Privacy Policy

Overview

Parakaleo Inc. ("Parakaleo," "we," "us") operates this website to share information about Parakletos, let visitors apply for our Active Vehicle Protection pilot or request information, and provide a licensing portal to manage a Parakletos subscription. Parakletos today is a Safety Intelligence product. It reads a vehicle's own sensors and turns what it finds into a Safety Score, and it does not steer or brake a vehicle. This page explains what data we collect through the site and portal, why, and how it's handled. Our separate simulation demo site carries its own short, self-contained notice covering the one thing it measures, page and video-demo views, so it isn't repeated here.

This policy also covers Parakaleo Drive, our free mobile app for iPhone and Android. It is a companion to the licensed accounts we sell to organisations on the web: it records a driver's trips and sends a summary of them to the portal. What the app does with your phone's data is explained under "Parakaleo Drive Mobile App" below. Everything else in this policy, including billing, sharing and your rights, applies to the app too.

Who Is Responsible for Your Data

Parakaleo Inc., a Delaware corporation, is the controller of the personal data collected through this website, the licensing portal and the Parakaleo Drive app, subject to the role split described next. Our registered office and address for legal notices is Parakaleo Inc., c/o Legalinc, 131 Continental Drive, Suite 305, Newark, DE 19713, USA. Legalinc is our registered agent for legal notices and service of process. For privacy questions or requests, and for day-to-day contact, email hello@parakaleoinc.com.

EU and UK. For the purposes of the GDPR and the UK GDPR, the controller is Parakaleo Inc. Our services are open to people around the world, including in the EU, the UK and Switzerland. Where the law asks for a local representative in those places, we will appoint one through a specialist representation service and list their contact details here. Your right to lodge a complaint with a supervisory authority is described under "Your Rights."

Fleets and employers. If a fleet owner, employer or other account owner uses the service for vehicles and drivers, that account owner is a separate controller for its drivers' data and for its own purposes, such as fleet management and coaching. For driver data that a fleet customer holds in its account for its own purposes, Parakaleo acts as a processor under the "Data Processing for Fleet Customers" section of our Terms of Service and handles it on the account owner's instructions. For the leaderboards, points, ranking, fraud prevention and product improvement described below, Parakaleo is an independent controller. The account owner is responsible for giving its drivers the notice the law requires and for having its own lawful basis for monitoring them, which may be consent where the law allows it. It must also meet any employee-monitoring, works-council and consultation requirements that apply to it before it monitors drivers with the service. If you are a driver with a question about how your fleet uses your data, start with the account owner. You can also write to us.

Information We Collect

Contact and pilot application submissions. When you fill out the "Join the Pilot" form, we collect what you provide (name, email address, organisation, role, and any message or fleet details you include). Submissions are delivered to our inbox through EmailJS, a third-party form-delivery service; we do not maintain a separate marketing database.

What the contact and pilot forms collect. These forms collect only what you type into them, such as your name, email address, organisation, role and message. EmailJS, acting as our service provider, delivers each submission to our inbox. We use it to reply to you and to assess pilot applications. We keep these emails only as long as needed to respond and follow up, then delete them.

Usage analytics. The Google Analytics code (gtag.js) is loaded from Google's servers only after you accept the cookie banner. If you accept, we use it to understand how visitors find and use this site (pages viewed, approximate location, device type, and referral source). If you decline, analytics stay off and no analytics cookies are set. If you decline or withdraw consent later, analytics stops immediately and the Google Analytics cookies are deleted. If your browser sends a Global Privacy Control signal, analytics never loads, even if you click Accept. The advertising features of our Google Analytics property are turned off. We do not use this data for advertising and we do not sell it.

Local preferences. We use your browser's local storage (not tracking cookies) to store three items: your light/dark theme choice, your language choice, and your cookie banner choice (accept or decline). They are stored on your device. When you follow a link from this site to our own licensing portal or our own demo site, your theme and language choice are included in that link so the choice carries over. We do not add them to links to third-party sites.

