Persimo Privacy Policy

Last Updated: October 22, 2026

1. Introduction

Ingengo LLC, a New York limited liability company (“Ingengo,” “we,” “us,” or “our”), operates Persimo, a personal contact and relationship management application available at https://persimo.app (the “App”), and a related website at https://persimo.ai (the “Website”). The App, the Website, the content we make available through them, our emails and notifications, our support, and all related tools, features, functionality, and technology, however accessed, are collectively referred to as the “Service.” This Privacy Policy describes how we collect, use, disclose, and protect information from and about you when you use the Service. This Privacy Policy forms part of our Terms of Service at https://persimo.ai/terms (the “Terms”). PLEASE READ THIS PRIVACY POLICY CAREFULLY. IF YOU DO NOT AGREE TO IT, PLEASE DO NOT USE THE SERVICE. Please send privacy questions to privacy@persimo.ai.

2. Our Two Roles

The App is a tool you use to keep your own records about the people you know. Our role differs depending on whose information is involved:

(a) Information about you as our user. For your Account, sign-in, support, and Usage Data, we decide why and how the information is processed, and we act as the controller (or business). This Privacy Policy is our notice to you about that processing.

(b) Your Content, including information about other people. You decide whom to record in the App, what to record, and why. For the contacts, contact details, notes, images, files and other materials you enter, import, scan, or submit (“Your Content”), you are responsible for that information, and where a data protection law applies to you, you are its controller. When we transmit or process Your Content to carry out your instructions, such as synchronizing, backing up, restoring, importing, exporting or scanning, we act only as your service provider (or processor) under the Data Processing Terms attached as Annex A to the Terms (the “Data Processing Terms”). We do not use Your Content for our own purposes.

This Privacy Policy describes how the Service handles Your Content so that you can decide whether the Service is appropriate for it. It is not a notice given by you to the people described in Your Content, and it does not satisfy any obligation you may have to them.

3. Definitions

Capitalized terms have the meanings below and include their singular and plural forms.

“Account” means the Persimo registration that identifies you and lets you use the App; your Google account is not an Account.

“Cookies” means small data files that a website stores in your browser, and similar technologies used for the same purpose; the browser storage that holds Your Content is not a Cookie.

“Google User Data” means information we receive from Google APIs about you or your Google Drive and Google Sheets files, including the profile Google returns when you sign in and the contents of files we access with the permissions you grant.

“Personal Information” means information that identifies, or can reasonably be linked to, an individual (or a household, where applicable law so provides).

“Prohibited Information” has the meaning given in Section 14(a) of the Terms.

“Sensitive Personal Information” means Personal Information that applicable privacy law treats as sensitive or as a special category of data, such as health and medical details (including allergies), religious or dietary practices, racial or ethnic origin, sexual orientation, biometric data, government identification numbers, financial account numbers, or passwords and authentication credentials (excluding the encrypted sign-in Cookies we use to maintain your session).

“Service Provider” means a company that processes Personal Information on our behalf and under our instructions to operate the Service, as listed in Section 11.

“Usage Data” means information generated automatically when you use the Service, such as the page or feature requested, the time of the request, your browser type, your IP address, and whether the request succeeded.

“Your Content” and “Data Processing Terms” have the meanings given in Section 2(b).

4. Information We Collect

(a) Your Google account information. When you sign in with Google, we receive the name, email address, profile picture URL, and account identifier that Google provides. We do not receive your Google password. We ask Google for permission to access only the Google Drive and Google Sheets files that the App creates or that you select, and we receive authorization tokens (including refresh tokens, which Google describes as access when you are not using the app) so that we can carry out requests from your browser during your sign-in session without asking you to sign in again each time. These tokens are kept in an encrypted sign-in Cookie in your browser. A sign-in session lasts up to 30 days unless you sign out sooner. During our limited preview, we maintain a list of email addresses approved to use the Service. Completing Google’s permission screen does not by itself create an Account, and declining a sign-in or removing an email address from the approved list does not revoke the permission you granted in your Google account. You can remove that permission at any time at https://myaccount.google.com/permissions.

