This Privacy Policy describes how PartnerAPI collects, processes, and protects your personal data in compliance with applicable laws, including the GDPR.
We may collect:
We do not use customer data to train AI models. Prompts and documents sent to OpenAI are processed solely to generate a response and are not used to train OpenAI's models. For our other AI providers, see our AI Notice. AI queries and documents are scoped to individual tenants and never cross shared datasets. Tenants can exclude their data from AI processing entirely via the AI data-processing opt-out in tenant settings.
AI assistant conversations may be logged for quality assurance and service improvement. Please avoid sharing sensitive personal data such as passwords, financial details, or government IDs in assistant conversations.
If you use the AI assistant in a partner portal's workspace, conversations you start there are visible to your colleagues at the same partner company, and any of them can reply in them. That includes the conversation's title, its messages and the assistant's replies, and files attached to it. Conversations are never visible to other partner companies, and the business running the partner programme cannot open them. Conversations started before this change stay visible only to the person who started them. If your account is erased, your messages are removed from conversations you shared, and your colleagues' messages are kept.
If we contact you about your company appearing on our public partnership ecosystem map, and you open the link we sent, we record that visit against your account: which company's page it was, and the name and email address you signed in with. We also record whether your email domain matches that company's, which we use only to help us judge whether we are talking to the right person.
We use this to follow up with you about a conversation, and for nothing else. We do not sell it, we do not share it with third parties, and we do not use it for automated decision-making. Booking a call takes you to a third-party scheduling service; we do not send them your details, and what you enter there is covered by that provider's own policy.
You can object to this at any time by contacting dpo@partnerapi.com, and we will delete the record.
To help businesses that use PartnerAPI find companies to partner with, we keep a dataset of companies built from the public partner directories that technology companies publish on their own websites. For each company we hold its trading name, its website address, its category and which published directories list it. We do not hold contact people, email addresses or free-text descriptions, and we run an automated check that leaves out companies whose name and web address, read together, look like an individual person's. That check cannot catch every case, so if you trade under your own name and find yourself in the dataset, you can ask us to remove you (see below).
When a business using PartnerAPI researches one of these companies, we may also read that company's own public web pages and record facts it publishes about itself, such as the countries it operates in or whether it offers an API. We keep those facts so other businesses do not have to repeat the research, and we delete them when they have not been seen again for 24 months.
A business using PartnerAPI sees at most ten suggested companies at a time and decides for itself whether to get in touch. We do not tell other businesses which companies a business is pursuing.
We rely on our legitimate interest in offering this matching service. If you run a business that appears in this dataset, and especially if you trade under your own name, you can ask us to remove it, or object to it being used, by writing to dpo@partnerapi.com. We will remove it and keep it out of future updates.
We process data under the following legal bases:
If you choose to sign in with your Google account, Google confirms your identity to us and shares the email address, verified-email status, name and profile picture on your Google profile. For that sign-in Google acts as an independent controller under its own privacy policy and the Google Controller-Controller Data Protection Terms — not as a subprocessor acting on our instructions — so it does not appear on our Subprocessor List. You can always sign in with an email link instead.
Data may be transferred to the U.S. We rely on Standard Contractual Clauses (SCCs) for GDPR-compliant data transfers.
You have the right to:
Contact us: dpo@partnerapi.com
We retain personal data only as long as necessary for service delivery or legal compliance.
We implement appropriate technical and organizational measures to protect your information, including:
If you have any questions about this Privacy Policy, please contact us at:
For details on how we use cookies, please see our Cookie Policy.
For a list of subprocessors we engage to process personal data, please see our Subprocessor List.
This Privacy Policy is designed to comply with applicable privacy laws, including GDPR, CCPA, and other relevant regulations.