Privacy Policy

1. Roles: Controller and Processor

As Data Controller. For data we collect directly — website visitors, leads, account and billing contacts — STRATEGIC DEALS SL acts as Data Controller.

As Data Processor. For the content customers upload or generate through the platform — call recordings, transcripts, performance analysis and related data — Performy acts solely as a Data Processor on behalf of the customer (or the customer's own client), who remains the Data Controller. Performy processes such data only under the customer's documented instructions and under a Data Processing Agreement (DPA), never for its own purposes.

2. Purpose of Processing

We process information to manage the commercial relationship, including:

• •Service Delivery: Execution of performance engineering contracts, AI video call analysis, and CRM automation.
• •Commercial Communications: Sending product updates and electronic offers.
• •Product Improvement: We improve our service using aggregated, anonymized usage metrics only. We do not use customer content (call recordings, transcripts or analysis) to train AI models.

3. Legal Basis and Retention

• •Contractual Execution: Processing is necessary for the performance of the service contract.
• •Retention (our own data): Commercial and billing data is kept for the duration of the relationship and five (5) years thereafter to meet legal obligations.
• •Retention (customer content): Call recordings, transcripts and analysis processed on behalf of customers are deleted within a maximum of thirty (30) days after account termination, unless law requires otherwise. Customers may export their data at any time.

4. Recipients, Subprocessors and Data Sovereignty

Performy's primary application and database infrastructure is hosted on servers within the European Union (AWS Ireland, eu-west-1), in compliance with GDPR. Certain specialized subprocessors may process specific data outside the European Union where necessary to provide the service, subject to appropriate contractual and data-protection safeguards. We do not sell data or transfer it to third parties except under legal obligation or to the controlled subprocessors required to deliver the service:

We impose equivalent data-protection obligations on every subprocessor and will notify customers of any material change to this list. International transfers are covered by valid mechanisms (e.g. Standard Contractual Clauses).

Use of data from Google APIs. When you connect your Google calendar, Performy requests only the calendar.events.readonly scope, which grants read-only access to your calendar events. We access the event title, scheduled date and time, the associated video-conference link (when available), and the information necessary to identify and process the meeting — solely for the purpose of detecting your scheduled meetings and, if you enable it, joining the notetaker to those meetings. We do not request or hold permission to create, modify, or delete events on your Google Calendar. This data is not used for advertising, ad-profile building, data sale, data brokerage, credit or lending decisions, or any purpose unrelated to the feature you chose to enable.

Sharing with subprocessors. We do not sell your Google data. Your Google Calendar data is not transferred to third parties except where strictly necessary to provide the feature you enabled. Our subprocessor for meeting capture and the notetaker feature is Recall.ai; their public documentation explicitly confirms that they do not use customer data to train or fine-tune their own machine learning or artificial intelligence models (see documentation). Your Google Calendar data is not transferred to any AI/ML provider for the purpose of training or improving their general models.

Use of this data for AI/ML. Data obtained through Google APIs, including Google Calendar data and any data derived directly from it, is not used to develop, improve, train, fine-tune, or evaluate general artificial intelligence or machine learning models — neither Performy's own models nor those of our subprocessors. We may use AI services to process the content of your meetings solely to provide you with the service you requested (for example, generating the call summary and analysis); this processing never involves using your Google Calendar data to train a general model. Any data derived from information obtained via Google APIs remains subject to these same restrictions — it is likewise never used for advertising, data brokerage, or ad-profile building.

Google API Limited Use compliance. Performy's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar data is used solely to provide the meeting-detection and notetaker functionality described in this section.

Retention and protection of this data. Calendar events (title, time, meeting link) are kept for a maximum of 90 days from the event date, unless they resulted in a meeting analyzed on the platform — in that case they're kept as part of that meeting's record while the account remains active. Disconnecting your calendar or deleting your account removes this data immediately, subject only to the technical backup windows necessary to guarantee system integrity and recovery. We don't store your Google credential ourselves: it's held by our meeting-capture subprocessor, which also deletes it when you disconnect. Data always travels encrypted (HTTPS/TLS) and is stored encrypted at rest (AES-256) on EU infrastructure; access is restricted to you — neither other users at your company nor Performy staff can see your calendar events.

5. Your Rights

You may exercise your rights of Access, Rectification, Erasure, Limitation, Objection, and Portability by contacting legal@performy.ai. We guarantee human oversight in performance analysis.