(b) Your Content. Your Content is stored primarily in your browser on your device. We do not maintain a database of Your Content on our servers. However, Your Content passes through our servers, where it is processed temporarily and is readable by our systems, when you use the following features: (i) sync, backup and restore, in which your contact details and notes (and, for backups, card images) are transferred between your browser and your Google Drive through our servers; (ii) Google Sheets, in which we process the spreadsheet names and contents you select and the contact details you export, including notes; and (iii) business card and document scanning, in which we send the entire image or PDF you select, including any handwritten or printed notes, other text and embedded metadata, to Google’s AI services to extract proposed contact details, which are returned to you for review. We do not add your saved notes to scan requests. If you save a scan result, the card image (but not the PDF) is stored with the contact in your browser.

(c) Usage Data and logs. When your browser contacts the Service, our hosting providers automatically record information such as your IP address, browser type, the time, the web address requested, response status and timing. Web addresses and error records can include identifiers such as Google Drive file or folder identifiers, sign-in parameters, or error details from our providers. If an error occurs during sign-in, your browser may send a technical error report to us. We design our logs not to record Your Content.

(d) Support communications. When you email us, we receive your email address, your message, and any attachments. Please do not send us other people’s records unless we ask for a specific item.

5. How We Use Your Information

We use information about you to: (a) provide, operate and administer the Service and your Account, including storing and verifying your acceptance of the Terms; (b) provide the App’s features you choose to use, including processing of Your Content described in Section 4(b); (c) provide customer support; (d) send you emails at your Account email about the Service, including updates and, where permitted, promotional messages or surveys, from which you can unsubscribe at any time; (e) understand how the Service is used, troubleshoot problems and improve the Service, using Usage Data, support communications, and feedback, but not Your Content; (f) secure the Service, your Account and Your Content, and prevent fraud and abuse, including by tracking request volumes per Account; (g) process payments you authorize, if we offer paid plans; and (h) comply with applicable law and legal process and establish, exercise or defend legal claims.

What we never do with Your Content. We do not sell Your Content, use it for advertising, build profiles of you or of the people described in it, combine Your Content with other users’ content, or use it to train artificial intelligence or machine learning models, and we do not authorize our Service Providers to do so.

Google User Data. The App’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements and, for Google Workspace API data, the Google Workspace API User Data and Developer Policy, including its Limited Use requirements. We do not use Google User Data, including raw data obtained through Google Workspace APIs and data derived from it, to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models, and we do not authorize our Service Providers to do so.

Where the law requires a legal basis for our processing of information about you, we rely on: (a) performance of our contract with you, to provide your Account and the App’s features you choose to use; (b) our legitimate interests in operating a secure and useful service, including security, abuse prevention, support and service improvement; (c) your consent, where required, including for optional analytics Cookies in the European Economic Area, Switzerland or the United Kingdom; and (d) compliance with our legal obligations. Our processing of Your Content on your behalf relies on the legal basis that you, as controller, are responsible for establishing.

6. Information About Other People in Your Content

Service users may record information about other people, including people who do not use the Service and children. That information is stored in the Service user’s own browser and Google account, not on our servers, and we process it only transiently and only on the Service user’s instructions. We do not search, index, analyze, or build profiles from it, and we have no way to locate, view, evaluate, correct, or delete information a Service user has saved about a particular person.

If you are a Service user, you are responsible under the Terms for having the right to record and use information about other people, including any lawful basis, notice or consent that applies to you. See Section 8 (Your Content) and Section 9 (Information About Other People; Your Responsibilities as Controller) of the Terms for details.

If you are not a Service user and believe a Service user holds information about you, please contact that user directly, because only the user can access, correct or delete it. If you contact us, we will respond about any Personal Information we do hold about you (such as a support message you sent us), and, where appropriate, we may refer your request to the user if we are able to identify them.

7. Sensitive Information

The Service is not designed for Sensitive Personal Information, and we do not ask you to provide it. Under Section 14(a) of the Terms, you may not use the Service to store Prohibited Information, including passwords, authentication secrets, recovery codes, full payment card or financial account numbers, government identification numbers, biometric data, HIPAA-protected health information, or confidential records that an employer, client, or other organization requires you to keep only in its approved systems.

