Privacy Policy

Version: 12 November 2026

1. Who we are and what this policy covers

Performance Hub Inc ("Performance Hub", "we", "us") provides software, connected hardware, cloud recording, AI, agents and related services. This policy explains how we handle personal information in connection with our websites, accounts, business relationships and services.

Our address is 251 Little Falls Drive, Wilmington, DE 19808, United States. Our telephone number is +1 (302) 244-5288. The preferred contact route is Performance Hub Support. Mark privacy questions or requests for the Privacy Contact. You may also contact us by post or telephone; you do not need a Performance Hub account to contact us about privacy.

This policy should be read with our Cookie Policy and Biometric Data Policy. Our Data Processing Addendum governs personal information we process on a customer's behalf. Accepting service terms is not, by itself, consent to every use of personal information described here. This policy is a notice of our practices. It does not itself create additional contractual warranties, a service-level commitment or a security guarantee beyond the applicable agreement and law. This clarification does not limit our duties or any responsibility for privacy representations under applicable law.

2. Our role and the customer's role

We determine the purposes and means of processing information used to administer our business, manage accounts and purchases, communicate with contacts, maintain our websites, and protect our own services. For that processing, we act as a controller or the corresponding responsible organisation under applicable law.

Customers either determine the purposes of their surveillance, recording, identity matching, connected sources, agents and other configured workloads, or act as authorised processors for the organisation that determines those purposes. Where we process personal information under those instructions, we act as a processor, subprocessor, service provider or equivalent, as applicable. This includes relevant recordings, audio, biometric templates, transcripts, search data, prompts, agent context and outputs. The actual activities and applicable law determine each party's role.

The responsible customer or controller's privacy notice explains its purposes and choices, including whom it records, what it searches, how it uses results and which people can access them. Contact that organisation about information it controls. If you contact us, we will handle the request according to our role and applicable duties, including directing it to the responsible customer or assisting that customer where required. Our customers' responsibilities do not remove our own obligations.

3. Information handled through our services

The information involved depends on the relationship, purchased features and deployment configuration.

Recordings, conversations, documents and AI context can contain sensitive information about health, identity, beliefs, employment or other personal circumstances. Biometric information can remain personal information even if it has no name attached. Our Biometric Data Policy gives additional information about that processing.

We obtain information from individuals, customer administrators and users, connected devices, configured integrations and sources, service interactions and the providers involved in delivering the selected service. Outputs and derived records can also contain personal information or inferences. An AI-generated inference is not necessarily accurate.

Information necessary to administer an account, fulfil an order or meet a legal obligation must be provided for that purpose. Without it, we may be unable to provide the relevant service or complete the transaction.

4. Purposes and legal grounds

For information we control, we use the following purposes and, where the GDPR or UK GDPR requires a legal basis, the corresponding grounds:

We assess legitimate interests against the rights and interests of affected individuals. Where consent is required, we obtain it through the relevant choice or collection process; it can be withdrawn as described below. If additional conditions apply to sensitive information, the necessary condition must also be met.

For information controlled by a customer or its controller, that controller determines the lawful purposes and grounds. We process that information under the applicable agreement, authorised instructions and DPA. Product improvement does not create a general permission for independent model training using that information. Any additional use requires the authority and legal basis required by the agreement and applicable law.

5. Models, agents and deployment locations

The enabled models, agents, tools and connected sources determine what information a workload uses and where it is sent. Inputs include material retrieved automatically under the configuration, such as recordings, transcripts, files or search results. Results can be stored in conversations, memory or other enabled destinations.

On-premises inference and AI deployments are currently available under enterprise arrangements. If an on-premises agent uses an on-premises model on the same local network, that inference path remains on that network. If only on-premises inference models are enabled, an unavailable local model does not cause fallback to a disabled cloud model.

A cloud agent using an on-premises model sends information between the agent's cloud region and the on-premises hardware. Separately enabled cloud recording, integrations, exports, management functions and support have their own data flows. Selecting an on-premises model does not itself make those activities local. Enterprise processing boundaries are recorded in the applicable deployment arrangements.

Our staff's remote support access must be initiated and authorised by the customer. Information supplied in a support request and authorised support access are handled for that support purpose. Automated operation or management included in a deployment is distinct from staff remote support.

The model developer, hosting operator and execution location can differ. Provider retention and permitted processing depend on the selected service, configuration and applicable processing arrangements. Enabling a model does not grant a general permission for unrelated use of personal information. Providers we appoint to process information on a customer's behalf remain subject to our applicable DPA obligations.

6. Who receives information

Access and disclosure are linked to the relevant purpose:

• Customer organisations and authorised users: administrators and users receive information according to the service's permissions and the organisation's configuration.
• Service providers: providers performing functions such as hosting, storage, communications, payment processing, delivery, support and security receive the information needed for their work, under the applicable arrangements.
• Selected models and connected services: information is sent to the models, tools, integrations and destinations enabled for a workload. Where a customer contracts independently with another service, that service's handling is also governed by its own relationship with the customer. Where we appoint a subprocessor, our DPA obligations apply.
• Professional advisers and authorities: information is disclosed where necessary for advice, legal obligations, lawful requests or the establishment, exercise or defence of rights, subject to applicable law.
• Business transactions: information relevant to a proposed or completed reorganisation, financing or business transfer is handled subject to applicable confidentiality, privacy and legal requirements.

