Privacy policy
Last updated: [DATE]
1. Who we are
Perfs is a performance-review product operated by Tahr Inc., doing business as Perfs ("we", "us"), located at [BUSINESS ADDRESS]. This policy explains what we do with personal information across our website and the Perfs application.
If you're an employee whose company uses Perfs, please read section 2 first — your employer, not us, decides what happens to your review data.
2. Two different roles
This distinction matters, so we're putting it up front.
We are the controller of information about the people who sign up for and administer a Perfs account — your name, work email, company, and billing details. We decide how that information is used, and this policy governs it.
We are a processor of everything inside a customer's review cycles — employee names, reporting relationships, ratings, and written feedback. That data belongs to the customer company. We only handle it on their instructions, to run the service. We don't use it for our own purposes, we don't sell it, and we don't share it with anyone outside the subprocessors listed in section 6.
If you're an employee and you want your review data corrected or deleted, contact your employer's Perfs administrator. We'll help them action it, but we can't act on it unilaterally — it isn't ours to give away.
3. What we collect
Account information. Name, work email address, company name, and role, provided when an account is created or a person is added to a roster.
Review content. Ratings, written feedback, competency scores, levels, and reporting relationships, submitted by users inside a review cycle.
Billing information. We use Stripe to process payments. Card numbers never touch our servers — we receive only a transaction record, the last four digits, and the card brand.
Technical information. IP address, browser type, device type, and pages visited, collected automatically when you use the site or app. Used for security, debugging, and understanding which parts of the product get used.
Support conversations. If you contact us through the form on our marketing site or by email, we keep that correspondence so we can help you.
4. How we use it
- To operate the service: creating cycles, delivering review requests, sending reminders and
kickoff emails, releasing results.
- To authenticate you (magic links) and keep accounts secure.
- To bill you and handle payment disputes.
- To respond to support requests.
- To diagnose problems, prevent abuse, and improve the product.
- To comply with legal obligations.
We do not sell personal information. We do not share it with advertisers. We do not use customer review content to build products for anyone else.
5. Cookies
We use the minimum set:
- Essential. Session cookies that keep you signed in after you click a magic link,
including a short-lived cookie used during the sign-in handshake itself. The product does not work without them.
- Preferences. A first-party cookie that remembers interface choices — currently whether
you've collapsed the admin sidebar. It identifies nothing about you and tracks nothing.
We use no third-party chat, analytics, advertising, or cross-site tracking cookies. If you send us a question through the contact form on our marketing site, the message is emailed to us — nothing is stored in your browser.
6. Subprocessors
We use a small number of vendors to run the service. Each is bound by contract to handle data only as needed to provide its service to us.
| Vendor | What it does | Where |
|---|---|---|
| Supabase | Database and authentication | West US (North California) |
| Vercel | Application hosting and content delivery | United States |
| Stripe | Payment processing | United States |
| Resend | Transactional email (review requests, reminders) | United States |
We'll update this list before adding a new subprocessor that handles customer data. Customers on an active plan can ask to be notified of changes by emailing privacy@runperfs.com.
7. Artificial intelligence
Some current or future Perfs features may use third-party AI providers to summarize review content or surface themes across a cycle. Where we do this:
- The AI provider processes the content solely to return a result to us. It is not used to
train or improve that provider's models.
- These features are identified in the product where they appear.
- Review content is never sent to an AI provider except to generate output for the customer
whose data it is.
8. How long we keep data
We keep customer data for as long as the account is active. Deletion is in your hands: an organization administrator can delete the organization from Settings at any time. Deletion takes effect immediately — the organization is hidden and inaccessible from the moment you confirm — and everything is permanently deleted from our production systems when the 30-day grace window ends (you can cancel the deletion any time within those 30 days). Backups are retained on a rolling 7-day cycle, so deleted data ages out of backups within 7 days after production deletion.
Two things survive a deletion, because the law requires or expects them to: transaction records with all personal identity removed (kept 7 years for tax purposes — this includes payment records held by Stripe, our payment processor, under its own legal obligations), and the record that the deletion itself happened — dates and counts, never names — kept 3 years as proof we honored the request.
9. Security
See our security page for specifics on how data is isolated, encrypted, and accessed.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export the personal information we hold about you, and to object to certain processing. To exercise any of these, email privacy@runperfs.com.
California residents (CCPA/CPRA). You have the right to know what personal information we collect and why, to request deletion or correction, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law.
If your employer uses Perfs, contact your employer's administrator first — for review data we act on their instructions, and routing requests through them is faster.
We won't charge you for a request or make you create an account to submit one.
11. International transfers
Our infrastructure is in the United States. If you use Perfs from outside the US, your information will be transferred to and processed there. Where required, we rely on standard contractual clauses with our subprocessors to cover these transfers.
12. Children
Perfs is a workplace tool. It isn't intended for anyone under 16, and we don't knowingly collect information from them.
13. Changes
If we make a material change to this policy, we'll update the date above and notify account administrators by email before it takes effect.
14. Contact
Tahr Inc. dba Perfs, [BUSINESS ADDRESS] — hello@runperfs.com
---