This Privacy Policy explains how Pernee, Inc., a Delaware corporation (“Pernee”, “we”, “us”, or “our”) collects, uses, shares, and protects personal information when you visit pernee.com, create an account, or use the Pernee application and related services (together, the “Services”). Pernee is a review-and-memory layer for professional-services firms (such as CPA and tax firms) that works alongside their existing tax-preparation tools.
Scope. This policy applies to the personal information we handle for our own purposes: visitors to our website, people who contact us, and the people who hold Pernee accounts. It does notapply to the information your firm puts into the Services about its own clients and engagements, which may include financial and tax information (“Customer Data”). We process Customer Data on your firm’s behalf, and that processing is governed by our contracts with our customers (our Terms of Service or the written agreement your firm has signed with us, including any Data Processing Addendum), not by this policy. Your firm’s own privacy notice governs how it collects and uses its clients’ information. Sections 4 and 7 describe how we handle Customer Data for your information only.
1. Who we are & how to contact us
Pernee is operated by Pernee, Inc., a Delaware corporation, with its registered address at 131 Continental Drive, Suite 305, Newark, DE 19713, USA. For any privacy question, or to exercise the rights described in this policy, contact us at privacy@pernee.com.
2. Information we collect
We collect the following categories of personal information:
- Account & profile information — your full name, work email address, the name and size of your firm or organization, and your role within it. We require a work/organizational email to register.
- Authentication data — your password, which is stored only in salted, hashed form by our authentication provider (we never store or see the plaintext); one-time verification codes; and session tokens held in cookies.
- Technical & security logs — your IP address, browser and device information, request timestamps, and rate-limiting signals used to protect the Services from abuse.
- Audit records — a log of consequential actions taken in your account (for example sign-ins, sign-outs, role changes, and administrative changes) retained for security and compliance purposes.
- Diagnostics & error reports — when something goes wrong, technical error data (which may include your user identifier and email address) is sent to our error-monitoring provider to help us diagnose and fix issues.
- Content you provide — information, documents, and other content you or your organization choose to enter into the Services.
We do not intentionally collect special categories of data (such as health or biometric data) for our own purposes, and we ask that you do not submit such data except where the Services are expressly designed for it.
3. How we use your information
We use personal information to:
- provide, operate, secure, and maintain the Services;
- authenticate you, create and manage your workspace, and administer roles and permissions;
- protect against fraud, abuse, and unauthorized access (including rate limiting and audit logging);
- diagnose problems, monitor reliability, and improve the Services — but never by training AI models on your data, which we do not do (see section 4);
- communicate with you about your account, security, and service-related matters; and
- comply with our legal and regulatory obligations.
Legal bases (EEA/UK). Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Services you request); our legitimate interests (to secure, maintain, and improve the Services), balanced against your rights; compliance with a legal obligation; and your consent where we specifically ask for it. You may withdraw consent at any time.
4. AI services & how your data is used
Pernee uses third-party AI services to run its features. These terms apply to every customer and every request; there is no setting or plan tier that changes them.
- We do not train on your data.Neither Pernee nor the AI service providers we use train, fine-tune, or otherwise improve any model on your prompts, your documents, your clients’ information, or the output produced for you.
- Zero data retention. We send requests only to AI service providers that have agreed not to retain them. If no such provider is available, the request fails rather than going to one that would retain your data. Subject to their own policies, providers may run automated safety or abuse checks, and may keep a request those checks flag in order to investigate it.
- What we keep.Zero data retention is a commitment about the AI service providers; it does not mean Pernee stores nothing. The data your firm puts into Pernee (clients, engagements, documents, conversation history, and the agent’s memory of an engagement) is stored in our database because the product does not work without it. It is scoped to your organization, it is yours to delete, and it is retained on the terms in section 8.
- Operational metadata. We record token counts, costs, timings, and error diagnostics for each request to meter usage, control spend, and keep the Services reliable. This is metadata about a request, not its contents.
5. Cookies & similar technologies
We use strictly necessary cookies to keep you signed in and to secure your session; these are required for the Services to function. We also use analytics tools on our website and in the application to understand how they are used and to improve them. We do not use advertising cookies, and we do not sell or share personal information for advertising.
6. How we share information
We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share information only with:
- Service providers (sub-processors) who process data on our behalf under contract, including providers of cloud hosting and infrastructure, database and authentication, AI services (on the zero-retention, no-training terms in section 4), background processing, email delivery, web search, error monitoring, and analytics. A current list of sub-processors is available on request at privacy@pernee.com.
- Your own organization— administrators of your firm’s workspace can access information associated with that workspace.
- Legal & safety — where we are required to by law, or to protect the rights, safety, and security of Pernee, our users, or the public.
- Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.
7. Data storage & international transfers
Customer Data, including tax documents, engagement files, and conversation history, is stored in the United States. Pernee does not use offshore teams or overseas subcontractors to handle Customer Data.
We may process information in the United States and other countries where we or our service providers operate, which may have data protection laws different from those where you live. When we transfer personal information out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism.
8. How long we keep your information
We keep personal information for as long as your account is active and for a reasonable period afterwards to meet the purposes described in this policy. Security and audit logs are retained as needed for security and compliance obligations. When information is no longer needed, we delete or anonymize it.
9. How we protect your information
We apply technical and organizational measures designed to protect personal information, including encryption in transit (HTTPS/TLS), strict transport security, database-level access controls with row-level security so that each organization can access only its own data, hardened HTTP security headers, rate limiting on authentication endpoints, and least-privilege access to production systems. No method of transmission or storage is completely secure, but we work continuously to protect your information.
10. Your privacy rights
EEA / UK (GDPR). Subject to conditions, you have the right to access, correct, delete, restrict, or object to our processing of your personal information, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your local data protection authority.
California (CCPA/CPRA).If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, to request access to and deletion or correction of your personal information, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under California law. We will not discriminate against you for exercising your rights, and you may use an authorized agent to submit a request.
To exercise any of these rights, contact us at privacy@pernee.com. We will verify your request and respond within the timeframe required by applicable law. If your data is held on behalf of your organization, we may direct your request to that organization.
11. Children’s privacy
The Services are intended for use by businesses and are not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice where required. Your continued use of the Services after an update means you accept the revised policy.
13. Contact us
Questions or concerns about this policy or our data practices? We are here to help:
privacy@pernee.com
Pernee, Inc.
131 Continental Drive, Suite 305, Newark, DE 19713, USA