Performance AI Privacy Policy
Our journey is driven by creativity, dedication, and the vision to grow with our community.
Last Updated: September 27, 2025
Effective Date: September 27, 2025
Performance AI, Inc. (a Delaware C‑Corporation) (“Performance AI,” “we,” “us,” or “our”) provides this Privacy Policy for: (i) our websites and pages that link to this Policy (the “Sites”); (ii) our AI platform, APIs, SDKs, agent workflows, and related services (the “Platform”); and (iii) our customer support channels (collectively, the “Services”).
This Policy covers website visitors, prospects/marketing contacts, Platform users/admins, API users, and support interactions. It does not cover job applicants or employees (see separate notice).
Role alignment. For customer content processed in the Platform, your organization is the Controller and Performance AI is the Processor (or Service Provider/Processor under applicable U.S. state laws). For the Sites and our direct marketing, Performance AI is the Controller.
1. Scope and Roles
See introduction above for scope and roles.
2. Information We Collect
2.1 From website visitors and prospects
– Identifiers & business contact (name, work email/phone, company, role), preferences and form submissions.
– Commercial/marketing data (downloads, registrations, campaign attribution, email engagement).
– Internet/Electronic activity (IP address, device/browser data, pages viewed, referrers, clicks, crash/diagnostics).
– Inferences we derive for B2B outreach.
2.2 From Platform users, admins, and API users
– Account & organization (name, work email, role, org and license data).
– Operational content: AI prompts, files/attachments, and model outputs; agent workflow metadata; connector metadata and scoped OAuth credentials; admin audit logs.
– Telemetry & security (performance metrics, API usage, abuse/fraud indicators, safety signals).
– Support (tickets, attachments, transcripts, recordings where applicable).
2.3 Sensitive data
We do not use or sell sensitive personal information (e.g., government IDs, financial account numbers, precise geolocation, biometric data, or PHI) for marketing or targeted advertising. If you are a healthcare customer that uploads PHI, we process it only to provide the Services and only under a Business Associate Agreement (BAA).
3. How We Use Information
We use information to: provide and secure the Services; operate agents and AI features; authenticate users; prevent abuse/fraud; support you; improve reliability and safety; communicate service messages; market to business contacts (including cross‑context behavioral advertising where permitted); and comply with law and enforce terms.
Google API Services User Data. Data obtained through Google APIs (including Gmail and Google Calendar data accessed via connected integrations) is used solely to provide or improve the user-facing features of the Services and is never used for advertising, including cross-context behavioral advertising, in accordance with the Google API Services User Data Policy, including the Limited Use requirements.
Purpose limitation & data minimization. We process personal information only for the purposes described here or as compatible with those purposes, and we limit collection and retention to what is reasonably necessary.
Retention defaults. Unless a different period is required by law or contract: Site analytics/ads identifiers up to 12 months; support tickets up to 12 months after closure; telemetry/security logs up to 12 months; backups up to 12 months (rolling); prompts & outputs (Platform) up to 3 years for safety, auditability, and quality (configurable by enterprise contract/admin settings).
Deletion and account termination. When a customer disconnects an integration (including QuickBooks Online) or closes its account, Performance AI will cease active processing of the associated data. Retained data will be securely deleted or de-identified within a reasonable period consistent with the retention defaults above, unless longer retention is required for legal, regulatory, security, dispute-resolution, or audit purposes. Customers may request deletion of their data at any time as described in Section 8.
4. AI/ML Model Operations
Customer content. We store prompts and outputs for up to three (3) years for safety investigations, auditability, debugging, and product quality. We do not use customer content to train or fine‑tune our base models unless your organization has expressly opted in via contract or an admin‑level setting.
Open‑source model evaluation (Sites). We may use de‑identified and aggregated Site interaction data (telemetry, error traces, de‑identified text snippets) to evaluate and improve open‑source models and safety systems.
De‑identified data pledge. For any de‑identified data, we: (a) implement technical and organizational measures to prevent re‑identification; (b) publicly commit not to re‑identify; and (c) contractually require recipients to do the same.
Third‑party model providers. Depending on your configuration, we may route prompts/outputs to providers such as Azure OpenAI/OpenAI, Anthropic, Google Vertex AI, or AWS Bedrock, or to customer‑hosted models. We configure such providers not to train on your content and share only what is necessary to fulfill your request.
5. Disclosures of Information
We disclose information to: service providers/sub‑processors for hosting/CDN, storage, identity/SSO, analytics/monitoring, logging/observability, communications (email/SMS), ticketing/support, and payments; advertising/retargeting partners (Sites) to facilitate cross‑context behavioral advertising and measurement; affiliates for corporate operations; business transfers (merger, acquisition, financing, or sale of assets); and legal and safety (to comply with law, enforce terms, or protect rights and safety).
Google user data (including Gmail and Google Calendar data) is never disclosed to advertising/retargeting partners and is excluded from the disclosures described above for that purpose. Such data is disclosed only to service providers strictly necessary to operate the Services’ AI assistant features, under contractual confidentiality and use restrictions.
Vendor contracts (CPRA/State law). We enter into contracts with service providers and contractors that limit use to providing services to us, prohibit secondary use, prohibit combining personal information except as allowed by law, require appropriate safeguards, assist us in responding to consumer requests and deletion/return, and flow‑down these obligations to sub‑processors.
We do not disclose PHI to advertising partners and do not use PHI for marketing.