Licensing portal account setup. If you're an approved early-access licensee, creating a portal account collects your name, email, a username, country, and, optionally, how you heard about us and any referral or group code you signed up with. We use the latter only to credit referral rewards correctly.

Vehicle & hardware data. Registering a vehicle collects a hardware fingerprint for the compute module running Parakletos, and the vehicle's year, make, and model, used only to classify whether your vehicle would connect over its own factory CAN bus (Tier 01) or need a physical actuator you'd source yourself, built to our specification (Tier 02), for when Active Vehicle Protection is certified. Parakaleo doesn't sell, ship, or bundle that hardware. Any nickname or tag you give a vehicle is for your own organisation only, and isn't used for anything else.

Driver profiles. You can optionally assign a driver to each vehicle, so activity is tracked against the person actually behind the wheel rather than the vehicle alone. A driver is a name you choose, reusable across your vehicles, and you can rename or reassign it at any time. Reassigning a vehicle to a different driver only affects data going forward. It never rewrites who past activity was already attributed to.

Safety & telemetry data. Once a vehicle is set up, it reports back: execution logs (timestamped messages describing what the software did), a running mileage total, hazard-detection events describing what the system would do about a risk (these are read-only observations today, not steering or braking commands), periodic "hardware ping" check-ins, boot-time self-diagnostic results, and raw detection telemetry tied to the vehicle's hardware fingerprint rather than to your name. Where a vehicle has a driver assigned, hazard data feeds that driver's Safety Score, alongside a maturity label describing how much driving history stands behind it. We use this to run your license, show you Safety Scores, event histories, certificates, and monthly report cards, and improve Parakletos. Execution logs older than 50 days are deleted automatically; billing and license records are kept longer, as described below.

Fraud-prevention data. Each vehicle check-in records the network (IP) address it came from. We use this only to flag an account reporting from an unusually high number of different networks in a short window, a signal of possible credential sharing or misuse, not to track your location.

Engagement & program data. The portal includes optional points, referral, streak, and group features. Using them means we track your points balance and history, referral link activity, and weekly streaks. If you join or create a group, your name and activity become visible to that group's members, and group listings are visible to other signed-in licensees generally. If you turn on Safety Score sharing within a group, that group also sees your chosen driver's score and its maturity label; this is off by default, and nothing is shared until you turn it on yourself. When you tap a share button for your referral link, we record that a share happened, not who received it or where you posted it, and we may limit how many shares earn points each week. Anything you submit through the Developer page, for example a reverse-engineered vehicle CAN-bus dictionary, is stored and reviewed by our team.

Safety Profile & monthly Report Cards. Every driver with a real Safety Score gets a Safety Profile, and on the first of each month we automatically generate a Report Card for every account with a registered vehicle, using the data described above: total distance synced, hazard-event counts by severity, a system uptime and sensor health reading, and your vehicle count. Both are private by default. If you choose to share a Safety Profile, you pick between "private" and "anyone with the link," and the shared page only ever shows aggregate numbers, never exact timestamps or raw telemetry. When you tap a "Post My Safety Score" style button, we create a public page and pass its link (and, where your device allows, a card image) to your device's share menu; we don't see or control where you send it. Anyone with that link can view the page, which shows your chosen display name (or a generic placeholder if you haven't set one), the relevant period, those statistics, and a sign-up button carrying your referral code so we can credit you if someone joins. These links aren't listed on our site and we ask search engines not to index them, but they aren't password protected, so share one only with people you're comfortable seeing those numbers. To have a shared page removed, email us at the address below.

Safety Challenge. If you take part in the monthly Safety Challenge, we track your rank, your score for that calendar month, and whether you qualify for a prize. Qualifying requires a referral and a minimum distance, as set out in the portal rules and described in the Terms of Service. Points, referral rewards and prizes are a financial incentive. If you place and choose to claim a prize, claiming redirects you to Stripe's own hosted onboarding, where Stripe collects your bank details and identity information directly. We never see or store your raw bank details. We do store the claim's status, the prize amount, and, once paid, a payout record. A short skill-verification question is shown at claim time; we store whether it was answered correctly, not a profile of you.

