Privacy Notice

Version 0.2 · Last updated: 13 October 2026

The short version

- The Hendy Collective Ltd runs Parley, and decides how your personal data is used. - We use your data to run Parley for you. We never sell it, and we don't train AI on it. Your works go to nobody for AI use except on the terms you set. - We don't keep your files. We fingerprint them and then delete them. - We keep your data only as long as we need it. Section 6 says how long. - You can ask for a copy of your data, correct it, or have it deleted. When you leave, we hand your record back to you first. - No decision about you is made by a computer on its own. - If you're unhappy with how we've handled your data, tell us. You can also go to the Information Commissioner's Office.

1. Who we are

Parley is run by The Hendy Collective Ltd ("we", "us"), a company registered in England and Wales (number 16646254), at 71-75 Shelton Street, London WC2H 9JQ. Magpie Standard, the open standard underneath Parley, is ours too, which is why our websites sit on magpiestandard.co.uk. We are the controller of your personal data: we decide how and why it is used. We are registered with the Information Commissioner's Office (registration number ZC059251). We haven't appointed a Data Protection Officer. Our founder, Sonia Hendy, looks after data protection herself. To reach her about anything in this notice, email privacy@thehendycollective.co.uk or write to the address above.

2. Who this notice is for

- Anyone who uses the discover tool on our website, whether or not they leave their details. - Anyone who joins the waitlist, applies for the beta, or gets in touch on behalf of an organisation. - Creators, licensees and people at rights organisations with a Parley account. - People who don't use Parley but whose details reach us anyway. Section 9 is for you. If you use Parley through a collecting society or another organisation that runs it under its own name, that organisation decides how your data is used, and its own privacy notice applies. We handle your data for them, under a written agreement.

3. What we use, and why

The law asks us to give our reason, the "lawful basis", for each use. We rely on four: - Contract: we need it to give you the service you signed up for, or asked us to start. - Legitimate interests: we have a genuine reason, and it doesn't override your rights. You can object (section 7). - Consent: you said yes, and you can take it back at any time. - Legal obligation: the law requires it.

3.1 Using the discover tool

A link you paste
Why: Our server fetches its public page and reads it for your report
Basis: Legitimate interests: showing you the report you asked for
A name or title you look up
Why: We search public catalogues for it
Basis: Legitimate interests, as above
A file you drop
Why: It is read in your browser and never uploaded. We never see it
Your answers
Why: We use them to build your report
Basis: Legitimate interests, as above

This preview doesn't save what you give it, though if a platform turns down our request, our error log keeps the reference we sent it. We only ask for your details if you want to join, or to hear from us.

3.2 Every visit

Your IP address and browser type
Why: Keeping Parley secure and spotting misuse
Basis: Legitimate interests: security
Counts of what gets used - never your name, your email or anything you type
Why: Seeing which parts of Parley work
Basis: Legitimate interests (see section 8)
Error reports when something breaks
Why: Fixing it
Basis: Legitimate interests: keeping the service working

3.3 Leaving your details

Applying to join, as a creator or as a licensee for yourself: your email, your name, your answers and what your preview found
Why: Considering your application, and contacting you about it
Basis: Contract: steps you asked us to take before an agreement
Your phone number, if you choose to give it
Why: A call about your application, or a message asking for your feedback. Leave it blank and you lose nothing
Basis: Contract, as above
Ticking "Send me Parley news and launch updates"
Why: Sending you news and launch updates
Basis: Consent. Every email tells you how to stop them
Ticking "OK to keep a note of what your preview found"
Why: Keeping that note, with your email, to improve how Parley works things out
Basis: Consent
Getting in touch for an organisation, or applying as a licensee for a company: your work email, your name, the website and your message, and your phone number if you choose
Why: Replying to you, and keeping a record of the conversation
Basis: Legitimate interests: answering an organisation that asked us

If you say "not for me" and don't tick the box to keep the note, we delete what you gave us straight away. We use your answers to give each application a score, which helps us decide the order we read them in. A person reads and decides every application. The score never decides on its own.

