Skip to main content
Paravey Products

Privacy Policy

Last updated October 22, 2026

This policy covers the Paravey SaaS products hosted at app.paravey.com — Undercut, LeadFeed, ShopAssist, and ENGAGE. The services website at paravey.com has its own policy covering the client-services business.

Paravey is operated by Jitendra Paswan. Contact for privacy requests: hello@paravey.com.

1. What we collect

Account data

When you create a Paravey account we store your email address, your company or display name, your subscription status, and your onboarding answers (store URL, competitor URLs, alert preferences, optional Slack webhook URL). We do not ask for or store a password — authentication is passwordless via email magic links.

Service data

For Undercut tenants we scrape public product pages on your tracked competitor stores and store the resulting price readings, product titles, and the URLs we read them from. We do not log in to any store, bypass any paywall, or collect any private information from competitors — only data they expose on their public storefronts for search engines and shoppers.

Website usage

Marketing pages at app.paravey.com use Umami for traffic analytics. Umami is self-hosted on our infrastructure and is cookieless — no fingerprinting, no cross-site tracking. We see which pages were visited and which CTAs were clicked, but we do not identify individual visitors.

Server logs

Our hosting provider (Dreamhost) and CDN (Cloudflare) retain standard web-server logs — IP address, user agent, request path — for approximately 7 days for operational troubleshooting.

2. How we use the data

  • Deliver the service you subscribed to (Undercut alerts, LeadFeed exports, etc.).
  • Send transactional emails (magic-link logins, alerts, billing receipts, weekly summaries) via Resend.
  • Operate the business: debugging, security monitoring, product improvement, and responding to support emails.
  • Improve our marketing pages by understanding which content resonates (via Umami, as above).

We do not sell your data. We do not share your data with advertisers. We do not share your tracked-competitor list with anyone, including other Paravey customers.

3. Third-party processors

We use a small, deliberate set of subprocessors. Each is contractually required to protect your data under their own terms.

  • Dreamhost — US-based hosting provider for our application servers and database.
  • Cloudflare — CDN and DNS; terminates TLS and caches static assets.
  • Resend — transactional email delivery.
  • Stripe — payment processing (when billing is live). We do not store card numbers; Stripe holds the payment method on your behalf.

Everything else (CRM, analytics, status monitoring, workflow automation) runs on self-hosted open-source software on our own infrastructure, which means your data stays within the four subprocessors above.

4. Data retention

  • Your account record is kept while your subscription is active and for 30 days after cancellation so you can reactivate.
  • Price readings and alerts are kept for the life of your Undercut subscription (so historical charts work) and for 30 days after cancellation.
  • Magic-link tokens expire after 15 minutes and are deleted on use; expired tokens are purged nightly.
  • Server logs are kept for ~7 days.

Email us for a full account deletion before the 30-day window expires and we'll process it within 7 business days.

5. Your rights

If you are in the EU, UK, California, or any other jurisdiction with specific data-rights laws (GDPR, CCPA, etc.), you have the right to request access to the data we hold on you, correction of inaccurate data, deletion, and portability (export in a machine-readable format).

Email hello@paravey.com with the request. We'll respond within 30 days and don't charge a fee unless the request is clearly unfounded or excessive.

6. Security

  • All traffic is HTTPS-only (HSTS enabled). Session cookies are HMAC-signed and HttpOnly.
  • Magic-link tokens are stored as sha256 hashes — a database leak cannot be used to log in as any user.
  • Database and backups live on servers located in the United States.
  • Automated error tracking via Sentry (self-hosted free tier) strips PII before capture.

No system is perfectly secure. If you believe you've found a vulnerability, email the address above and we'll respond within 48 hours.

7. Changes to this policy

We'll update this policy as the product changes. Material changes get an email to active customers at least 14 days before taking effect. The “Last updated” date at the top of the page always reflects the current version.