Perisso Privacy Policy

Effective Date: August 28, 2026

Last Updated: August 28, 2026

The Short Version

This summary is provided for convenience. It is not a substitute for the full policy below, which governs.

 ‍

• We do not sell your information. We do not sell or share personal information, and we do not use it for advertising.Your business records stay yours.
• Your business records stay yours. The data you put into Perisso belongs to you. We use it only to provide the Services to you, never for our own purposes, and you can export it at any time.A person approves consequential actions.
• A person approves consequential actions. We use AI to draft correspondence, summarize accounts, and prepare documents —but actions that are hard to reverse, including releasing an unconditional lien waiver, changing payment terms, and escalating to legal, always require a person to approve them.

Questions or privacy requests: privacy@perisso.com.

1. Who We Are and What This Policy Covers

Perisso, LLC ("Perisso,""we," "us") is a California limited liability company that provides a business-to-business accounts receivable and revenue cycle management platform, delivered through our website at perisso.com and our mobile applications for iOS and Android (together, the "Services").

This policy explains how we handle personal information in connection with the Services. It applies to visitors to our website, individuals who create an account, and individuals whose information appears in data our customers submit to the platform.

Two different roles. This distinction matters throughout this policy:

• Account Data. When you create an account, contact us, or use the Services, we act as the business (or controller) with respect to your personal information. We decide how it is used, and this policy governs it.
• Account Data. When you create an account, contact us, or use the Services, we act as the business (or controller) with respect to your personal information. We decide how it is used, and this policy governs it.
• Customer Data. Our customers upload or connect business records — invoices, payment applications, lien waivers, contact details for their own clients and vendors, and related financial information. Some of that constitutes personal information about third parties. With respect to Customer Data, we act as a service provider (or processor) on our customer's behalf. We process it only to provide the Services under our agreement with that customer, and we do not use it for our own purposes. If your information appears in Customer Data and you want it corrected or deleted, contact the business that submitted it; we will assist them in responding.

• Account and profile information: name,business email address, phone number, job title, company name, and password credentials.
• ‍Business and billing information: company legal name, address, tax identification information, subscription tier,and billing contact. Payment card and bank account details are collected and processed directly by our payment processor; we receive only limited information such as the last four digits, card brand, and expiration date. We do not store full payment card numbers.
• Support and communications: the content of emails, support tickets, and other messages you send us.
• Customer Data you submit: invoices, payment applications, contracts, change orders, preliminary notices, lien waivers, aging reports, correspondence, and associated contact and payment information for your customers and vendors.

2. Information We Collect

2.1 Information you provide

• Account and profile information: name, business email address, phone number, job title, company name, and password credentials.
• Business and billing information: company legal name, address, tax identification information, subscription tier, and billing contact. Payment card and bank account details are collected and processed directly by our payment processor; we receive only limited information such as the last four digits, card brand, and expiration date. We do not store full payment card numbers.
• Support and communications: the content of emails, support tickets, and other messages you send us.
• Customer Data you submit: invoices, payment applications, contracts, change orders, preliminary notices, lien waivers, aging reports, correspondence, and associated contact and payment information for your customers and vendors.

2.2 Information from connected services

At your direction, the Services connect to third-party systems you already use. When you authorize a connection, we receive data from that system. Depending on which integrations you enable, this may include accounting and ERP records, project and purchase order data, banking or payment status information, and calendar or email content relevant to collections activity.

You control these connections and can revoke them at any time in your account settings or in the third-party system.

2.3 Information collected automatically

• Device and technical information: device model, operating system version, unique device or installation identifier, app version, language, time zone, and IP address.
• Usage information: features accessed, actions taken, timestamps, and session duration.
• Diagnostic information: crash reports, error logs, and performance data.

2.4 Device permissions

The mobile applications may request the following permissions. Each is optional, and declining will limit only the related feature:

• Camera and photo library — to capture and attach documents, receipts, and job site photos to records.
• Files and storage — to upload and download documents.
• Push notifications — to alert you to payment events, approvals awaiting your action, and deadline reminders.

The Services do not request or use location data.

2.5 Information we do not collect

We do not collect health information, biometric identifiers, or geolocation of any kind, precise or approximate. We do not knowingly collect information about children.

We do not request or require Social Security numbers or other government identification numbers, and the Services contain no field designed to capture them. Documents that users choose to upload — such as tax forms — may contain identification numbers. We do not extract, index, or use that information; it is stored as part of the document and handled under the same protections as all other Customer Data.