3.4 Your account

Your name, email, phone number, sign-in details and profile
Why: Running your account
Basis: Contract
Where you are, what you make, the organisations you belong to and your membership numbers, and your identifiers, such as IPI and ISNI
Why: Showing you the rights you're likely to hold and where you could register
Basis: Contract
Your works: titles, details, identifiers, the fingerprint codes we make from your files (ISCC), how you declared each work was made, and the terms you set
Why: Registering your works, publishing your terms, and checking what's licensed
Basis: Contract
Your files
Why: Fingerprinted from temporary storage, then deleted. We never keep them
Basis: Contract
The parts of your identity you choose to include, such as your voice or your face, and the terms you set on them
Why: Offering those uses only where you've opened them
Basis: Contract
What you choose to make public on your creator card
Why: Showing it to anyone who visits, as you asked
Basis: Contract
Scans you ask for
Why: Looking for your work online. We send the matching service a link to your work, it fetches the work from there, and we record what it finds
Basis: Contract
Usage reports you upload
Why: Checking recorded uses against your terms and payments
Basis: Contract
Licences you grant or take, the terms served and the consent behind them
Why: Forming the licence, and keeping the evidence of what was agreed
Basis: Contract, then legitimate interests in keeping the evidence (section 6)
A record of what was done to your works, licences and account, when, and from which IP address and browser
Why: Security, and evidence of what was agreed
Basis: Legitimate interests
Emails about your application, invite, account, security and receipts
Why: Running the service. These aren't marketing
Basis: Contract
Your feedback
Why: Improving Parley
Basis: Legitimate interests

We don't use face recognition to identify anyone. If we offer to look for your own likeness, we will only do it if you ask us to and give your explicit consent first.

3.5 Payments

Payments aren't switched on yet. When they are, Stripe will handle card and bank details and identity checks, and we will keep only Stripe's references and statuses, plus the financial records the law requires (legal obligation). Stripe also acts as its own controller for preventing fraud and for anti-money-laundering checks, under its own privacy notice.

3.6 Complaints and requests

If you complain or make a request about your data, we keep what you sent and our replies, because the law requires us to handle them (legal obligation).

3.7 Group chats

We'll only add you to a group chat, such as WhatsApp, if you say yes at the time, because everyone in the group will see your number.

3.8 What you have to give us

To apply, we need your email and your name. To hold an account, we need what section 3.4 lists for running it. Everything else is optional, and leaving it out never stops you applying.

5. Data outside the UK

Your account data is stored in London, and our email in Europe. Sentry and PostHog are in the EU. UK law recognises the EU as protecting your data to the same standard as ours. When you look something up, or ask for a scan, we send the outside service only what it needs: what you searched for, an identifier, or a link. Where those services are: - Google (for Google Books, YouTube links and image scans) is certified under the UK-US data bridge, which UK law recognises as protecting your data. - Requests from the UK to Spotify (Sweden), Deezer (France), Discogs (the Netherlands) and Apple (Ireland) are handled in the EU. - The other public catalogues and matching services we use don't, as far as we can find, offer a transfer agreement, and some of them are in the United States. Ask us and we'll tell you which service gets what.

6. How long we keep it

Waitlist sign-ups, beta applications, and a preview note you asked us to keep
How long: Six months from the last time you were in touch
Enquiries for an organisation
How long: Twelve months from the last time you were in touch
An application we've decided, or an invite you didn't use
How long: Six months
"Not for me", without the box ticked
How long: Deleted straight away
Your account, after you close it
How long: Twelve months, then deleted. Before that, we hand your record back to you
Your works, fingerprint codes, terms and identifiers, when you close your account
How long: Handed back to you, then deleted with your account
A licence, the terms served and the consent behind it
How long: Six years after the licence ends
Financial records, if you pay us or are paid through us
How long: Six years from the end of the financial year they belong to, because UK tax law requires it
IP addresses and browser types
How long: 90 days
The record of what was done on Parley
How long: Consents, terms served, licences and payments: six years after the licence or your account ends. Everything else: 12 months
Complaints and requests
How long: Six years after we close them
Error reports
How long: Up to 90 days
Backups
How long: Deleted details can stay in our encrypted backups for up to 30 days before those backups expire

"The last time you were in touch" means the last time you left or updated your details with us. Emails we send don't count. The record of what was done on Parley can't be edited, by anyone. It is deleted when its period ends.