However, a personal note may contain Sensitive Personal Information that is not Prohibited Information, such as a health or allergy detail (not subject to HIPAA), religious or dietary practice, racial or ethnic origin, or sexual orientation – or sensitive personal or family circumstances. If you choose to include such information in Your Content, including in contact details, notes or scanned files, you are responsible under Section 9(e) of the Terms for having any rights, lawful basis and consents needed to do so, and you should consider that Your Content is not currently end-to-end encrypted (see Section 13). We use any Sensitive Personal Information only to provide and secure the Service and to comply with applicable law, and not to infer characteristics about you or anyone else.

8. When We Disclose Personal Information

We disclose Personal Information only: (a) to our Service Providers, to perform services for us as described in Section 11; (b) to Google, in connection with your own Google account when you use Google sign-in, Google Drive, or Google Sheets; (c) at your direction, such as when you export data, share a spreadsheet or Google Drive file, send a message, or connect a third-party tool; (d) to comply with valid legal process, or where necessary to investigate fraud, abuse or security incidents, limited to what that purpose requires; and (e) in connection with a merger, acquisition, financing, or sale of all or part of the Service or Ingengo LLC (or its assets), in which case the recipient may receive the information needed to operate the Service, subject to this Privacy Policy. Google User Data will be transferred only with any prior consent required by Google’s policies.

9. Cookies and Browser Storage

(a) Sign-in and security. The App uses strictly necessary Cookies to keep you signed in and to secure the sign-in process. If you block them, you will not be able to stay signed in. The sign-in session lasts up to 30 days unless you sign out sooner; security Cookies used during sign-in expire after about 15 minutes.

(b) Your records in the browser. The App stores Your Content and your settings in your browser’s storage. This storage is not used for advertising. Clearing your browser’s site data can permanently delete the records stored in that browser.

(c) The Website. The Website does not offer forms or Accounts. In addition to any analytics Cookies described in Section 9(d), our website hosting provider may set a security Cookie and keep standard server logs, such as IP address, browser type and pages requested.

(d) Measurement. Where Google Analytics is enabled, it sets Cookies and receives Usage Data as described in Section 10. You can block these Cookies in your browser without affecting sign-in.

(e) What we do not use. We do not use advertising Cookies. We do not respond to “Do Not Track” signals. We treat a Global Privacy Control signal as a request to opt out of optional analytics Cookies.

10. Product Measurement and Google Analytics

We use Usage Data and, where enabled, analytics tools to operate and troubleshoot the Service and decide what to improve. We do not use the text of your notes or the contents of your contact list for this purpose, and we do not send Your Content to Google Analytics or enable Google’s advertising features. Where Google Analytics is enabled, it receives technical information such as pages or screens viewed, browser and device type, and approximate location inferred from your IP address. Google’s use of analytics data is governed by its own terms; see https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245. Where the law of the European Economic Area, Switzerland, the United Kingdom, or another jurisdiction requires consent before optional analytics Cookies are set, we will ask for it.

11. Service Providers

Service Providers process Personal Information on our behalf to operate the Service. They may use it only to perform services for us, under contracts that require them to protect it. Where noted below, they act as our sub-processors for Your Content under the Data Processing Terms. Third-Party Services that you use under your own account or connect yourself, such as Google sign-in, your own Google Drive and Google Sheets, browser extensions, or AI assistants, are not our Service Providers, and their own terms and privacy policies govern information held in or directed to them. This list is current as of the Last Updated date. We will update this Privacy Policy before we add or replace a Service Provider, and at least 14 days before we add or replace one that acts as a sub-processor of Your Content (or sooner if required for an urgent security, legal, or operational need).

(a) Google Cloud (sub-processor of Your Content) hosts the App, processes sync, backup, restore, and Google Sheets requests, and keeps our technical logs. Google’s AI services extract contact details from the images and PDFs you scan, and Google may retain content submitted to its AI services for limited purposes, such as abuse monitoring, under its terms. Google Cloud processes customer data under its cloud terms and data processing addendum; see https://cloud.google.com/terms/cloud-privacy-notice.

