Performance AI Privacy Policy
Our journey is driven by creativity, dedication, and the vision to grow with our community.
Performance AI
Privacy Policy
Last Updated: September 27, 2025
Effective Date: September 27, 2025
Performance AI, Inc. (a Delaware C‑Corporation) (“Performance AI,” “we,” “us,” or “our”) provides this Privacy Policy for: (i) our websites and pages that link to this Policy (the “Sites”); (ii) our AI platform, APIs, SDKs, agent workflows, and related services (the “Platform”); and (iii) our customer support channels (collectively, the “Services”).
This Policy covers website visitors, prospects/marketing contacts, Platform users/admins, API users, and support interactions. It does not cover job applicants or employees (see separate notice).
Role alignment. For customer content processed in the Platform, your organization is the Controller and Performance AI is the Processor (or Service Provider/Processor under applicable U.S. state laws). For the Sites and our direct marketing, Performance AI is the Controller.
1. Scope and Roles
See introduction above for scope and roles.
2. Information We Collect
2.1 From website visitors and prospects
– Identifiers & business contact (name, work email/phone, company, role), preferences and form submissions.
– Commercial/marketing data (downloads, registrations, campaign attribution, email engagement).
– Internet/Electronic activity (IP address, device/browser data, pages viewed, referrers, clicks, crash/diagnostics).
– Inferences we derive for B2B outreach.
2.2 From Platform users, admins, and API users
– Account & organization (name, work email, role, org and license data).
– Operational content: AI prompts, files/attachments, and model outputs; agent workflow metadata; connector metadata and scoped OAuth credentials; admin audit logs.
– Telemetry & security (performance metrics, API usage, abuse/fraud indicators, safety signals).
– Support (tickets, attachments, transcripts, recordings where applicable).
2.3 Sensitive data
We do not use or sell sensitive personal information (e.g., government IDs, financial account numbers, precise geolocation, biometric data, or PHI) for marketing or targeted advertising. If you are a healthcare customer that uploads PHI, we process it only to provide the Services and only under a Business Associate Agreement (BAA).
3. How We Use Information
We use information to: provide and secure the Services; operate agents and AI features; authenticate users; prevent abuse/fraud; support you; improve reliability and safety; communicate service messages; market to business contacts (including cross‑context behavioral advertising where permitted); and comply with law and enforce terms.
Purpose limitation & data minimization. We process personal information only for the purposes described here or as compatible with those purposes, and we limit collection and retention to what is reasonably necessary.
Retention defaults. Unless a different period is required by law or contract: Site analytics/ads identifiers up to 12 months; support tickets up to 12 months after closure; telemetry/security logs up to 12 months; backups up to 12 months (rolling); prompts & outputs (Platform) up to 3 years for safety, auditability, and quality (configurable by enterprise contract/admin settings).
4. AI/ML Model Operations
Customer content. We store prompts and outputs for up to three (3) years for safety investigations, auditability, debugging, and product quality. We do not use customer content to train or fine‑tune our base models unless your organization has expressly opted in via contract or an admin‑level setting.
Open‑source model evaluation (Sites). We may use de‑identified and aggregated Site interaction data (telemetry, error traces, de‑identified text snippets) to evaluate and improve open‑source models and safety systems.
De‑identified data pledge. For any de‑identified data, we: (a) implement technical and organizational measures to prevent re‑identification; (b) publicly commit not to re‑identify; and (c) contractually require recipients to do the same.
Third‑party model providers. Depending on your configuration, we may route prompts/outputs to providers such as Azure OpenAI/OpenAI, Anthropic, Google Vertex AI, or AWS Bedrock, or to customer‑hosted models. We configure such providers not to train on your content and share only what is necessary to fulfill your request.
5. Disclosures of Information
We disclose information to: service providers/sub‑processors for hosting/CDN, storage, identity/SSO, analytics/monitoring, logging/observability, communications (email/SMS), ticketing/support, and payments; advertising/retargeting partners (Sites) to facilitate cross‑context behavioral advertising and measurement; affiliates for corporate operations; business transfers (merger, acquisition, financing, or sale of assets); and legal and safety (to comply with law, enforce terms, or protect rights and safety).
Vendor contracts (CPRA/State law). We enter into contracts with service providers and contractors that limit use to providing services to us, prohibit secondary use, prohibit combining personal information except as allowed by law, require appropriate safeguards, assist us in responding to consumer requests and deletion/return, and flow‑down these obligations to sub‑processors.
We do not disclose PHI to advertising partners and do not use PHI for marketing.
6. Cookies & Similar Technologies
We use strictly necessary (authentication, load balancing, security), functional (preferences, product tours), analytics, and advertising/retargeting cookies/pixels. Manage cookies via our banner or your browser settings.
Signals. We honor Global Privacy Control (GPC) and other recognized Universal Opt‑Out Mechanisms (UOOMs) where required by law (e.g., Colorado, Connecticut, Texas, Montana; Oregon beginning January 1, 2026). Legacy “Do Not Track (DNT)” signals are not currently recognized.
7. “Sale,” “Share,” and Targeted Advertising
Under certain U.S. state laws, “sell” includes disclosing personal information for monetary or other valuable consideration, and “share” includes disclosing personal information for cross‑context behavioral advertising. On the Sites, we may sell/share identifiers, device/internet activity, commercial information, and inferences with advertising/analytics partners for these purposes.
Your choices. Opt out of sale/share and targeted advertising at /privacy‑choices; we also honor GPC and other recognized UOOMs.