Safety Challenge leaderboards. Leaderboards show participants' display names and scores to other accounts, including accounts of other organisations. For leaderboards, points, ranking, fraud prevention and product improvement, Parakaleo is an independent controller, not a processor. Our purposes are to run the challenge and show rankings, to award points and prizes, to detect cheating and misuse, and to improve the service. Our legal basis is our legitimate interest in doing so, and you can object to it. Parakaleo acts as a processor only for a fleet customer's own driver data that we hold for that customer's purposes, as explained under "Who Is Responsible for Your Data." If you are a driver and do not want your display name shown on leaderboards, email hello@parakaleoinc.com and we will hide it.

Team members. If you invite someone to help manage your account, we collect the email address you invite and the role you assign, and we log the actions they take on your account.

Developer tools. You can generate a personal API key (we store only a hash of it, never the raw key) and configure "log forwarding" to send a copy of your own execution logs to a webhook URL you choose. That forwarding happens directly between our servers and the endpoint you specify; we don't control, and aren't responsible for, what happens to the data once it reaches it.

Support & administrative access. Our support team, and specific staff we designate as account-limited "mini admins" with access to only the customers assigned to them, can access account, vehicle, and billing data to help with your account. Every such access is logged. If a payment is disputed (a chargeback), we may pause a license while we investigate.

Billing & currency display. Billing itself is handled by Stripe (see "Third-Party Services" below); we store your subscription status, billing history, and cancellation date, plus a record of each successful charge, but not full card or bank account numbers. If you set a country in Settings, we show subscription and Safety Challenge prize figures as an estimate converted into your local currency, clearly marked as an estimate; you are always charged, and always paid, in US dollars. This account, vehicle, and subscription data is stored in a database hosted by Supabase, our backend infrastructure provider; Supabase does not use it for its own purposes. We keep billing records for as long as needed to manage your license and meet our tax and accounting obligations.

Parakaleo Drive Mobile App

Parakaleo Drive is a free mobile app. A driver pairs the app with a vehicle that an account owner has set up in the portal, and the app then records that vehicle's trips automatically. Your phone's data is processed on the phone first, and only a summary is sent to us. The app is intended for adult drivers and isn't directed to anyone under 18.

Accepting the terms when you pair. When you pair the app, it asks you to accept the Terms of Service and this Privacy Policy and to confirm that you are 18 or older. We record which version you accepted. Pairing does not go ahead until you have done so.

What the app can access on your phone. With your permission, the app uses your phone's location, including when the app is closed or not on screen ("Always" on iPhone, "Allow all the time" on Android), so it can notice when a trip starts and ends and measure how far and how fast you drove. It also uses your phone's motion sensors and its motion and activity data to tell driving from walking or cycling and to spot hard braking, hard acceleration, sharp cornering and speeding. The app asks to send notifications, for example when a trip has been saved or when a permission has been switched off, and never during a trip. It asks for the camera only to scan the pairing QR code, and you can type the code instead. While tracking is on, Android shows a permanent notification and iPhone shows its location indicator. You can change any of these permissions in your phone's settings at any time. Without location and motion access, the app cannot record trips.

Background location and your choice. Before your phone asks for location access when the app is closed or not on screen, the app shows a short explanation of why it needs it, and you decide whether to continue. You can revoke any permission in your phone's device settings at any time (iPhone: Settings, Parakaleo Drive, Location. Android: Settings, Apps, Parakaleo Drive, Permissions, Location). The app then stops recording trips. Revoking a permission does not delete data we already hold; for that, see our data deletion page.

What the app sends us. The app works out your trips on your phone and sends us only a summary. For each trip: when it started and ended, the distance, the duration and the top speed, whether the phone reported a mock location, and whether the GPS position made an impossible jump. For each hard braking, hard acceleration or sharp cornering event: its type, when it happened, how strong it was, your speed just before and how long it lasted. For each speeding event: when it happened, your peak speed, the posted speed limit that applied, how far over it you went and how long it lasted, with no location. When you pair the app, we receive a random install ID that the app creates (it is not your advertising ID), the platform (iPhone or Android), the operating system version, the app version and the device model. About once a day the app tells us whether tracking is on or off, which permissions are granted and which app version you use. After pairing, the app signs in to our service with a device token, and we store only a hash of it. We link all of this to the vehicle you paired and to the account that owns it, so it is not anonymous.