(b) Other Google Services. We use Google Workspace (at our @ingengo.com domain) to receive, manage, and reply to emails forwarded from our @persimo.ai addresses, and, where enabled, Google Analytics for product measurement. If you choose to include any of Your Content in an email to us for support or otherwise, our Google Workspace processes that email as a sub-processor of Your Content to fulfill and manage the email delivery. When you use Google sign-in or store and access files in your own Google Drive or Google Sheets, Google provides those services directly to you under your own agreement with Google, and not as our Service Provider. Google’s privacy policy is available at https://policies.google.com/privacy.

(c) Cloudflare (sub-processor of Your Content) provides content delivery and network security for the App. Requests to the App, including backups and scanned files, pass through Cloudflare. Cloudflare’s privacy policy is available at https://www.cloudflare.com/privacypolicy/.

(d) Hostinger hosts the Website and provides email hosting and forwarding for our @persimo.ai email addresses. If you choose to include any of Your Content in an email to us for support or otherwise via an @persimo.ai email address, Hostinger processes that email as a sub-processor of Your Content to fulfill and manage the email delivery. Hostinger’s privacy policy is available at https://www.hostinger.com/legal/privacy-policy.

(e) Payment processor. We do not currently offer paid plans. Before we do, we will identify our payment processor in this Privacy Policy. The processor will collect your payment card details directly under its own privacy policy, and we will not store your full card number.

12. Access to Your Content

Our personnel do not view Your Content as part of ordinary operations, and we do not store Your Content on our servers. When you sync, back up, restore, use Google Sheets, or scan a file, we process Your Content temporarily in transit and do not keep a separate copy. Our technical logs may contain the identifiers and error details described in Section 4(c), which our authorized personnel can access to operate and secure the Service. We do not access your Google credentials, Google User Data, or specific items of Your Content except: (a) when you request help and agree that we may review a specific item; (b) to investigate abuse, a security incident, or a breach of the Terms; or (c) as required by law. We may be unable to resolve a problem if you do not allow us to review the item involved.

Anyone with access to your unlocked device, browser profile, or Google account can access the information stored there. Anyone you share your sync or backup files with can see Your Content, because those files are not encrypted by the App. Software you install, such as a browser extension or AI assistant, can read what your browser displays, and that software’s privacy policies govern its access to your data. For more information regarding your responsibilities and our limitation of liability concerning these third-party tools, please review Section 15 (Third-Party Services) of the Terms.

13. Security

We protect data in transit using HTTPS with industry-standard TLS encryption (TLS 1.2 or higher) to protect data transmitted between your browser and the Service, and we limit access to our production systems to personnel whose work requires it. Account information and logs stored on our Google Cloud infrastructure are encrypted at rest using industry-standard encryption (such as AES-256), and your OAuth authorization tokens are stored in an encrypted Cookie in your browser. Your Content is not currently end-to-end encrypted. When we sync, back up, restore, import, export, or scan Your Content, our systems can read it, and sync and backup files stored in your Google Drive are not encrypted by the App. No method of storage or transmission is completely secure, and we cannot guarantee that Your Content will not be lost, altered, or accessed without authorization. If a breach involving Personal Information we hold or process requires notice, we will provide notice as required by law and, for Your Content, as described in the Data Processing Terms.

14. How Long We Keep Personal Information

Your Content stored in your browser remains there until you reset the App in that browser, clear your browser’s site data, or your browser or device removes it. Deleting a contact in the App removes it from your contact list, but the underlying record may remain in your browser’s storage until you reset the App. Deleting or resetting data in the App does not delete backup and sync copies in your Google Drive, Google Sheets, downloaded files, or other devices; those copies remain until you or the holder deletes them. Restoring an older backup can bring back older information.

Because Your Content is stored locally on your device rather than on our servers, you maintain physical control over it. For important information regarding local data volatility, your responsibility to maintain independent backups, and our limitations of liability regarding lost data, please review Section 10 of the Terms, “Storage, Synchronization, Backups and Security”.

