Privacy Policy

[Perfstaq legal entity name], [registered address], India, is the data fiduciary (controller) for personal data about our account holders, website visitors and billing contacts.

For content a workspace puts into Perfstaq, such as contacts in Sales or the people a contract is sent to in Sign, the workspace's organisation decides why and how that data is used, and we process it on its behalf. Requests about that data are best sent to the organisation first; we will help it respond.

• Account data: name, email address, password hash (never the password itself), Google account identifier if you sign in with Google, workspace name and address, roles and membership.
• Customer content: documents and templates, signature fields and values, contacts, companies, deals and notes, boards, and anything else you or your assistant store in a workspace.
• Signing evidence: for each signer, their name and email, the time they viewed, consented, signed or declined, their IP address and browser user agent, the signature they drew or typed, and SHA-256 hashes of each document version. Together these form the audit trail and certificate attached to a signed document.
• Usage and security data: an audit log of actions in each workspace (who, what, when, from the web or an assistant), sign-in sessions, access tokens and connected assistants (stored as hashes), IP addresses for rate limiting and abuse prevention, and server logs.
• Billing data: plan, invoices and Razorpay subscription identifiers. Card and bank details are entered with Razorpay and never reach our servers.
• Perfstaq for Mac (beta): whether you asked for beta access, and the Macs you signed in from. Dictation and meeting memory stay on your Mac; only what you choose to send (for example a meeting summary logged to a deal) reaches your workspace.
• Early access lists: whether you asked to hear when a coming-soon app (Meeting Bot, Marketing) opens, and when.

• to provide the service: run your workspace, send the emails you trigger (verification, invitations, signing requests and reminders, completion copies), and carry out the tool calls you or your assistants make;
• to produce and preserve evidence that a document was signed, and to let anyone with a copy verify it;
• to secure the service: rate limiting, fraud and abuse prevention, and investigating incidents;
• to bill paid plans and keep tax and accounting records;
• to tell you about changes to the service, these policies or your account. We don't sell personal data, and we don't use customer content to train AI models.

Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we process personal data on the basis of your consent, given when you create an account or sign a document, and for legitimate uses the Act permits, including complying with law and preserving records we are legally required to keep. You can withdraw consent at any time (see section 7); withdrawal doesn't affect processing that happened before it, or records we must keep.

We share personal data only with service providers that help us run Perfstaq, under contracts that limit their use of it, and when the law requires. Current subprocessors:

• Google Cloud (hosting, database and file storage), [region to be confirmed, e.g. asia-south1 (Mumbai)];
• Resend (transactional email delivery);
• Razorpay (payments and subscriptions);
• Google (sign-in with Google, only if you choose it).

When you connect an AI assistant, the data it reads or writes through our connector is also processed by that assistant's provider under its own terms. Signers and other workspace members see the information needed to sign or collaborate. Some providers may process data outside India; where they do, we rely on the safeguards the DPDP Act and its rules allow. [Final subprocessor list and locations to be confirmed]

• Signed documents, audit trails and certificates:at least eight (8) years after the document is completed, because they are evidence of an agreement and may be needed for limitation periods and tax or company-law records. They are kept even if the workspace downgrades or closes, and can't be edited.
• Other customer content: while the workspace exists, and deleted or anonymised within [90 days] after it is closed.
• Account data: while your account is active, then deleted within [90 days] of closing it, except entries in audit logs and signing evidence that must be kept as above.
• Billing records: for the period Indian tax and accounting law requires (currently at least eight years).
• Security logs and rate-limit counters: short-lived; rate-limit counters are cleared within a day.

Under the DPDP Act you have the right to:

• get a summary of the personal data we process about you and how we process it;
• have inaccurate or incomplete data corrected, completed or updated;
• have your data erased when it is no longer needed, subject to the records we must keep (such as signed documents and their evidence);
• withdraw consent, as easily as you gave it;
• nominate another person to exercise these rights if you die or become incapacitated;
• have a grievance addressed by us, and then escalate it to the Data Protection Board of India.

Email [grievance@perfstaq.com (to be confirmed)] from the address on your account. If your data is in a workspace someone else runs, we may refer you to that organisation.

Data is encrypted in transit and at rest with our hosting provider. Passwords are hashed with scrypt; access tokens and links are stored only as hashes; uploaded files live in a private bucket and are served only after a permission check; workspaces are isolated from one another; and every action is written to an audit log. No system is perfectly secure: if a breach affects your personal data, we will notify you and the Data Protection Board as the law requires.

We use strictly necessary cookies only: a session cookie to keep you signed in (shared across your workspace subdomains in production) and short-lived cookies for sign-in flows. We don't use advertising or third-party analytics cookies.

Perfstaq is a business tool for people aged 18 or over. We don't knowingly process children's personal data; if you believe we have, contact us and we will delete it.

We will post updates here and, for material changes, notify workspace owners by email or in the product before they take effect.

Grievance Officer: [name to be confirmed], [grievance@perfstaq.com (to be confirmed)], [postal address]. We aim to acknowledge requests within 24 hours and respond within the time the DPDP Act and its rules set. See also our Terms of Service.