What the app does not send. The app does not send your raw GPS points, the route you drove, or raw readings from your phone's sensors. It does not read your contacts, photos or advertising ID. Location and sensor readings are used on your phone to work out the summary and are kept in memory only while a trip is processed; they are not saved to storage. While a trip is in progress, the app saves a small checkpoint (start time, distance so far, top speed and events so far) so a trip is not lost if the phone restarts. Finished trip summaries stay on your phone until they have uploaded, and then for up to 90 days so you can see them in the app.

Speed limits. While you drive, and unless you switch it off under Settings, Speed limit checks in the app, the app looks up the posted speed limit of the road. The limits come from OpenStreetMap, an open map database. The app does not contact OpenStreetMap itself. It asks our server for a fixed map tile, a grid square about 2 km by 2 km that is identified only by its grid number. Our server fetches that tile from OpenStreetMap's Overpass service on the app's behalf and keeps a copy so it can be reused. The request does not contain your position, your route, your account, your vehicle or a device ID. Like any web request, it does show our server your IP address and which tile was asked for, so it reveals the general area you are in, about 2 km across. Our normal server logs apply, and we do not store tile requests per user or link them to a driver. OpenStreetMap only ever sees our server. Whether you were speeding is worked out on your phone, by comparing your GPS speed with the downloaded limits, and your route still never leaves it. When you stay well over the limit, the app sends a speeding event with the trip: its time, your peak speed, the posted limit that applied, how far over it you went and for how long, with no location. Limits in OpenStreetMap can be missing or wrong, so speeding events are a guide, not proof. The lookups need a mobile data connection; without one, nothing is checked. You can turn them off at any time with the Speed limit checks switch in the app's Settings.

Speeding and your score. The app collects speeding events, but speeding is not scored: as our Parakaleo Mobile page explains, speeding events do not lower the Mobile Safety Score. They are stored with the other trip details and deleted with them after 90 days.

How we use it. We use trip summaries and driving events to calculate your distance, Safety Score (based on hard braking, hard acceleration and sharp cornering, not speeding), streaks, points and rankings, and to run the monthly Safety Challenge, in which phone drivers are ranked against other phone drivers. We also use them to check for mistakes and cheating. For example, a trip that reports a mock location or an impossible GPS jump, or an unusual speed or duration, or that overlaps with another trip, is held back from scores and rankings until our team has looked at it. We do not use the data for advertising, and we do not sell it.

Who can see it. The account owner, and the managers and viewers they invite, can see the trips and events of the vehicles in their account, and our support team can see them to help you. If you drive a vehicle that belongs to someone else, they can see your trips for that vehicle. Other people see only what you or the account owner choose to share, for example a group score or a shared Safety Profile, as described above, plus the display name and score that Safety Challenge leaderboards show to other accounts, including other organisations (see "Safety Challenge leaderboards" above). Apple and Google process your download of the app under their own privacy policies, and we do not receive your store account details.

How long we keep it. We delete trip details, including driving events, automatically after 90 days. Distance already counted toward points and prize qualification, points and prize records are kept, as are billing records, until the account is deleted or for as long as the law requires. Data we delete can remain in our backups for a limited time, as explained under "How Long We Keep Information" below.

Deleting your data. The account owner or a manager can delete a vehicle's trip data in the portal (Add a Vehicle, Parakaleo Mobile, Delete trip data), or delete the whole account under Settings. In the app, "Delete my data" erases the trips stored on your phone and unpairs it. To remove what we hold, use the portal or write to us. A driver who does not own the account can ask the owner, or email us. The steps are on our data deletion page. Deleting trip data does not remove distance already counted toward points and prize qualification unless the whole account is deleted. Points you have already earned and payout records are kept after trip data is deleted.