We do not keep a copy of Your Content on our servers after a sync, backup, restore, Google Sheets operation, or scan is completed. We keep any Terms acceptance records, sign-up, sign-in, and security records, and support messages only for as long as needed to operate the Service and your Account, document your acceptance of the Terms, respond to requests, investigate abuse, and protect our legal rights. Our technical request and error logs are generally retained for 30 days, and certain administrative and security audit records are retained for up to 400 days. Our Service Providers, including Google, may retain information under their own retention schedules. We may retain limited information for as long as necessary and permitted by law to comply with legal obligations, establish, exercise or defend legal claims, prevent fraud or abuse, or document our response to a request. We cannot delete data stored in your browser on a device we do not control or files in your Google account, and because we do not store Your Content, we cannot recover lost records. When you close your Account or request deletion of your Personal Information under Section 15, we delete your Account profile information within 30 days, except for limited records we retain to document your acceptance of the Terms, comply with legal obligations, or maintain security and audit logs as described above.

15. Your Privacy Choices and Requests

In the App, you can edit and delete contacts, export or back up your records, reset the App in your browser, and sign out. You can revoke the App’s access to your Google account at any time at https://myaccount.google.com/permissions. To request access to or a copy of Personal Information we hold about you, or to ask us to correct or delete it, email privacy@persimo.ai and describe your request. Please do not send passwords, sign-in tokens, or other people’s records unless we ask for a specific item. We will respond within the time required by applicable law (for example, 45 days under California law or one month under the GDPR). If we need to verify your identity, we will ask only for the information needed to do so. You may appeal a denial by replying with “Privacy Appeal” in the subject line. We will respond to your appeal within the timeframe required by law (such as 60 days under Virginia law), and if we deny your appeal, we will tell you how to contact the relevant regulator, such as the state’s Attorney General, to submit a complaint. Where permitted by law, an authorized agent may submit a request on your behalf, and we may require proof of the agent’s authority and confirm the request with you directly. We will not discriminate against you for exercising your privacy rights. Requests concerning information that a Service user holds about you are addressed in Section 6.

16. Children

You must be at least 18 years old to use the Service. The Service is not directed to children, and we do not knowingly collect Personal Information from children under 13 or from anyone under 18 as a user of the Service. We do not knowingly allow anyone under 18 to create an Account. If you believe someone under 18 is using the Service, email privacy@persimo.ai. If we learn that someone under 18 has used the Service, we will disable their access and promptly delete any related Personal Information we hold in accordance with Section 14 and applicable law. You may save information about a child in Your Content, such as a name, birthday, or allergy. Doing so does not make the child a user of the Service, and you are responsible for having the right to keep that information.

17. International Transfers

The Service is operated from the United States. Your Content stays in your browser on your device unless you use a feature that transmits it (such as synchronization, backup, restore, Google Sheets import or export, or scanning) or choose to include it in a support request. When Personal Information leaves your device, including your Account information, Usage Data, and any portion of Your Content that is transiently transmitted through those features, it is processed in the United States and may be processed in other countries where our Service Providers (including Google, Cloudflare, and Hostinger) operate. Data protection laws in these countries may differ from the laws in your country.

When Personal Information is transferred from the European Economic Area, the United Kingdom, or Switzerland to the United States or another country, we rely on legally recognized transfer mechanisms:

Transfers from You to Us: We do not currently participate in the EU-U.S. Data Privacy Framework. When you use the Service from outside the United States, your Account information, support communications, and Usage Data are transmitted directly to us in the United States as necessary to provide the Service to you under the Terms. Where data protection laws require a transfer mechanism for the Personal Information in Your Content that we process on your behalf, our Data Processing Terms (see Paragraph 10 of Annex A to the Terms) incorporate the European Commission’s Standard Contractual Clauses (and their UK and Swiss equivalents). If we become certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) in the future, we may also rely on that framework.

Transfers to Our Service Providers: For onward transfers to our Service Providers, we rely on their binding data processing agreements, which incorporate Standard Contractual Clauses and, where applicable (such as with Google and Cloudflare), the provider’s certification under the EU-U.S. Data Privacy Framework.

