Privacy Policy

1. Introduction

Persay (“we,” “our,” or “us”) provides a secure client communication platform. This Privacy Policy explains how we collect, use, and protect your information when you use our service (the “Service”).

Our core principle: We build our service so we cannot access your sensitive data, even if we wanted to.

2. What We Collect

2.1 Information You Provide

• Account Information: Email address, name, phone number, password (hashed)
• Profile Information: Optional profile photo, business name, profession
• Payment Information: Processed by Stripe; we store only payment method type and last 4 digits

2.2 Data You Store (End-to-End Encrypted)

The following data is encrypted on your device before reaching our servers. We cannot decrypt or access this data:

• Messages and conversations
• Files and attachments
• Login credentials stored in client vaults
• Notes and metadata you add

2.3 Automatically Collected Information

• Usage Data: Access logs, feature usage, error reports (no content)
• Device Information: Device type, OS version, app version
• Technical Data: IP address, access times, browser type
• Metadata: Message timestamps, file sizes, participant IDs (not content)

3. How We Use Your Information

3.1 To Provide the Service

• Authenticate you and maintain your session
• Route encrypted messages between you and your clients
• Store encrypted files and data
• Process payments
• Provide customer support

3.2 To Improve and Secure the Service

• Monitor and analyze usage patterns (aggregated, anonymized)
• Debug errors and technical issues
• Detect and prevent security threats
• Improve features and user experience

3.3 To Communicate with You

• Send service updates and security notifications
• Respond to support requests
• Send billing statements
• Optional: Product updates and tips (you can opt out)

4. What We Don’t Do

5. Data Sharing and Disclosure

We share information only in these limited circumstances:

5.1 Service Providers

We use third-party services to operate Persay. These providers have access only to information necessary for their function and are contractually obligated to protect it:

• Cloud hosting (encrypted data storage)
• Payment processing (Stripe)
• Email delivery (transactional emails only)
• Analytics (aggregated, anonymized data)

5.2 Legal Requirements

We may disclose information if required by law, subpoena, or court order. However:

• We can only provide unencrypted account data and metadata
• We cannot decrypt your messages, files, or vault data
• We will notify you unless legally prohibited
• We will challenge overbroad or inappropriate requests

5.3 Business Transfers

If Persay is acquired or merged, your information may transfer to the new entity. We will notify you and the new entity must honor this privacy policy.

6. Your Rights and Choices

6.1 Access and Portability

You can access and download all your data at any time through the app. Export includes all messages, files, and metadata in standard formats.

6.2 Correction and Deletion

Update your account information in settings. Request account deletion anytime—we will delete your account and encrypted data within 30 days (except data we’re legally required to retain).

6.3 Marketing Communications

Opt out of marketing emails anytime. You’ll still receive critical service and security notifications.

6.4 GDPR Rights (EU Users)

If you’re in the EU, you have additional rights:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with a supervisory authority

7. Data Security

We implement industry-leading security measures:

• End-to-end encryption (AES-256-GCM)
• Zero-knowledge architecture
• Secure password hashing (Argon2id)
• TLS 1.3 for all connections
• Regular security audits and penetration testing
• Encrypted backups
• Multi-factor authentication support

For technical details, see our Security page.

8. Data Retention

• Active accounts: Data retained as long as account is active
• Inactive accounts: Encrypted data deleted after 2 years of inactivity
• Deleted accounts: Data deleted within 30 days (except legal retention requirements)
• Backups: Deleted data removed from backups within 90 days
• Logs: Access and error logs retained for 1 year

9. International Data Transfers

Persay operates globally. Your data may be stored in data centers in the US, EU, or other regions. All data transfers comply with GDPR and use Standard Contractual Clauses (SCCs) where required.

10. Children’s Privacy

Persay is not intended for users under 16. We do not knowingly collect information from children. If we discover we’ve collected a child’s information, we’ll delete it immediately.

11. Changes to This Policy

We may update this policy occasionally. Material changes will be announced via email and in-app notification. Continued use after changes constitutes acceptance.

12. Contact Us

Questions about privacy? We’re happy to help:

• Email: privacy@persay.app
• Data Protection Officer: dpo@persay.app