Other people who drive. The app can record people other than the account owner, for example employees, family members or anyone else who drives with a phone paired to a vehicle in the account. The account owner is responsible for informing these drivers that their trips are recorded and who can see them, and for having a lawful basis, which may be their consent where the law requires it, before they use the app.

Drivers under 18. The service is not for anyone under 18. Account owners should not enable or pair the app for a minor without the involvement of a parent or legal guardian. If we learn that we hold data from a minor, we delete it.

Third-Party Services

This site and the licensing portal load resources from a small number of third parties, each governed by its own privacy policy. We separate the providers that process driver and account data for us from the tools used on this website for analytics and the contact form.

Processors of driver and account data (hosting, database, payments and email):

• Supabase (licensing portal account, vehicle & subscription database hosting): supabase.com/privacy
• Vercel (hosting of the licensing portal and its API, including the Parakaleo Drive app's connection): vercel.com/legal/privacy-policy
• Stripe (licensing portal payment processing, and Safety Challenge prize payouts through Stripe Connect): stripe.com/privacy
• Resend (sending account and service emails): resend.com/legal/privacy-policy
• Zoho (Zoho Mail, our business email service, which handles the messages you send us, for example to hello@parakaleoinc.com or our support address, and our replies; legal basis: our legitimate interest in answering your enquiry): zoho.com/privacy.html

Website hosting, analytics and contact form tools (these do not receive trip, vehicle or driver data):

• Netlify (hosting of this website). Like any host, it sees your IP address and browser details when you load a page. The legal basis is our legitimate interest in running the site: netlify.com/privacy
• Google Analytics (site analytics). The Google Analytics code (gtag.js) is loaded from Google's servers only after you accept the cookie banner. The legal basis is your consent. When it loads, Google receives your IP address and browser details. The advertising features of our Google Analytics property are turned off: policies.google.com/privacy
• EmailJS (delivery of pilot applications and contact form submissions; legal basis: our legitimate interest in answering your enquiry): emailjs.com/legal/privacy-policy
• jsDelivr (a content delivery network, or CDN, that serves the EmailJS code used by the contact and pilot application form). The code is loaded when you start filling in a form, not when the page opens. Like any web request, this shows your IP address and browser details to the CDN. The legal basis is our legitimate interest in delivering the contact form: jsdelivr.com/terms/privacy-policy-jsdelivr-net

Our fonts are served from our own site rather than a third-party font CDN, so loading a page doesn't reveal your visit to any font provider.

We do not sell personal information, and we do not share it for advertising or for cross-context behavioral advertising. We do not give it to data brokers or advertisers.

How We Use Information

We use the information described above to respond to pilot applications and questions, create and run your portal account and license, process payments, show you Safety Scores, event histories, certificates and report cards, run leaderboards, points and rankings, provide support, detect fraud and misuse, understand how the site is used, improve Parakletos, meet legal obligations, and send service messages about your account. We only send marketing email to people who have asked to hear from us, and every such message can be opted out of.

Legal Bases for Processing (EU, UK and Switzerland)

If you are in the EU, the UK or Switzerland, we process your personal data only where we have a legal basis under Article 6 of the GDPR (or the UK and Swiss equivalents). In summary:

• Performing a contract. For the person or organisation that holds the account: creating and running the portal account and license, processing payments, providing support, and paying out prizes that a participant claims. Where you are both the account holder and the driver, this also covers storing the trip summaries and driving events your app sends us and calculating your Safety Scores.
• Legitimate interests. For drivers who use the app or are assigned to a vehicle in an account that someone else (for example an employer) owns: storing their trip summaries and driving events and calculating their Safety Scores so we can provide the service to that account owner. Also, for everyone: leaderboards, points and rankings, keeping the service secure, preventing fraud and misuse, checking trips for mistakes, improving Parakletos and the app, answering enquiries, and delivering the contact form (including the jsDelivr CDN that serves its code). We balance these interests against your rights and freedoms. The account owner relies on its own lawful basis for its own purposes.
• Consent. Analytics cookies and the Google Analytics code. Also, where you are a private individual using the app on your own account, the app's use of your phone's precise location and motion data to detect trips and driving events, which takes place on your phone. The permission prompts of your phone's operating system are a technical control and are not by themselves our record of consent. We also rely on the explanation the app shows before it asks for background location and on your acceptance when you pair (see "Accepting the terms when you pair"). For drivers in an account owned by someone else, such as employees, we do not rely on their consent for this processing; the legitimate interests basis above applies.
• Legal obligation. Keeping billing, tax and accounting records, and answering lawful requests from authorities.