3. How We Use Information

We use Account Data to:

• Provide, operate, secure, and maintain the Services
• Create and administer accounts and authenticate users
• Process subscription payments and send billing communications
• Provide customer support and respond to inquiries
• Send service and security notices, and — where permitted — product updates and marketing communications you can opt out of
• Monitor for fraud, abuse, and unauthorized access
• Analyze aggregate usage to improve and develop the Services
• Comply with legal obligations and enforce our agreements

• ‍Human review of consequential actions. Actions that are difficult or impossible to reverse — including the release of unconditional lien waivers, concessions to payment terms, and escalation to lien or legal proceedings — require explicit approval by an authorized user before they take effect. The system does not take these actions on its own.Where AI processing occurs.
• Where AI processing occurs. AI features are delivered through our cloud infrastructure provider. Customer Data processed by these features is handled under contractual restrictions and is not made available to any provider for its own use.Training and retention.
• Training and retention. Our agreements with the providers that deliver these features restrict them to processing data on our behalf, and prohibit use of Customer Data for their own purposes.
• ‍Your controls. AI processing is integral to the Services and cannot be disabled without rendering them non-functional. Customers do control how it is used: who holds approval authority, which users may act on AI-generated output, and the review of any document or communication before it is released. AI-generated content is presented for review, never sent or executed on its own.

• ‍Service providers. We use vendors to host infrastructure and process data, handle subscription payments, deliver email, provide analytics and error monitoring, and support our customers. They are contractually restricted to using the information only to perform servicesfor us. A list of our subprocessors is available on request at privacy@perisso.com.At your direction.
• At your direction. When you connect a third-party system or send a document through the Services, we transmit information as you instruct.Within your organization.
• Within your organization. Account administrators can access, manage, and export data associated with your organization's account, including records associated with individual users.Legal and safety.
• Legal and safety. We may disclose information where required by law, subpoena, or legal process; to protect our rights, property, or safety, or that of our users or the public; or to investigate suspected fraud or violations of our agreements.Business transfers.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, information may be transferred as part of the transaction. We will provide notice before your information becomes subject to a materially different privacy policy.

We process Customer Data solely to deliver the Services as instructed by the customer, including generating and tracking invoices and payment applications, preparing statutory notices and waiver documents, monitoring aging and payment status, and producing reports.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding twelve months.

4. Artificial Intelligence and Automated Processing

The Services use artificial intelligence to assist with accounts receivable workflows — for example, drafting collections correspondence, summarizing account status, flagging aging risk, and preparing documents for review.

We do not use automated processing to make decisions producing legal or similarly significant effects about individuals without human involvement.

5. How We Disclose Information

We disclose personal information in thefollowing circumstances:

• Know what personal information we collect, use, and disclose, and to request a copy in a portable formatDelete
• Delete personal information we have collected, subject to legal exceptionsCorrect
• Correct inaccurate personal informationOpt out
• Opt out of the sale or sharing of personal information — we do not sell or share personal informationLimit
• Limit the use of sensitive personal information — we do not use sensitive personal information for purposes requiring this rightNon-discrimination
• Non-discrimination for exercising these rights

6. Data Retention

We retain Account Data for as long as your account is active and for 90 days after termination, after which we delete or de-identify it. Billing and transaction records are retained for seven years to meet tax and accounting requirements.

Customer Data is retained according to the terms of our agreement with the customer. Following termination, we make Customer Data available for export for 60 days, then delete it within 30 days after that period ends. Backup copies are purged on our standard backup cycle, currently 35 days, after which deletion is complete across all systems.

Records related to lien waivers, preliminary notices, and payment applications may carry statutory retention obligations for our customers; customers are responsible for exporting records they are required to maintain.

7. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit and at rest, role-based access controls, multi-factor authentication required for all user accounts, audit logging of user actions, monitoring for unauthorized access, and periodic review of our security practices.

No system is completely secure. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law.

Our infrastructure is hosted with major cloud providers, and we rely on their physical and environmental security controls for the underlying facilities.

8. Your Privacy Rights

8.1 California residents

Under the California Consumer Privacy Act, as amended, California residents have the right to:

Note that California law protects personal information collected in a business-to-business context on the same terms as other personal information. Business contacts whose details appear in our Services have these rights.

To exercise a right, contact us at privacy@perisso.com. We will verify your request by confirming that you control the email address associated with your account or, if you do not have an account, by asking you to confirm the email address at which we contact you. We may request additional information where reasonably necessary to verify your identity. You may use an authorized agent to submit a request on your behalf; we will require the agent's written permission from you and may verify your identity directly.

