: it's a transmission your organization explicitly enables toward its own Meta ad account.
  • Telegram (Telegram FZ-LLC and/or Telegram Messenger Inc.), Bot API (optional): the Telegram messaging channel, only if your organization turns Telegram on (Settings → Integrations) and connects a bot. The bot is your organization's own: you create it with Telegram's @BotFather and paste its token into Parlario, and Parlario has no Telegram bot or credential of its own. The messages your customers send to the bot, and the replies your team or the AI agent send back through Telegram's Bot API (api.telegram.org), pass through Telegram's infrastructure as part of that platform's normal operation; your organization's use of its bot is additionally subject to Telegram's own terms and privacy policy, which your organization accepts directly with Telegram when it creates the bot. Telegram keeps its own copy of those chats under its own terms. Telegram messages are never reported to Meta Conversions API.
  • Stripe: payment processor for the subscription, in platform mode. Stripe receives the data needed to process the charge (through its hosted checkout) directly from you; Parlario only receives payment confirmation.
  • Language model provider (optional): if your organization enables the AI agent, the relevant conversation content is sent to an AI provider (OpenRouter, OpenAI, or Google Gemini) to generate the suggested or automatic reply — by default, through the shared account Bridgeware Technologies pays for and manages. If your organization connects its own key (Settings → AI), that transmission instead goes through your own account with that provider, subject to that provider's own privacy policy. Without an AI provider configured (your own or shared), this transmission doesn't happen and the CRM works without an agent.
  • Hosting and database infrastructure: the Parlario instance and its PostgreSQL database run on the hosting infrastructure chosen by the operator (for example AWS Amplify, Google Cloud Run or Supabase), which hosts the data described in this policy as part of operating the service.
  • Transactional email provider (optional): if the operator configured one (Postmark, with Amazon SES as a backup not in active use), it's used EXCLUSIVELY for three specific emails: confirming your email address when you register, sending you the password recovery link when you request it from “Forgot your password?”, and confirming an email address change on your account — never for the content of your conversations, WhatsApp or Instagram credentials, or any other data. Without this provider configured, those three features simply aren't available; the rest of the CRM works the same.
  • Google Calendar API (optional, Business and Advanced plans): if your organization's Owner connects the business's Google Calendar (Settings → Extensions → Integrations), Parlario creates appointment events on that calendar and checks its availability — with access limited solely to the “calendar.events” scope, never to any other information in the connected Google account. It's a single calendar per business, not individual calendars per salesperson.
  • Shopify (optional, Business and Advanced plans): a data source, not a recipient. Parlario reads from the store your organization connects, through a private app your organization creates in its own Shopify account, using four read-only permissions (read_orders, read_fulfillments, read_products, read_customers) and no write permission of any kind: it never creates, edits or cancels an order, and never touches inventory. We send Shopify nothing about your contacts or your conversations. Order information travels onward in two ways, both of them to Meta: as the content of the WhatsApp message, delivered as described above; and, if your organization also connects Meta Conversions API (Settings → Meta Ads), as the total and currency of the paid order, reported to your organization's own Meta ad account so that Ads Manager can calculate the return on its own campaigns. That second transmission carries the amount and the same contact identifier already described for Meta Conversions API above — never what was bought, and never the order's addresses.
  • WooCommerce (optional, Business and Advanced plans): a data source, not a recipient, and not a separate company: WooCommerce is software running on your organization's own website, so the data comes from your own store's server. Parlario reads it with WooCommerce's Read access only and never creates, edits or cancels an order. We send the store nothing about your contacts or your conversations. Order information travels onward exactly as described for Shopify above: as the content of the WhatsApp message, and, if you connect Meta Conversions API, as the total and currency of the paid order.

We don't use external object storage or other Google services beyond what's noted above, and we don't sell or share your data for advertising purposes.

5. Data retention

We retain your data while your account and your organization's subscription are active. If you request deletion of your account or of specific contact data (see Data Deletion), we remove it from our production database within the timeframe stated on that page. Encrypted backup copies, when they exist, are overwritten in the normal backup rotation cycle and are not used to restore data already deleted at the data subject's request.

Disconnecting a Telegram bot (Settings → Channels → Telegram → Disconnect) removes the webhook at Telegram and deletes the stored bot token immediately. The contacts and conversations already received stay in Parlario until your organization deletes them or asks us to, as with the other channels (see Data Deletion). Telegram's own copy of the chat is governed by Telegram's terms and is outside Parlario's control.

The chat history of the WhatsApp Business app is never stored. When a number is connected while staying on that app, Meta requires Parlario to request the app's chat history (up to its last 180 days). Parlario requests it because Meta requires it, and discards it as it arrives, without saving any of it: the business starts clean in Parlario and its previous chats stay on its phone.

Shopify and WooCommerce events are kept on a shorter, automatic clock. The content of each event a connected store sends is deleted 90 days after it arrives, without anyone asking. If a shopper asks the business for their data or its deletion, the business can ask us and we delete the store events tied to that person; when a business disconnects its store, no new events arrive and the ones already received follow the same 90-day clock. That deletion covers the data that came from the store. It deliberately does not delete the contact or the conversation in the merchant's CRM: that record belongs to the business's own relationship with that person, which usually began before any order and often on WhatsApp rather than in the shop. Deleting it is the merchant's decision, through the channel described in Data Deletion.

6. International transfers

Depending on where your Parlario instance is deployed and where Meta, Telegram, Stripe or your chosen AI provider operate, your data may be processed in countries other than your own. In those cases, we rely on the contractual and compliance safeguards each provider offers for international data transfers. Telegram operates from the United Arab Emirates with global infrastructure; because your organization creates and controls its own bot and accepts Telegram's terms directly, the safeguards that apply to Telegram's own processing arise from that relationship between your organization and Telegram.

7. Security

Secrets (WhatsApp, Instagram and Telegram tokens, session keys) are encrypted at rest and are never exposed to the browser or written to application logs. Every organization is isolated at the data level: no system query returns information from an organization other than the one making the request. We don't detail additional internal security mechanisms here for operational confidentiality reasons.

8. Your rights

You can request access to, correction of, or deletion of your personal data, as well as object to or limit certain processing, by writing to privacy@parlario.co. If you're a contact who received messages from a business using Parlario and want to exercise these rights, you can also write directly to that business, which manages your conversation.

9. Minors

Parlario is designed for business use (B2B) and is not directed at minors. We don't knowingly collect data from minors.

10. Changes to this policy

We may update this policy as the product or applicable regulation changes. We'll publish the last-updated date at the top of this page.

11. Contact

For any questions about this policy, write to us at privacy@parlario.co.