Privacy Policy

Palanor, Inc. (“Palanor,” “we,” or “us”) operates the Palanor Enterprise Intelligence Platform — a predictive scenario-based intelligence product comprising a marketing site at palanor.com and the in-product app at palanor.com/<org>. This Privacy Policy explains what data we collect, why, how we use it, who we share it with, and your rights under applicable law. It applies to both the marketing site and the in-product app.

1. Data we collect

Account data. When a steward creates an account or is invited to one, we collect name, email, organization affiliation, role, and an avatar if provided. Authentication is handled by our identity provider (Supabase Auth).

Organization data. The business profile a customer provides during onboarding (industry, what we do, strategic priorities, risk surface) plus any data entered into the product (CRM contacts, scenarios, signals subscriptions, schemas, briefings, research-paper unlocks, deal pipeline records). Customers control this data and can export or delete it.

Usage data. Standard server-side logs (request URL, timestamp, IP, user-agent, response status) for security and reliability. To spot suspicious sign-ins, we record each sign-in with an approximate location (city and country) derived from the IP address by our hosting provider, and keep these records for 400 days. We do not run third-party analytics or marketing pixels.

Cookies. Only session-authentication cookies essential to keep you signed in. No advertising cookies. See the Cookies section below.

Mobile apps. The Palanor app for iPhone and Android uses the same account. It stores your sign-in session on the device, and if you allow notifications it registers a push token so we can send briefings and alerts. Questions you ask Numen in the app are sent to our AI provider to produce an answer. The app has no advertising, no advertising ID, and no third-party analytics. You can delete your account in the app under Profile → Delete account; see palanor.com/privacy/delete-account for the steps and what is deleted.

Palanor Data: the API, the MCP, the Python client and the Excel add-in. Palanor Data is Palanor’s data service. It comprises the REST API at api.palanor.com, the Palanor MCP, the palanor Python client and the Palanor Data add-in for Microsoft Excel. To use it you create an API key in your Palanor account. We store only a hash of the key, plus its first eight characters so you can tell your keys apart. For each request we log the key it came from, the endpoint, the response status, the time and the client that sent it (for example, palanor-excel/0.1.0). We use this to enforce monthly limits and keep the service reliable.

The Excel add-in keeps your key in the add-in’s own storage on your computer (Office’s OfficeRuntime.storage), never in the workbook, and sends it only to api.palanor.com. To show where a value comes from, it reads the formula in the cell you select, and the cell that holds the signal name if the formula refers to one. The only workbook content sent to Palanor is the signal names and dates inside PALANOR formulas. The add-in writes to your workbook only when you ask it to (the “Palanor sources” sheet). It sets no cookies and runs no analytics.

Communications. Email you send to us, and email we send you via Resend (transactional notifications, Numen briefs, Council inquiries). We do not sell or share email addresses with third parties.

2. Why we collect it (legal bases under GDPR)

We process personal data on the following legal bases, depending on jurisdiction:

• Contract. To provide the platform and deliver the services you have contracted for.
• Legitimate interests. To secure the platform, prevent abuse, and improve the product. We balance these interests against your privacy rights.
• Consent. Where required (e.g., marketing email outside a contracted relationship). You can withdraw consent at any time.
• Legal obligation. Tax, accounting, fraud prevention, regulatory response.

3. How we use the data

To operate and improve the platform: render Numen briefings, run scenarios, score signals, generate research papers, deliver email, secure the service, and respond to support requests. We do not use customer data to train shared AI models. Per-customer LLM calls (Anthropic Claude) are stateless and do not contribute to model training under our subprocessor agreement.

4. Who we share it with — subprocessors

We rely on a small set of vetted subprocessors to operate the platform. The current list is published at palanor.com/subprocessors. Subprocessors are contractually bound to confidentiality and to processing data only as instructed by Palanor. Standard Contractual Clauses (SCCs) cover international transfers where required.

