Privacy Policy

Last updated: October 22, 2026

Performdesk (the "Service") is operated by Performdesk ("we", "us"). Performdesk helps businesses send automated email sequences from their own mailboxes and manage the contacts, leads and customers those emails lead to. This policy explains what personal information we collect, how we use and share it, and the choices and rights you have.

Two roles: your data and our data

Your contacts are your data. The people you upload or add to Performdesk (prospects, leads, customers) are your contacts. You decide who to contact and why, and you are responsible for having the right to contact them. For that data we act as your service provider and process it only to run the Service for you. Your account is our data. For your own sign-in, billing and usage information we decide how it is used, as described below.

Information we collect

• Account information: your email address, a securely hashed password (or your Google account identifier if you sign in with Google), and the company name, website, phone number and mailing address you choose to save for email footers and documents.
• Contacts and content you add: names, email addresses, phone numbers, companies, custom fields, list memberships, notes, lead and customer details, workflow and email content, tasks, and Statements of Work and invoices you create.
• Candidates and resumes: if you use the Candidates tab, the CV files you upload, the details read from them (contact details, skills, experience, education), the compensation and notice-period details you enter, your notes, and the reason you record when you reject a candidate. A CV that matches someone already on file is held, with its scan, for up to 14 days until you decide what to do with it. The PDF or Word files you upload as a sample of your company CV format are kept too. Resumes and sample files are stored privately for your account only. If you add team members, their name and email address are kept and they work inside your account only; the hiring projects you create (their details, the interview results and feedback notes you record for each candidate) are stored privately for your account too. The scan runs on our servers and the CV text is not sent to any outside service.
• Mailbox connections: if you connect a mailbox, either the SMTP and IMAP settings you enter or the access tokens Microsoft or Google issue to us when you click "Link with". Passwords, tokens and signing keys are encrypted before they are stored. We never ask for your LinkedIn password and never store a LinkedIn sign-in.
• Sending activity: a log of each email sent for you (recipient, subject, time, result) and, when open and click tracking is on, when a recipient opened an email or clicked a link. We detect replies and bounces by reading message headers and subjects in your connected mailbox; we do not store the body of a reply.
• Billing: your plan, subscription status and invoice history. Payments are processed by our payment partners (Stripe, PayPal or Square, whichever you choose). We never see or store full card or bank details.
• Optional provider keys: if you add an API key for a profile-lookup service or an AI provider, we store it encrypted and use it only for the features you turn on.
• Support tickets: what you write to us and our replies.
• Technical data: logs such as IP address, browser type and timestamps, needed to run and secure the Service.

How we use information

• To provide the Service: send the emails you schedule, track results, detect replies and bounces, and produce your documents.
• To manage your account and subscription, provide support and send service messages (for example a verification or billing email).
• To keep the Service secure, prevent abuse and spam, and comply with legal obligations.

We do not sell your personal information, we do not use your contacts or content for advertising, and we do not use them to train AI models.

Service providers

We share information only with providers that process it on our behalf, and only as needed: our hosting provider; Stripe, PayPal and Square (payments); Microsoft and Google (when you sign in with Google or link a mailbox, so mail can be sent and replies detected); and, only if you add your own keys and use the feature, your profile-lookup provider (for example Apollo) and your AI provider (for example OpenAI or Google Gemini), which receive the text or details needed for that request. We may also disclose information if required by law or to protect rights and safety.

When you link a Google or Microsoft mailbox, our use of information received from those services is limited to sending the emails you ask us to send and detecting replies to them for you. We do not use it for advertising or sell it.

Cookies

We use one strictly necessary cookie to keep you signed in. Your light or dark display choice is saved in your browser. We do not use advertising or third-party analytics cookies. Our payment partners may set their own cookies on their checkout pages to process payments and prevent fraud.

Email tracking

When you turn on open and click tracking, emails you send include a tiny image and rewritten links so you can see opens and clicks. Every email we send for you also includes an unsubscribe link and your sender mailing address, and a person who unsubscribes is not emailed again by any of your workflows.

Retention and deletion

We keep your account data while your account is active. You can delete contacts, lists, workflows and connected mailboxes yourself at any time, and you can ask us to delete your whole account (see Data deletion). We delete account data within 30 days of a verified deletion request, except records we must keep by law, such as billing records. Encrypted backups roll off on their normal schedule, which keeps about 30 days of daily snapshots.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To make a request, raise a ticket in the Support tab of your Performdesk account. We will verify your identity and respond within the time the law requires, and we will not discriminate against you for exercising your rights.

California residents (CCPA/CPRA): in the past 12 months we collected identifiers (email address, IP address), commercial information (subscription records), internet activity (service logs) and the content you added, for the business purposes described above. We do not sell or "share" personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics.

EEA, UK and other regions (GDPR): we process your account data to perform our contract with you, for our legitimate interests in securing and improving the Service, and to comply with legal obligations. You may lodge a complaint with your local data protection authority. If you send email to people in those regions, you are responsible for having a lawful basis to contact them.

International transfers

We and our providers may process information in countries other than yours. Where required, we use appropriate safeguards such as standard contractual clauses.

Security

Passwords are stored hashed, mailbox passwords and access tokens are encrypted at rest, connections use HTTPS in production, and each customer's data is kept separate from every other customer's. No method of transmission or storage is 100% secure, but we work to protect your information.

Children

The Service is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

Changes

We will post any changes here and update the date above. If a change is material, we will notify you by email or in the app.

Contact

Performdesk · the Support tab · Contact page