Privacy Policy

Last updated: March 11, 2026

ParaSarah ("we," "us," or "our") is committed to protecting the privacy of our users and the parties they interact with through our platform. This Privacy Policy describes how we collect, use, store, and share information when you use the ParaSarah platform, website, and services (the "Service").

1. Information We Collect

1.1 Account Information

When you sign up for ParaSarah using Google OAuth, we receive and store:

We do not receive or store your Google account password. Authentication is handled entirely through Google's OAuth 2.0 protocol.

1.2 Firm and Practice Data

You provide the following information when configuring your firm on ParaSarah:

1.3 File and Party Data

For each file you manage through ParaSarah, we store:

ParaSarah does not store legal documents. We only store references to documents that are needed (e.g., "HO-3 insurance certificate from Maria Rodriguez — pending"). The actual documents are managed through your existing case management system.

1.4 Call Data

When ParaSarah places or receives calls on your behalf, the following data is generated and stored:

1.5 SMS Data

When ParaSarah sends or receives text messages on your behalf:

1.6 Usage and Technical Data

We automatically collect:

1.7 Payment Data

Payment processing is handled entirely by Stripe. We do not store your credit card numbers or full payment details. We receive from Stripe: your subscription status, plan type, billing history, and a customer identifier used to manage your subscription.

2. How We Use Your Information

We use the information we collect to:

3. Third-Party Services

ParaSarah integrates with the following third-party services. Each has its own privacy policy governing data they process:

3.1 VAPI.AI (Voice AI Platform)

VAPI.AI provides the voice AI infrastructure that powers ParaSarah's calls. When a call is placed or received, VAPI processes:

VAPI's telephony is powered by Twilio. Call audio is processed using AI models (including OpenAI's GPT-4o for conversation and Deepgram for speech recognition) as subprocessors of VAPI.

3.2 Stripe (Payment Processing)

Stripe processes all payment transactions. When you subscribe to a paid plan, Stripe collects your payment method information, processes charges, and manages your subscription. We do not have access to your full payment card details.

3.3 Google (Authentication)

We use Google OAuth 2.0 for user authentication. When you sign in with Google, Google shares your basic profile information (name, email, profile picture) with ParaSarah. We do not access your Google Drive, Gmail, contacts, or any other Google services beyond what is needed for authentication.

3.4 Google Calendar (Optional Integration)

If you enable Google Calendar integration, ParaSarah can read and write closing dates to your calendar. This integration is optional and requires explicit authorization. You can revoke access at any time through your Google account settings.

4. Data Sharing

We do not sell your personal information or your clients' information. We share data only in the following circumstances:

5. Data Retention

After the retention period, data is permanently deleted from our systems. You may request earlier deletion of your data by contacting us at privacy@parasarah.com.

6. Data Security

We implement appropriate technical and organizational measures to protect your data:

While we strive to protect your data, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please contact us immediately at security@parasarah.com.

7. Your Rights

7.1 All Users

Regardless of your location, you have the right to:

7.2 California Residents (CCPA)

If you are a California resident, you additionally have the right to:

7.3 European Residents (GDPR)

If you are a resident of the European Economic Area, you additionally have the right to:

Our legal basis for processing personal data is: (a) performance of our contract with you (providing the Service); (b) our legitimate interest in operating and improving the Service; and (c) your consent, where applicable.

8. Call Recording and Consent

All automated calls placed by ParaSarah begin with a recording consent disclosure. Georgia is a one-party consent state, but as a best practice, we announce recording at the start of every call. This disclosure is configurable per firm but is enabled by default. Parties who do not wish to be recorded can end the call, and the firm is notified.

9. SMS Communications and Opt-Out

Every outbound SMS message sent by ParaSarah includes instructions for opting out ("Reply STOP to opt out"). Opt-out requests are processed immediately and logged. Once a party opts out, they will not receive further automated text messages through ParaSarah. Opt-outs do not affect voice calls unless the party also requests to be removed from call automation.

10. Children's Privacy

ParaSarah is a business-to-business service designed for law firms and legal professionals. We do not knowingly collect personal information from children under the age of 13. If we become aware that we have collected such information, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to the account owner at least 30 days before taking effect. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

ParaSarah — Privacy
Email: privacy@parasarah.com
General: support@parasarah.com
Web: parasarah.com