Where we rely on consent, you can withdraw it at any time, for example by revoking a permission in your phone's settings, by using the "Cookie settings" link in the footer of this site to reopen the cookie choice, or by emailing us. Withdrawing consent does not affect processing carried out before you withdrew it. Withdrawing analytics consent stops analytics immediately.

No solely automated decisions. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. The Safety Score is informational. Trips flagged by our checks are reviewed by our team before they count. If an account owner uses scores in decisions about its drivers, that decision is the account owner's.

How scores may be used. Safety Scores are meant for coaching and fleet management. They are not consumer reports. They must not be used, by account owners or anyone else, to make decisions about credit, hiring, firing, tenancy or insurance eligibility.

How We Share Information

We share information only in these situations: with the service providers listed under "Third-Party Services," who process it on our behalf; with other people, only where you choose it (for example group members or a Safety Profile link you share), apart from the display names and scores that Safety Challenge leaderboards show to other accounts, as described above; when the law, a court order, or a valid legal request requires it; to protect the rights, safety or property of Parakaleo, our users or others; and as part of a merger, acquisition or sale of assets, in which case we'll tell you if your information becomes subject to a different privacy policy.

Insurers. Parakaleo does not currently share personal data with insurers. Any such sharing is only a possible future plan. If we ever offer it, it would be opt-in only, and only with the explicit consent of the driver whose data it is. An employer or account owner cannot give that consent on a driver's behalf. We would describe it in an updated version of this policy before it starts.

How Long We Keep Information

We keep personal information only as long as we need it for the purpose it was collected for. In practice:

• Execution logs: deleted automatically after 50 days.
• Parakaleo Drive trip details and driving events (including speeding events): deleted automatically after 90 days. Finished trip summaries stay on your phone for up to 90 days after upload.
• Account, vehicle and driver profile data: kept while your account is active. When you delete the account, we erase it once your request is verified and completed (see the timeframes under "Your Rights"), except for records we must keep by law. We also delete accounts that have been cancelled and then inactive for 24 months.
• Distance totals, points and prize payout records: kept until the account is deleted, or longer where the law requires. Deleting trip data does not remove distance already counted toward points and prize qualification unless the whole account is deleted.
• Billing and subscription records: kept for as long as tax and accounting law requires.
• Contact and pilot form emails: kept for as long as needed to respond and follow up, then deleted.
• Network (IP) addresses in logs, including those used for fraud prevention: kept for up to 90 days.
• Analytics data: kept for 14 months, the retention period configured in our Google Analytics account, and only if you accepted analytics cookies.
• Shared Safety Profile and Report Card pages: kept until you or we take them down, or until the account is deleted.

Backups. Data we delete can remain in backups for a limited time. It is removed from backups on our normal backup cycle, as backups are replaced, and is not used for any other purpose in the meantime.

Cookies & Local Storage

We do not set marketing or advertising cookies. Google Analytics, whose code (gtag.js) is loaded from Google's servers, sets its own analytics cookies only after you accept the cookie banner. If you decline, analytics stay off and no analytics cookies are set. If you decline or withdraw consent later, analytics stops immediately and the Google Analytics cookies on this site are deleted.

Your choice and how to change it. Your choice (accept or decline) is stored in your browser's local storage, alongside your theme and language choices (see "Local preferences"). You can change it at any time with the "Cookie settings" link in the footer of this site, which reopens the cookie choice. As an extra option, you can install the Google Analytics opt-out browser add-on. If your browser sends the Global Privacy Control signal, we treat it as a decline of analytics: analytics never loads, even if you click Accept.

