Privacy Policy
Last updated 7 August 2026
This explains what the operator of Pallas does with data in Pallas. It is written to be understood. If anything here is unclear, ask us at privacy@getpallas.com.
The short version
- We hold your business records because you put them in Pallas so we can run it for you.
- We do not sell your data, ever, to anyone.
- We do not use your business data to train AI models, and neither does our AI provider on our account.
- Your data lives in the United States, in a database schema separate from every other customer’s.
- You can export it, and you can tell us to delete it.
What we collect
Data you enter
Your items, stock, lots and traceability records, suppliers and customers, orders, invoices, payments, ledger entries and documents — plus any file or photo you upload for the assistant to read. Some of this includes personal data about other people, such as a contact name, email address, phone number or delivery address at one of your suppliers or customers. For that data you are the controller and we are your processor: see the Data Processing Agreement.
Account data
Your name, work email, hashed password, company name, and which features you use.
Technical data
Ordinary server logs — IP address, browser, pages and API routes hit, timestamps, errors — kept for security and debugging, and deleted on a rolling basis.
Billing data
Handled by Stripe. We receive the fact of a payment, the amount, and enough identifiers to link it to your account. We never receive or store your full card number.
Why we hold it
| Purpose | Basis |
|---|---|
| Running Pallas for you | Performing our contract with you |
| Supporting you when you contact us | Performing our contract |
| Keeping the service secure and diagnosing faults | Our legitimate interest in a service that works |
| Taking payment and keeping tax records | Contract, and our legal obligations |
| Telling you about your account, trial or a problem | Contract |
The assistant and AI
When you use the assistant, the relevant parts of your business data — and any file or image you attach — are sent to our AI provider (Anthropic) so it can answer or carry out what you asked.
- It is sent for that request only, to produce your answer.
- It is not used to train models, on our account or theirs.
- If you would rather no business data ever left the system, the assistant is the one feature to avoid — tell us and we will disable it for your account.
Who else touches your data
| Who | What for | Where |
|---|---|---|
| Vercel | Hosting and running the application | United States |
| Neon | The database your records live in | United States |
| Anthropic | The assistant’s answers and actions | United States |
| Stripe | Taking payment | United States |
| Resend | Sending email that Pallas sends for you, and account notices | United States |
That is the whole list. We will keep it current, and we will tell you before we add a sub-processor that handles customer data.
We also disclose data if the law compels us to. If we are legally able to tell you first, we will.
Where it is stored, and how it is separated
In the United States. Each company’s records live in its own database schema, not mixed into shared tables with a customer column — so one customer’s data is not one mistaken query away from another’s. Traffic is encrypted in transit and the database is encrypted at rest.
How long we keep it
- While you are a customer: as long as your account is open. Records inside your account are kept until you remove them; traceability records are marked void rather than deleted, because you may need to produce them for years.
- After you leave: your data stays available to export for 30 days, then we delete it. Tell us and we will delete it sooner.
- Backups: deleted data can persist in backups for up to 30 days before ageing out.
- Invoices and tax records: kept as long as tax law requires.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to what we do with it, or to have it sent elsewhere. Email privacy@getpallas.com and we will respond within 30 days. There is no charge, and asking will never affect your service.
If you are in California you also have the rights the CCPA/CPRA gives you, including the right to know and to delete. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of.
If there is a breach
If personal data in Pallas is exposed or lost, we will tell affected customers without undue delay and within 72 hours of confirming it, by email to your account contact. We will say what happened, what data was involved, what we have done, and what we suggest you do — including anything you need in order to meet your own notification duties. We will not sit on it while we work out how it looks.
Cookies
Pallas uses cookies to keep you signed in and to remember which company you are working in. That is all — no advertising or cross-site tracking cookies.
Children
Pallas is a business tool and is not for anyone under 16.
Changes
If we change this in a way that matters, we will email you before it takes effect rather than quietly editing the page.
Contact
See also the Terms of Service and the Data Processing Agreement.