7. Your rights

You can ask us to: - give you a copy of your data - correct anything that's wrong - delete it. Some records we have to keep for the periods in section 6, such as a licence's evidence and financial records - stop using it while something is checked - give you your data in a common format, so you can take it elsewhere - stop using it where we rely on legitimate interests. We will, unless we have a compelling reason that outweighs yours, or need it for a legal claim - stop sending you marketing. We always will, straight away You can take back your consent at any time. It doesn't change what we did before you did. No decision about you is made by a computer on its own. A person reads and decides every application. How to ask. Email privacy@thehendycollective.co.uk. There's no charge, unless a request is clearly unfounded or excessive. We reply within a month. If we need to confirm who you are, we'll ask, and the month starts when we have what we need. If a request is complex, or you've sent several, we can take up to two more months, and we'll tell you why within the first month. When you leave. We give you your record first: the fingerprint codes, details, terms and identifiers for your works, in a common format such as CSV or JSON. Fingerprint codes are an open standard (ISO 24138), so you can make the same codes again from your own files, without us. Then we stop publishing your terms, and delete your account as section 6 says. Anything you registered with a collecting society through Parley stays with that society, as your own registration.

8. Cookies and similar technology

We don't use advertising cookies, or anything that follows you to other websites. We don't use Google Analytics. - Keeping you signed in and secure. Parley needs these to work, so they don't need your consent. - Error reports (Sentry). When something breaks, Sentry records the error so we can fix it. Keeping the service working depends on it. - Usage counts (PostHog). PostHog counts how Parley is used, without cookies, and we never send it your name, your email or anything you type. It still reads what your browser sends, so the law asks us to tell you, and to let you say no. Press "Stop counting my visits" on our cookies page. - Remembering your choices. If you set a theme or accessibility option, or say no to usage counts, your browser remembers it. It stays on your device.

9. If you don't use Parley but your details are here

The law asks us to tell you, even though you didn't give us your details yourself. Every right in section 7 is yours too. - You're named on a work. A creator who registered a work told us who made it with them: your name, your role, and any identifiers they gave, such as an IPI or ISNI number. We hold it so that everyone who made a work is on the record, and so the consent behind a licence can be checked. Our basis is legitimate interests: an accurate record of who made a work. Where we have your email, we'll tell you when we first contact you. - A child appears in a work. We record the consent given for them. A work with a child in it is never offered for AI training or AI-generated use through Parley, whatever terms are set on it. - Your organisation is in our directory. We list collecting societies and other organisations, some with a contact email address and phone number taken from CISAC's members' directory. We don't hold the names of the people who work there. If an address we list is yours personally, tell us and we'll remove it. Our basis is legitimate interests: helping creators reach the organisations that matter to them. - Your work, or you, appears in something we scan. We record what matched and where it was found. We don't use face recognition to identify people. - A system you run reads creators' terms. We record which terms it read, when, and what it was served, with its IP address and browser type. That record is evidence the terms were available. The IP address and browser type go after 90 days, unless they're the only way to tell who read the terms. Our basis is legitimate interests. - Someone looks you up on discover. We show them what public catalogues say about you, and don't save it, though if a catalogue turns down our request, our error log keeps the reference we sent it.

10. Keeping it safe

Your account data is encrypted in transit and at rest, and held in London. Only the people who need it can reach it. Every action on works, licences and accounts goes into a record no one can edit. If something goes wrong that puts your data at risk, we will tell the ICO where the law requires it, and tell you if you're at high risk.

11. Over-18s only

Parley is for people aged 18 and over. We don't knowingly hold data about anyone younger who uses it. If we find we do, we delete it.

12. Complaints

If you think we've got something wrong with your data, tell us: email privacy@thehendycollective.co.uk, or write to us at the address in section 1. You don't need a form or any particular words. We'll confirm we have it within 30 days, look into it, and tell you what we found. You can also complain to the Information Commissioner's Office, at ico.org.uk/make-a-complaint/data-protection-complaints or on 0303 123 1113. The ICO will ask for a copy of your complaint to us, so it helps to come to us first.

13. Changes to this notice

When we change this notice, we'll update the date at the top. If a change affects how we use your data, we'll email account holders before it applies.