Request information about the subprocessors and transfer arrangements relevant to a service through support. Customer-directed exports and independently controlled copies must also be addressed by that customer's notices and controls.

7. International processing

Performance Hub is based in the United States. Processing locations also depend on the service infrastructure, enabled providers, customer premises, agents and connected services. Selecting a cloud region describes that component; it does not by itself determine the location of every recipient or processing activity.

Where law restricts an international transfer, the transfer must have an applicable legal mechanism and safeguards. These can include an adequacy determination, approved contractual terms with any required assessments or supplementary measures, or another legally permitted basis. An enterprise routing choice or customer instruction does not itself replace those requirements. Contact the Privacy Contact for information about the safeguards applicable to your information and a copy where the law provides for one, subject to lawful redactions.

8. Retention and deletion

We retain information for the relevant purpose and applicable legal requirements. For information we control, the criteria include the duration of the account or business relationship, completion of the transaction or support matter, applicable financial-record duties, security investigation needs, limitation periods and lawful preservation requirements. We delete or anonymise information when it is no longer needed for a permitted purpose.

Customer-controlled content follows the applicable service settings, customer instructions, agreement and legal requirements. Recordings, transcripts, facial templates, indexes, agent memory, conversation history, logs and exports are distinct records. Removing a source or disabling a feature does not necessarily delete each associated record or a copy already exported elsewhere.

The DPA governs our applicable return and deletion duties. Backup handling follows the relevant retention and deletion arrangements; retained backup or legally preserved information is subject to appropriate restrictions. Mandatory biometric retention and destruction requirements take priority over general storage settings. Customers are responsible for copies in systems they independently control. Contact support for the retention or deletion information applicable to a particular service or category.

9. Security and user controls

We apply appropriate technical and organisational measures taking account of the processing and its risks, as required by applicable law and the relevant agreement. Security responsibilities for customer-controlled premises, devices, credentials, users and configurations are allocated in the service terms and deployment arrangements.

Authorised administrators should review permissions, model and integration access, retention settings and agent capabilities. Individuals should contact the responsible organisation if they believe their information is inaccurate or used outside the intended purpose.

10. Your rights and choices

Depending on applicable law and our role, rights can include access to or information about personal information; correction; deletion; restriction; objection; portability; withdrawal of consent; and information about, or safeguards concerning, qualifying automated decisions. Applicable US laws can also provide rights to opt out of sale, sharing or targeted advertising, limit certain uses of sensitive information, and appeal a refused request.

Customers can configure facial matching, agents and rules to support or trigger access-control decisions, alerts and other actions. These can affect entry to facilities or other interests. The criteria, significance and consequences depend on the deployment. Contact the responsible organisation for the required information about its processing and to exercise applicable rights to human review, express your view or challenge a decision. Where we are responsible for the relevant processing, address those requests to us. Our assistance duties for customer-controlled processing remain governed by the DPA and applicable law.

Exercise applicable rights using the privacy contact details above. Describe the information or processing concerned so we can identify the relevant records. We verify identity and authority where required and proportionate, including an authorised agent's authority where the law permits requests through an agent. We apply lawful exceptions and respond within the applicable legal period. Exercising a right does not result in unlawful discrimination.

Where we rely on consent, withdrawal does not affect earlier lawful processing. You can unsubscribe from marketing using the message's unsubscribe method or contact us; necessary service communications are handled separately. Browser and device choices, including legally recognised opt-out signals, are explained in the Cookie Policy. An absence of an opt-out signal is not consent where consent is required.

You may complain to the relevant privacy regulator, including your competent EEA authority, the UK Information Commissioner's Office, Australia's OAIC, New Zealand's Privacy Commissioner, Singapore's PDPC or Japan's PPC, as applicable. Contacting us does not restrict that right.

Where Japanese law requires additional information about retained personal data, including our corporate representative's name, applicable safeguards and request procedures, it is available through the Privacy Contact as required by that law.

11. Information about children

The platform is supplied for organisational use. Customer deployments can nevertheless involve children or information about them. The responsible customer must assess lawful collection, notices, permissions and safeguards for its deployment. An account-age restriction does not make recordings of children exempt from privacy law. Contact the Privacy Contact or the responsible organisation with a concern about a child's information.

12. Changes and contact

We update this policy when our processing or relevant requirements change and identify the applicable version. Where additional notice or a new choice is legally required, we provide it before the affected processing. A policy update does not override an agreed customer processing restriction or supply consent where consent is required.

Privacy Contact — Performance Hub Inc
Preferred route: Submit a support ticket
Post: 251 Little Falls Drive, Wilmington, DE 19808, United States
Telephone: +1 (302) 244-5288