Privacy Policy

1. Data Controller

The data controller within the meaning of the GDPR is:

Jan Ole Schmidt
Kellersweg 7
35764 Sinn
Germany

E-Mail: hello@usepalim.com

2. What Data We Process

When using Palim, the following data is processed:

• Account data: Email address and a salted password hash processed by Supabase Auth for authentication. Palim does not store the plaintext password.
• Session content: The AI conversations, summaries, and notes you explicitly save with the Palim MCP server.
• Metadata: Timestamps, tags, and other metadata you assign to your sessions.

Storing your choice (marketing site): We set a cookie `palim_cookie_consent` (one-year lifetime, path “/”, SameSite=Lax) to remember your decision on optional statistics — so we can honor a refusal persistently. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in transparent, compliant cookie handling).

Optional analytics (marketing site): If you consent, we load Vercel Web Analytics and Vercel Speed Insights (provider: Vercel Inc.). Aggregated usage data and Web Vitals (performance) are processed; Vercel may use first-party cookies or similar technologies for this. We do not run ad tracking. Legal basis when you consent: Art. 6(1)(a) GDPR. You may withdraw consent by deleting this cookie and visiting the site again.

3. Legal Basis

Your data is processed for the performance of the contract (Art. 6(1)(b) GDPR). Storage is at your explicit request — Palim only stores what you actively save with the MCP tools.

4. Data Storage & Processing

Your data is stored on servers operated by Supabase.

The infrastructure (API server) is provided via Render.com.

5. Encryption

Supported stored content fields are encrypted server-side at rest with AES-256-GCM. A separate key is derived for each user via scrypt from a Palim-managed master key. This is not end-to-end or zero-knowledge encryption: Palim can decrypt content to provide the service. Account data and operational metadata are processed separately. Transfers use HTTPS/TLS.

6. Retention

Your data is stored for as long as your account exists. You can delete individual sessions at any time. For account-deletion requests or privacy-rights requests, contact privacy@usepalim.com; self-service account deletion is not currently available.

7. Your Rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR): What data we hold about you.
• Rectification (Art. 16 GDPR): Correction of inaccurate data.
• Erasure (Art. 17 GDPR): Removal of your data ("right to be forgotten").
• Restriction (Art. 18 GDPR): Restricted processing of your data.
• Data portability (Art. 20 GDPR): Export of your data in a standard format.
• Objection (Art. 21 GDPR): Object to processing.

To exercise these rights, contact: privacy@usepalim.com

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), P.O. Box 3163, 65021 Wiesbaden, Germany.

9. Beta Notice

Palim is currently in public beta. Although we take great care with the security of your data, we cannot guarantee full data availability during the beta phase. For critical data, we recommend additional backups via the export function.