Privacy

Current scope

This page describes the current Parlia application, document ingestion service, agent chat server, and automation worker behaviour found in the codebase.

It is written as product privacy information. Final legal wording should be reviewed before public launch and matched to the deployed environment.

Data Parlia handles

Parlia handles account identifiers, session data, organisation membership, workspace records, uploaded documents, document metadata, attachments, chat messages, generated drafts, agent runs, traces, spans, raw model responses, action pipeline jobs, and evaluation records.

Workspace data is used to authenticate users, check organisation access, retrieve approved source context, generate policy-facing drafts, inspect agent behaviour, and support product operations.

Supabase

Parlia uses Supabase for authentication, account sessions, email confirmation, password recovery, database records, GraphQL access, and file storage.

Documents, page images, attachments, organisations, workspaces, sessions, runs, traces, spans, files, and membership records are stored in the Supabase project configured for the deployment.

Protected routes verify Supabase access tokens. Server routes use service-role access only for trusted backend work such as membership checks, storage cleanup, document processing, trace writes, and admin operations.

AI model providers

Parlia sends the text, attachments, selected document context, tool results, and instructions needed for a user request to configured AI model providers.

The chat agent currently uses Anthropic as the main model provider. OpenAI is required for the Agents SDK setup, tracing support, embeddings, optional OpenAI model calls, and optional OpenAI tools such as web search, code interpreter, and image generation.

The document ingestion service can use OpenAI, Anthropic, or Google Gemini models depending on model configuration. It sends document page images and extracted document text for page extraction, document analysis, and embeddings.

Document ingestion

PDF, DOCX, and PPTX uploads are sent to the Parlia document ingestion service. The service verifies the Supabase access token, checks active organisation membership, confirms the target workspace, and stores originals and rendered page images in Supabase Storage.

The service converts pages to images, extracts markdown, analyses the full document into metadata, creates embeddings, and writes document, page, render, file, and attachment records back to the Parlia schema.

Chat attachments are stored against the active thread and item. PDF attachments are rendered into page images before being attached to the conversation.

Search and browser tools

When enabled for an agent run, Parlia can use web search, external website extraction, Browserbase, and Google Gemini grounding tools to collect public web context.

Those tools may send search queries, target URLs, task instructions, retrieved page content, browser actions, and tool outputs to the relevant provider. Browserbase sessions can include session recording and debug links when that tool is used.

External websites may receive normal request information such as the requested URL, browser metadata, and network details when browser or fetch tools visit them.

Operational logs and review data

Parlia keeps agent sessions, runs, raw responses, traces, spans, usage data, tool events, and run metadata so authorised users can review how an answer or draft was produced.

Redis or Upstash Redis can store tool request and result snapshots for debugging and audit-style inspection. Application logs also record counts, text lengths, status changes, and error messages.

Model input logging can be reduced with OpenAI agent logging environment settings, including controls for model data and tool data.

Access controls

Access is based on Supabase authentication and active organisation membership. The app derives the user from the access token rather than trusting user identifiers supplied in request bodies.

Organisation-scoped records are checked through membership functions and row-level security policies in the Parlia Supabase schema.

Users should only upload material they are authorised to process inside the selected organisation workspace.

Retention and deletion

Workspace data is retained while it is needed for the product, audit, review, and operational processes configured for the deployment.

Deleting a document removes the document record, linked page records, file rows, organisation links, and related Supabase Storage objects. A service-role-only deletion audit row is retained.

Some operational records, logs, traces, or provider-side records may remain until the relevant retention process or provider configuration removes them.

What Parlia does not use data for

The application code does not add an advertising profile, sell workspace data, or build a separate training dataset from organisation content.

Provider handling is controlled by the configured provider accounts, model settings, logging settings, and data processing terms used in the deployment.