Minors. We do not knowingly sell/share personal information of individuals under 16. Where we have actual knowledge a consumer is 13–15, we will obtain the consumer’s opt‑in; for consumers under 13, we require verifiable parental consent. If we learn otherwise, we will cease such processing and delete or segregate the data.
We do not use sensitive personal information for purposes requiring the CPRA right to limit.
8. Your Privacy Rights (U.S. State Laws)
Depending on your state, you may have rights to access/know, correct, delete, port, opt out of sale/share and targeted advertising, and opt out of profiling for decisions with legal or similarly significant effects. You also have the right to appeal a denial of your request.
How to exercise. Submit a request at /privacy‑requests or email hello@getperformance.ai. We may request information to verify your identity; authorized agents may submit requests with proof of authorization. We will respond within required timelines (typically 45 days, with a permitted extension).
Appeals. If we deny your request, you may submit an appeal at /privacy‑appeal or by emailing hello@getperformance.ai; we will respond within the period required by law and provide reasons for our decision.
We will not discriminate against you for exercising your rights.
9. Notice at Collection (California)
We collect the categories below for the purposes described in Sections 3–5 and disclose them as indicated. Retention reflects our defaults (Section 3) or criteria noted.
| Category | Examples | Purposes | Disclosed to | Sold/Shared? | Retention |
| Identifiers | name, business email/phone, IP, online IDs | operate Services, security, support, marketing | service providers; ad/analytics partners (Sites) | Yes (Sites) | Sites: up to 12 months; Accounts: while active + up to 12 months |
| Commercial/marketing | registrations, downloads, campaign data | marketing, attribution, measurement | service providers; CRM/marketing tools | Yes (Sites) | up to 12 months |
| Internet/electronic activity | pages viewed, events, logs | operations, security, analytics | service providers; analytics partners | Yes (Sites) | up to 12 months |
| Inferences | interest segments | B2B marketing | service providers; ad partners | Yes (Sites) | up to 12 months |
| Account & organization | profile, roles, org info | provide/administer Platform | sub‑processors | No | while account active + up to 12 months |
| Operational content | prompts, files, outputs, audit logs | AI features, quality, safety | sub‑processors; model providers per config | No | up to 3 years (configurable by contract/admin) |
| Payment | billing contact, payment tokens | billing, fraud prevention | payment processors | No | Billing contact: while active + up to 12 months; card data held by processor per their policies |
10. Security
We implement measures including encryption in transit and at rest, SSO/SAML with RBAC, audit logging, tenant‑level data segregation, and optional customer‑managed keys (KMS/HSM) for eligible deployments. No method is 100% secure; safeguard your credentials and report suspected incidents to hello@getperformance.ai.
11. Data Residency & International Access
By default, we host and process data in the United States. Members of our support and engineering teams may access data from the U.S. and other countries as necessary to provide and secure the Services, subject to contractual safeguards, access controls, and confidentiality obligations.
12. Payments
We use third‑party payment processors (e.g., Stripe) to process card transactions. We do not store full card numbers; processors are responsible for PCI‑DSS compliance.
13. HIPAA & Enterprise Compliance
For healthcare customers, we offer HIPAA‑aligned deployments and will execute a BAA upon request. We maintain enterprise‑grade security controls and undergo independent assessments (e.g., SOC 2 Type II). Your use of PHI requires appropriate configuration under the MSA/BAA.
14. Children’s Privacy
Our Services are not directed to individuals under 16, and we do not knowingly collect personal information from them. If you believe a minor has provided information, contact us to request deletion.
15. Third‑Party Links & Beta Features
The Services may link to third‑party websites or services; their privacy practices are governed by their own policies. We may offer beta/preview features that include additional or different data handling; where applicable, those terms will be presented to administrators or users before enablement.
16. Financial Incentives
We do not offer financial incentives (e.g., loyalty, discounts, or payments in exchange for personal information) at this time. If we offer such programs in the future, we will provide a Notice of Financial Incentive describing material terms and how to opt in or withdraw without penalty.
17. Changes to This Policy
We may update this Policy from time to time. We will post changes on this page and update the “Last Updated” date. For material changes, we will provide additional notice (e.g., email or in‑product).
18. Contact Us
Performance AI
180 North Stetson Avenue, Ste 3500, Chicago, IL 60601
hello@getperformance.ai
Your Privacy Choices (Do Not Sell/Share) — Page Copy
At /privacy‑choices, provide:
– A toggle to opt out of sale/share and targeted advertising.
– A statement that we honor Global Privacy Control (GPC) and other recognized Universal Opt‑Out Mechanisms (e.g., CO, CT, TX, MT; OR starting 1/1/2026).
– Links to this Privacy Policy and Cookie Preferences.
Sample text:
You may opt out of the sale or sharing of your personal information and of targeted advertising. We also honor Global Privacy Control (GPC) and other recognized Universal Opt‑Out Mechanisms. Adjust your preferences below or contact us at hello@getperformance.ai.
Cookie Policy — Page Copy (Summary)
We use cookies and similar technologies to operate our Sites, remember preferences, analyze traffic, and deliver relevant ads. You can accept, reject, or customize categories through our banner or browser settings. We honor GPC and other recognized UOOMs for applicable opt‑outs. We do not respond to legacy DNT signals.
Categories we use:
– Strictly Necessary (security, load balancing, authentication)
– Functional (preferences, product tours)
– Analytics (usage measurement)
– Advertising/Retargeting (relevant B2B outreach and measurement)
Sample banner text:
We use cookies to operate our site, measure performance, and deliver relevant ads. Click Accept to consent, Reject to deny non‑essential cookies, or Customize to choose. We honor Global Privacy Control (GPC) and other recognized Universal Opt‑Out Mechanisms. See our Privacy Policy for details.