Categories collected in the past twelve months: identifiers; commercial information; financial information; internet or network activity; professional or employment-related information; and inferences drawn from the foregoing. The sources, purposes, and recipients for each are described in Sections 2, 3, and 5.

8.2 Individuals outside the United States

We design our privacy practices to a common standard regardless of where our users are located. Where the General Data Protection Regulation, the UK GDPR, Swiss data protection law, or comparable legislation in other jurisdictions applies to our processing of your personal information, you have the rights described below.

Your rights: 

‍

• ‍‍Access to the personal information we hold about you;
• correction of inaccurateinformation;
• erasure;
• restriction of processing; portability in amachine-readable format;
• objection to processing based on our legitimate interests;
• withdrawal of consent where processing is based on consent;
• and theright to lodge a complaint with your local supervisory authority.

Our lawful bases for processing. We rely on:

• Performance of a contract — to provide the Services, administer accounts, and process payments
• Legitimate interests — to secure the Services, prevent fraud and abuse, and improve and develop our platform, balanced against your rights and freedoms
• Compliance with legal obligations — to meet tax, accounting, and regulatory requirements
• Consent — where required, such as for certain marketing communications, which you may withdraw at any time

Where we process Customer Data on behalf of a business customer, that customer determines the purposes and means of processing and is the controller; we act as processor under our agreement with them.

International transfers. Personal information is transferred to and processed in the United States and, for certain operations, in other regions. Where required, we rely on Standard Contractual Clauses approved by the European Commission and the UK equivalent, together with supplementary measures appropriate to the transfer.

Exercising your rights. Contact privacy@perisso.com. We respond within one month of receipt, extendable by two further months for complex requests, and will tell you if an extension applies. There is no charge for a reasonable request.

8.3 Other jurisdictions

Data protection laws in other regions, including the Middle East and Asia-Pacific, may grant you additional or different rights. We will honor rights granted to you under applicable law. Contact us at privacy@perisso.com and we will respond in accordance with the law that applies to you.

8.4 Do Not Track and Global Privacy Control

We do not sell or share personal information, and we do not track users across third-party websites or applications. As a result, there is no sale or sharing for an opt-out signal to apply to.

Where our website receives a Global Privacy Control signal from a visitor's browser, we treat it as a valid request to opt out of any sale or sharing of personal information and honor it accordingly.

Browsers may also send "Do Not Track" signals. Because no common industry standard has been established for how to interpret them, we do not respond to Do Not Track signals. Our practices do not change based on whether one is sent.

9. Account Deletion

Individual accounts. Accounts are created through our web platform, not in the mobile applications; the mobile applications provide sign-in to an existing account only. You may delete your account at any time [Settings → Account → Delete Account at app.perisso.com], or by emailing privacy@perisso.com. Deletion removes your profile and authentication credentials and revokes your access to the Services. If your account belongs to an organization, deleting it does not delete that organization's records, which remain under the organization's control.

Organization accounts. An authorized administrator may request closure of an organizationaccount and deletion of its Customer Data by submitting a written request to privacy@perisso.com. Data is handled following closure as described in Section 6.

Deletion and your agreement areseparate. Deleting an account removes access andpersonal information; it does not terminate your subscription agreement or any payment obligation under it. Subscription term, renewal, cancellation, and fees are governed by your agreement with us, not by this policy.

We may retain limited information where necessary to perform our agreement with you, to comply with legal, tax, or accounting obligations, to detect and prevent fraud, or to establish or defend legal claims. We may also retain de-identified or aggregated data that cannot reasonably be used to identify you.

10. Children's Privacy

The Services are business tools intended solely for use by individuals aged 18 and over acting in a commercial capacity. We do not direct the Services to children and do not knowingly collect personal information from anyone under 18. If we learn we have done so, we will delete it.

11. International Data Transfers

Our primary data storage is located in the United States. Certain processing operations, including AI-assisted features, may be routed across regions for availability and performance, which means information may be processed outside the United States.

Wherever processing occurs, the same contractual protections and security controls apply, and information is handled in accordance with this policy.

12. Changes to This Policy

We may update this policy. We will post the revised version with an updated Effective Date and, for material changes, provide notice by email or in-app notification before the change takes effect. Your continued use after the effective date constitutes acceptance.

13. Contact Us

Email: privacy@perisso.com

‍