6. Cookies & Similar Technologies
We use strictly necessary (authentication, load balancing, security), functional (preferences, product tours), analytics, and advertising/retargeting cookies/pixels. Manage cookies via our banner or your browser settings.
Signals. We honor Global Privacy Control (GPC) and other recognized Universal Opt‑Out Mechanisms (UOOMs) where required by law (e.g., Colorado, Connecticut, Texas, Montana; Oregon beginning January 1, 2026). Legacy “Do Not Track (DNT)” signals are not currently recognized.
7. “Sale,” “Share,” and Targeted Advertising
Under certain U.S. state laws, “sell” includes disclosing personal information for monetary or other valuable consideration, and “share” includes disclosing personal information for cross‑context behavioral advertising. On the Sites, we may sell/share identifiers, device/internet activity, commercial information, and inferences with advertising/analytics partners for these purposes.
Google user data (including Gmail and Google Calendar data) is never sold or shared as defined in this section and is excluded from targeted advertising and advertising/analytics partner disclosures.
Your choices. Opt out of sale/share and targeted advertising at /privacy‑choices; we also honor GPC and other recognized UOOMs.
Minors. We do not knowingly sell/share personal information of individuals under 16. Where we have actual knowledge a consumer is 13–15, we will obtain the consumer’s opt‑in; for consumers under 13, we require verifiable parental consent. If we learn otherwise, we will cease such processing and delete or segregate the data.
We do not use sensitive personal information for purposes requiring the CPRA right to limit.
8. Your Privacy Rights (U.S. State Laws)
Depending on your state, you may have rights to access/know, correct, delete, port, opt out of sale/share and targeted advertising, and opt out of profiling for decisions with legal or similarly significant effects. You also have the right to appeal a denial of your request.
How to exercise. Submit a request at /privacy‑requests or email hello@getperformance.ai. We may request information to verify your identity; authorized agents may submit requests with proof of authorization. We will respond within required timelines (typically 45 days, with a permitted extension).
Appeals. If we deny your request, you may submit an appeal at /privacy‑appeal or by emailing hello@getperformance.ai; we will respond within the period required by law and provide reasons for our decision.
We will not discriminate against you for exercising your rights.
9. Notice at Collection (California)
We collect the categories below for the purposes described in Sections 3–5 and disclose them as indicated. Retention reflects our defaults (Section 3) or criteria noted.
| Category | Examples | Purposes | Disclosed to | Sold/Shared? | Retention |
| Identifiers | name, business email/phone, IP, online IDs | operate Services, security, support, marketing | service providers; ad/analytics partners (Sites) | Yes (Sites) | Sites: up to 12 months; Accounts: while active + up to 12 months |
| Commercial/marketing | registrations, downloads, campaign data | marketing, attribution, measurement | service providers; CRM/marketing tools | Yes (Sites) | up to 12 months |
| Internet/electronic activity | pages viewed, events, logs | operations, security, analytics | service providers; analytics partners | Yes (Sites) | up to 12 months |
| Inferences | interest segments | B2B marketing | service providers; ad partners | Yes (Sites) | up to 12 months |
| Account & organization | profile, roles, org info | provide/administer Platform | sub‑processors | No | while account active + up to 12 months |
| Operational content | prompts, files, outputs, audit logs | AI features, quality, safety | sub‑processors; model providers per config | No | up to 3 years (configurable by contract/admin) |
| Payment | billing contact, payment tokens | billing, fraud prevention | payment processors | No | Billing contact: while active + up to 12 months; card data held by processor per their policies |
10. Security
We implement measures including encryption in transit and at rest, SSO/SAML with RBAC, audit logging, tenant‑level data segregation, and optional customer‑managed keys (KMS/HSM) for eligible deployments. No method is 100% secure; safeguard your credentials and report suspected incidents to hello@getperformance.ai.
11. Data Residency & International Access
By default, we host and process data in the United States. Members of our support and engineering teams may access data from the U.S. and other countries as necessary to provide and secure the Services, subject to contractual safeguards, access controls, and confidentiality obligations.
12. Payments
We use third‑party payment processors (e.g., Stripe) to process card transactions. We do not store full card numbers; processors are responsible for PCI‑DSS compliance.
13. HIPAA & Enterprise Compliance
For healthcare customers, we offer HIPAA‑aligned deployments and will execute a BAA upon request. We maintain enterprise‑grade security controls and undergo independent assessments (e.g., SOC 2 Type II). Your use of PHI requires appropriate configuration under the MSA/BAA.
14. Children’s Privacy
Our Services are not directed to individuals under 16, and we do not knowingly collect personal information from them. If you believe a minor has provided information, contact us to request deletion.
15. Third‑Party Links & Beta Features
The Services may link to third‑party websites or services; their privacy practices are governed by their own policies. We may offer beta/preview features that include additional or different data handling; where applicable, those terms will be presented to administrators or users before enablement.
16. Financial Incentives
We do not offer financial incentives (e.g., loyalty, discounts, or payments in exchange for personal information) at this time. If we offer such programs in the future, we will provide a Notice of Financial Incentive describing material terms and how to opt in or withdraw without penalty.
17. Changes to This Policy
We may update this Policy from time to time. We will post changes on this page and update the “Last Updated” date. For material changes, we will provide additional notice (e.g., email or in‑product).
18. Contact Us
Performance AI
180 North Stetson Avenue, Ste 3500, Chicago, IL 60601
hello@getperformance.ai