18. Europe, Switzerland and the United Kingdom

This Section applies if the data protection laws of the European Economic Area, Switzerland or the United Kingdom apply to our processing of your Personal Information. You may request access to, correction, deletion, restriction, or a copy of your Personal Information, and you may object to processing based on our legitimate interests. You may withdraw consent at any time without affecting prior processing. You may also lodge a complaint with your local data protection authority: in the European Economic Area, a list of authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en; in the United Kingdom, this is the Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/); and in Switzerland, this is the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/). To submit a request, see Section 15. Our legal bases are described in Section 5. We do not make decisions based solely on automated processing that produce legal or similarly significant effects. When we process Your Content to sync, back up, import, export, or scan it at your request, we do so on your behalf under the Data Processing Terms and do not use it to build our own database of individuals. International transfers are described in Section 17.

19. California and Similar United States State Laws

This Section applies to residents of California and other U.S. states with comprehensive privacy laws, to the extent those laws apply to us. In this Section, “sell” and “share” have the meanings given in the California Consumer Privacy Act; “share” means disclosing personal information for cross-context behavioral advertising and does not refer to files you share from your Google account.

In the past 12 months, we have collected (or, where noted below, may collect) the following categories of Personal Information:

(a) identifiers, such as name, email address, Google account identifier, IP address and sign-in Cookie, received by Google, Cloudflare and Hostinger as relevant to the request;

(b) customer records, such as names, email addresses, phone numbers, notes and similar contact details you save, received by Google and Cloudflare when you sync, back up, restore, use Google Sheets or scan;

(c) commercial information, none currently, or, if paid plans are offered, payment confirmation details received by the payment processor;

(d) internet or network activity, such as request time, web address requested, browser type, response status, error details and Google Analytics data, received by Google and Cloudflare for the App and Hostinger for the Website;

(e) professional information, such as company, title and similar details you enter, received by Google and Cloudflare when you sync, back up, restore, use Google Sheets or scan;

(f) visual information, such as business card images and PDFs you scan and card images included in backups, received by Google and Cloudflare for scanning and Google Drive backups;

(g) Sensitive Personal Information (if you choose to include any in Your Content), received by Google and Cloudflare when you sync, back up, restore, use Google Sheets, or scan (and by Hostinger and Google if you include it in an email to us); and

(h) approximate location, such as locations you enter and approximate location inferred from an IP address, received by Google and Cloudflare.

We collect these categories of Personal Information from the sources described in Section 4 (you, your browser and device, and your Google account when you sign in or connect files) and use and disclose them for the business and commercial purposes described in Sections 5 and 8.

We do not sell Personal Information or share it for cross-context behavioral advertising, and we do not disclose Personal Information to third parties for their own direct marketing purposes. We honor Global Privacy Control signals as described in Section 9. We use Sensitive Personal Information only to provide and secure the Service and to comply with law, and not to infer characteristics about you or anyone else. Depending on your state, you may have the right to know, access, correct, delete, and obtain a copy of your Personal Information, to appeal a denial, and not to be discriminated against for exercising these rights. To submit a request, see Section 15. To the extent you are a covered business under these laws and store information in Your Content, we process that information as your service provider under the Data Processing Terms.

20. Links to Other Sites

The Service, and records you save, may contain links to third-party websites. Those websites are governed by their own terms and privacy policies, and we are not responsible for their content or practices.

21. Changes to This Privacy Policy

We will post any revised Privacy Policy at https://persimo.ai/privacy and update the “Last Updated” date. If we make a material change to how we use Personal Information, we will notify you by email or in the App at least 30 days before the change takes effect, unless the change is required by law or addresses a security risk, in which case it may take effect sooner, and we will obtain your consent before any new use that requires it. If the Terms and this Privacy Policy conflict regarding information practices, this Privacy Policy controls, except that the Data Processing Terms control for Customer Personal Data as stated in Annex A to the Terms.

22. Contact

Inquiries regarding this Privacy Policy should be sent to Ingengo LLC by email at privacy@persimo.ai or by mail to Ingengo LLC, 418 Broadway, STE R, Albany, NY 12207, United States.