4.1 YouTube API Services

Palanor uses YouTube API Services to publish Palanor’s own videos to Palanor’s own YouTube channel from our internal publishing tool. By interacting with any part of Palanor that uses YouTube API Services, you are also subject to the Google Privacy Policy.

What we access. Only Palanor staff connect a YouTube account, and the only account connected is Palanor’s own channel. Through the YouTube API we upload videos, set their thumbnails and captions, and read our own channel’s name and ID and our own videos’ public statistics (view, like and comment counts). We do not let customers or readers connect their YouTube accounts, and we do not access, collect, or display any other person’s YouTube data.

What we store and share. We store the access and refresh tokens for Palanor’s channel (in our encrypted database, readable only by our servers), the IDs and links of the videos we uploaded, and those videos’ public statistics. We do not sell or share this information with anyone. Uploaded videos are public content on YouTube under YouTube’s own terms.

Revoking access and deletion. The connected channel owner can revoke Palanor’s access at any time through the Google security settings page. Once access is revoked, our systems detect it within a day and delete the stored tokens. Video statistics are deleted automatically once they are more than 30 days old without being refreshed, in line with the YouTube API Services Developer Policies. To have everything we hold deleted sooner, email privacy@palanor.com and we will delete it within 7 days.

5. Where we store data

The Palanor app and database are hosted in the United States (Vercel + Supabase, AWS us-east region). Email is delivered by Resend (US). LLM inference runs on Anthropic (US). Customers in jurisdictions with data-residency requirements should review the Data Processing Agreement available at palanor.com/dpa before contracting.

6. How long we keep it

Account data is retained while the account is active. On account closure, customer data is deleted within 90 days unless retention is required by law or to resolve disputes. Audit logs are kept for a rolling 18 months. Backups are deleted on the same 90-day rolling window. Specific retention can be negotiated in the DPA.

7. Your rights

Under GDPR, UK GDPR, CCPA/CPRA, and the state privacy laws in force in Colorado, Virginia, Connecticut, Utah, Texas, Delaware, Iowa, Indiana, Maryland, Minnesota, New Hampshire, New Jersey, Tennessee, Oregon, and Montana, you have the right to access, rectify, erase, port, restrict, and object to the processing of your personal data. Under CCPA/CPRA you also have the right to know the categories of personal information collected and to opt out of any “sale” or “sharing” — Palanor does not sell or share personal information for cross-context behavioral advertising, full stop.

How to exercise these rights (DSAR): Email privacy@palanor.com with the subject line “DSAR” and the right(s) you want to exercise. We will verify your identity (typically via the email associated with your account), respond within 30 days, and provide the data in a machine-readable format. We do not discriminate against users who exercise their rights.

8. Security

Encryption at rest (Supabase + AWS-managed AES-256 for the database and Storage; application-side AES-256-GCM for BYOLLM customer API keys) and in transit (TLS 1.2+). Row-Level Security on every customer table. Multi-factor authentication (passkeys or authenticator apps, with backup codes) for every user via /account/security, required for new accounts. Service-role keys live only in trusted server contexts and never reach the browser. Vulnerability disclosure: security@palanor.com. The full security posture is published at palanor.com/security.

9. Children

Palanor is a B2B product not intended for users under 16. We do not knowingly collect data from children. If you believe we have, contact privacy@palanor.com.

10. Cookies

We use only essential cookies: a session-authentication cookie that keeps you signed in, and a small theme-preference cookie that remembers light/dark/auto. We do not use analytics or advertising cookies. Under the EU ePrivacy Directive, no banner is required for cookies strictly necessary for the service. If we ever introduce non-essential cookies, we will publish a banner with granular consent.

11. Changes to this policy

If we change this policy materially, we will notify customers via email and update the “Last updated” date at the top. Continued use of the platform after the change constitutes acceptance of the updated policy.

12. Contact

Privacy questions, data subject access requests, breach notifications:

• Email: privacy@palanor.com
• Mail: Palanor, Inc., 254 Chapman Rd Ste 208, Newark, DE 19702, USA
• EU representative: available on request via privacy@palanor.com