This Privacy Policy explains how PARALLEL TREE LIMITED (“Branchboard”, “we”, “us”) collects, uses, shares and protects personal data when you use our website paralleltree.shopand the Branchboard online software service (the “Service”). It also explains how we handle the text you enter, the notes or files you upload, and the maps we generate for you.

1. Who is responsible

The data controller is PARALLEL TREE LIMITED, 83 Ducie Street, M1 2JQ, Manchester, United Kingdom. For any privacy question, or to exercise your rights, contact us at support@paralleltree.shop or by post at the address above.

2. What we collect

• Account data: email address and authentication identifiers when you create an account or subscribe.
• Subscription & billing data: plan, billing cycle, subscription status and payment confirmations. Payments are processed by Stripe; we never receive or store your full card number.
• Workspace content: the text you type, notes or outlines you paste or upload, and the maps, outlines and exports we generate from them.
• Support data: messages you send through our contact and support forms (name, email, topic, message).
• Technical & usage data: IP address, device and browser type, pages viewed, and basic feature usage, collected to run and secure the Service.
• Cookies: a small number of cookies and similar technologies (see our Cookie Policy).

3. Collection sources

Our collection sources are:

• Directly from you — when you sign up, subscribe, type into the workspace, upload notes or files, or contact us.
• Automatically from your device — technical and usage data and cookies collected as you use the Service.
• From our payment processor Stripe — subscription and payment status only, never full card details.
• From our infrastructure and AI processors — operational metadata generated while running and securing the Service.

4. Why we use it and our legal bases

• To provide the Service — generate maps, run the workspace, deliver exports (legal basis: performance of a contract).
• To take payment and manage subscriptions (legal basis: performance of a contract).
• To provide support and respond to your messages (legal basis: legitimate interests / contract).
• To secure, maintain and improve the Service and prevent abuse (legal basis: legitimate interests).
• To meet legal, tax and accounting obligations (legal basis: legal obligation).
• For optional analytics or communications where required (legal basis: consent, which you can withdraw).

5. AI data handling: your user input, generated output and uploaded files

• User input: the text, ideas, decisions, notes, outlines and any optional files or example data you type, paste or upload into the workspace to generate a map.
• Generated output: the branching maps, diagrams, outlines, branch-reveal sequences and exports the Service produces from your user input.
• Uploaded files & example data: anything you attach is processed only to produce your generated output and is handled with the same protections as your other workspace content.
• You keep ownership of your user input and of the generated output produced from it.
• We process your user input solely to run the generation and to deliver your generated output, exports and history.
• We do not use your user input, uploaded files or generated output to train AI models, and we do not sell them. Where a third-party model provider helps structure your text, it receives only the input needed to return the generated output, under terms that prohibit training on it.
• Retention and deletion: user input, uploaded files and generated output are retained while your account is active so you can revisit your work, and are cleared from active processing caches by default within 30 days if unsaved. You can delete saved workspace content at any time, or email us to request deletion, unless we must keep it to meet a legal obligation.
• Please do not enter other people’s personal data, confidential information or trade secrets you are not authorised to share.

6. Payment provider boundary

Card payments and subscriptions are handled by Stripe as an independent processor. Stripe collects and processes your card data on its own systems; Branchboard does not see, receive or store your full card number, CVC or full card details. We receive only the information needed to fulfil your subscription (such as plan, status and a payment reference).

7. Who we share it with

We share personal data only with service providers that help us run the Service, under contract and only as needed:

• Hosting & infrastructure: Vercel (application hosting and delivery).
• Payments: Stripe (checkout, subscriptions, billing).
• Database, authentication & storage: Supabase (account, lead and content storage).
• AI generation: where an external model provider is used to help structure your text, only the input needed for that generation is sent, under terms that prohibit using it to train their models.
• Email & support tooling: to deliver transactional messages and answer support requests.

We may also disclose data where required by law, to protect our rights, or as part of a corporate transaction, in each case with appropriate safeguards.

8. International transfers

Some providers may process data outside the UK or EEA. Where that happens, we rely on appropriate safeguards such as UK International Data Transfer Agreements, EU Standard Contractual Clauses, or adequacy decisions, so your data keeps an equivalent level of protection.

9. How long we keep it

• Account and subscription records: for the life of your account and as required for tax and accounting (typically up to 6 years after your last transaction).
• Workspace content: as described in section 5 (cleared from active caches within 30 days by default unless saved or legally required).
• Support messages: up to 24 months after your query is resolved.
• Technical logs: a short rolling period for security and diagnostics.

10. Security

We use encryption in transit, access controls, and reputable processors. Payment card data is handled entirely by Stripe. No online service is perfectly secure, but we take reasonable technical and organisational measures to protect your data and review them regularly.

11. Your rights

Depending on where you live, you have rights over your personal data. Under UK GDPR and EU GDPR you may:

• access a copy of your data;
• correct inaccurate data;
• erase data (“right to be forgotten”) where applicable;
• restrict or object to certain processing;
• port your data to another provider;
• withdraw consent at any time where processing is based on consent.

Under the California Consumer Privacy Act (CCPA/CPRA), California residents may request access to and deletion of personal information, and may opt out of “sale” or “sharing” of personal information.

Do Not Sell or Share My Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. If this ever changes we will provide a clear opt-out. To make any rights request, email support@paralleltree.shop; we will verify and respond within the time the law requires.

12. Cookies and analytics

We use essential cookies to run the Service and may use limited, privacy-respecting analytics to understand usage. You can control non-essential cookies through your browser or any on-site controls we provide. See our Cookie Policy.

13. Automated decisions and profiling

Map generation is automated, but it does not make legal or similarly significant decisions about you. Generated maps are drafts to help you think and are not a decision made about you. See our AI Disclaimer.

14. Children and minors

The Service is not for children under 13, and we do not knowingly collect their data. Users aged 13–17 must have permission from a parent or guardian. If you believe a child has provided us data, contact us and we will delete it.

15. Complaints and contact

For any privacy request or concern, contact support@paralleltree.shop. If you are in the UK you may also complain to the Information Commissioner’s Office (ICO); in the EEA, to your local data protection authority; in California, to the California Privacy Protection Agency.

16. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a new “last updated” date. This policy was last updated on 14 July 2026.