Third-party code on the contact page. The contact page loads the EmailJS code from the jsDelivr CDN when you start filling in a form, not when the page opens. This is not a cookie, but, as with any web request, your IP address and browser details are visible to the CDN. Our legal basis is our legitimate interest in delivering the contact form. See "Third-Party Services" above.

Security

We take reasonable steps to protect information from unauthorized access, loss, or misuse, including encrypted connections, storing only a hash of API keys and of the app's device tokens, limiting staff access to the customers they support, and logging that access. No method of transmission or storage is completely secure, so we can't guarantee absolute security. Please use a strong, unique password and keep it private.

Data breaches. If a breach affects personal information we hold, we will notify affected users and regulators as required by applicable law.

Children's Privacy

This site and the licensing portal are intended for adults and businesses. They are not directed to anyone under 18, and we do not knowingly collect personal information from children or minors. If we learn that we hold a minor's data, we delete it. If you believe a child has given us personal information, email us at the address below and we'll delete it.

External Links

This site may link to websites we don't operate. Those sites have their own privacy policies, and we aren't responsible for their content or practices.

International Transfers

Parakaleo Inc. is based in the United States, and the personal data we collect is processed and stored there and by the service providers listed under "Third-Party Services" in the countries where they operate. If you are in the EU, the UK or Switzerland, this means your data is transferred outside your country. A list of the service providers (sub-processors) that may handle your data is under "Third-Party Services" above. Where the law requires it, we rely on recognised transfer safeguards for these transfers, such as the standard contractual clauses approved by the European Commission (with the UK and Swiss addenda where applicable). You can ask us for information about the safeguards that apply by emailing the address below.

Your Rights

You can ask us at any time what information we hold about you, ask us to correct or delete it, or opt out of marketing email. If the GDPR or similar laws apply to you (for example in the EU, the UK or Switzerland), you also have the right of access, rectification, erasure, restriction of processing, data portability and objection, including to processing based on our legitimate interests, and the right to withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority, such as the data protection authority where you live or work. To use these rights, email hello@parakaleoinc.com with the subject "Privacy request". We may need to verify your identity first, for example by asking you to write from the email address on your account or to sign in. We aim to acknowledge requests within 48 hours and will respond to them within 30 days. If a request is complex, we may extend that period as the law allows, and we will tell you. For residents of California and other US states, see the section below.

Deleting your account also removes your name from any group you belong to, takes down any Safety Profile or Report Card you shared, and cancels any pending team invites you sent. It also ends your subscription and your access immediately, without a refund of the current billing period, except where the law gives you one. We may need to keep billing records for a period after deletion to meet tax and accounting requirements.

The same rights apply to the data the Parakaleo Drive app sends us. You can use the delete options described under "Parakaleo Drive Mobile App" above, or email hello@parakaleoinc.com, and we aim to acknowledge your request within 48 hours.

California and Other US State Privacy Rights

This section supplements the rest of this policy for residents of California and other US states with consumer privacy laws. We collect the following categories of personal information:

• Identifiers and contact details: name, email address, username, country, network (IP) address, hardware fingerprint, and the app's random install ID and device details.
• Commercial information: subscription status, billing history, points, referral and prize records.
• Internet and app activity: execution logs, check-ins, portal use and, if you accept analytics cookies, site analytics.
• Sensitive personal information (precise geolocation): the app processes precise geolocation on your phone, to detect trips and driving events, and does not send us your route or coordinates. We receive trip and event summaries (hard braking, hard acceleration, sharp cornering and speeding) without location, so we do not receive precise geolocation from the app. We list it here for transparency.
• Other: professional details you give us (organisation and role), messages you send us, and inferences such as your Safety Score.

Where we get it. We collect personal information directly from you (forms, your portal account and the app), from the account owner or manager who sets up or manages your account, from your phone through the Parakaleo Drive app, from the vehicle's Parakletos module, from our payment provider (the status of your payments), and by deriving inferences such as your Safety Score.

Why we collect it and who receives it. We use this information for the purposes in "How We Use Information." We disclose it for business purposes only to the service providers listed under "Third-Party Services" (hosting, database, payments, email delivery, form delivery and, with your consent, analytics), and as described under "How We Share Information." In the preceding 12 months we disclosed identifiers, commercial information, internet and app activity and other information (including inferences) for a business purpose to those service providers. We did not disclose sensitive personal information, because we do not receive it. We have not sold or shared personal information in the preceding 12 months.

How long we keep each category. Identifiers and contact details: while your account is active, then erased once your deletion request is verified and completed, except for records we must keep by law; cancelled accounts that stay inactive for 24 months are deleted; network (IP) addresses in logs, including those used for fraud prevention, are kept for up to 90 days. Commercial information: billing and subscription records for as long as tax and accounting law requires; points, referral and prize payout records, and the distance counted toward them, until the account is deleted, or longer where the law requires. Internet and app activity: execution logs for 50 days; analytics data for 14 months, the retention period configured in our Google Analytics account, and only if you accepted analytics cookies. Sensitive personal information and driving data: trip details and driving events, including speeding events, for 90 days; finished trip summaries stay on your phone for up to 90 days after upload. Other: contact and pilot form emails and messages you send us for as long as needed to respond and follow up, then deleted; your Safety Score with your driver profile data while the account is active; shared Safety Profile and Report Card pages until you or we take them down, or until the account is deleted.

No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Sensitive personal information. Precise geolocation stays on your phone and is used there only to detect trips and driving events. We use the event summaries we receive only to provide the service you requested and for the limited purposes the law permits, such as security and fraud prevention.

Notice of financial incentive. Points, rankings, referral rewards and the monthly Safety Challenge cash prizes are a financial incentive. To take part we use your account details and display name, your trip and driving-event summaries (distance and Safety Score), your referral activity, and, if you claim a prize, the claim and payout records. We do not sell this data, and we do not assign it a separate dollar value. Its value to us is that participants who drive, refer others and keep their vehicles connected help us run and improve the service, and the points and prize amounts are set by the program rules rather than by valuing any one person's data. Taking part is voluntary. You opt in by joining the challenge or using the points and referral features in the portal. You can withdraw at any time by emailing hello@parakaleoinc.com or by leaving the challenge, after which we stop counting your activity toward the incentive. You may lose points and prize eligibility, but your account and license are not affected. Qualifying for a prize requires a referral and a minimum distance, as set out in the portal rules.

Your rights. You have the right to know what personal information we collect, use and disclose; to delete it; to correct inaccurate information; to limit the use of sensitive personal information; and to opt out of sale and sharing (which we do not do). You also have the right not to be discriminated against for exercising these rights.

How to make a request. Email hello@parakaleoinc.com with the subject "Privacy request" and tell us what you want. We verify your request by matching the details you give to your account, and we may ask you to write from your account email address or sign in. We respond within 45 days. Where the law allows and we need more time, we may extend this once and will tell you why.

Authorized agents. You may ask an authorized agent to make a request for you. We may require written proof of their permission and may verify your identity with you directly.

Appeals. If we decline a request, you can appeal by replying to our decision or by emailing us with the subject "Appeal", and we will answer within the time the law requires. If you are not satisfied, you may contact your state attorney general.

Global Privacy Control. We treat the Global Privacy Control signal as a request to opt out of analytics and of any sale or sharing. When your browser sends it, analytics never loads, even if you click Accept.

Changes to This Policy

If we change this policy materially, we will notify account holders by email and post a notice on this site, and we will update the date at the top of this page. Where the law requires your consent to a change, we will ask for it.

Contact

Questions about this policy or privacy requests: hello@parakaleoinc.com. Parakaleo Inc. is a Delaware corporation. Registered office and address for legal notices: Parakaleo Inc., c/o Legalinc, 131 Continental Drive, Suite 305, Newark, DE 19713, USA. Day-to-day contact is by email.