Privacy Policy

The Services are owned and operated by Apistride Private Limited, an Indian private limited company (CIN: U62011KL2025PTC097423). Perslace is a product and brand of Apistride Private Limited.

Our registered office is Edakkat House, Chirakandi Parambu, Tiruvannur, Kozhikode 673029, Kerala, India. Our data protection contact is [email protected].

This policy applies to personal information relating to:

• visitors to perslace.com and related Perslace pages;
• customers, prospective customers, subscribers, event participants, and their representatives;
• authorised users of Perslace accounts, including administrators, managers, approvers, finance personnel, employees, contractors, sales representatives, brokers, and affiliates;
• people who contact us for demos, support, security, billing, or other business purposes; and
• people whose information a customer submits or connects to the Services.

It does not apply to a third party's independent practices, including a customer's own employment, compensation, payroll, or performance-management decisions.

If your organisation provided your data through Perslace and you have a question about its business use, contact your organisation first. We support customers in responding to valid privacy requests as required by our agreements and applicable law.

We collect personal information:

• directly from you when you visit our website, request a demo, communicate with us, or use an account;
• from your employer, contracting organisation, customer administrators, managers, or other authorised users;
• from files, databases, APIs, CRM, ERP, finance, payroll, collaboration, and other systems that a customer chooses to connect;
• automatically from browsers, devices, network requests, application activity, and security events; and
• from referrals, events, public business sources, and business partners where permitted by law.

If we obtain information indirectly, the customer or other source is responsible for having authority to provide it and for giving any notice required for its own processing.

• provide, configure, operate, maintain, and support the Services;
• manage identities, accounts, permissions, organisations, and customer relationships;
• receive customer-authorised data and perform calculations, reporting, approval, dispute, forecasting, notification, integration, and export workflows;
• prepare compensation outputs for authorised customer use; Perslace does not execute salary or bank payments;
• respond to enquiries, schedule demos, provide onboarding and support, and send service communications;
• invoice customers, manage subscriptions, and maintain business and accounting records;
• monitor reliability, diagnose faults, protect accounts, prevent abuse, investigate incidents, and maintain auditability;
• understand and improve service performance using aggregated or effectively anonymised information;
• send permitted product news, newsletters, and B2B marketing, subject to your choices; and
• comply with law, enforce agreements, and establish, exercise, or defend legal claims.

Where the GDPR, UK GDPR, or another law requires a legal basis, we rely on the bases below. The appropriate basis depends on the context and your relationship with us.

When we act only as a processor, the customer determines the legal basis for processing Customer Data. Where other privacy law applies, we process personal information with consent or another permitted lawful ground.

"Customer Data" means information submitted to, generated within, or connected to the Services by or for a customer. We process Customer Data to provide the customer-configured Services, follow documented instructions, protect the platform, and meet applicable legal obligations.

• We do not use identifiable Customer Data for unrelated purposes.
• We do not combine identifiable Customer Data across customers for benchmarking or general product development.
• We do not use Customer Data to train general-purpose AI or machine-learning models.
• Customers control users, roles, plans, fields, workflows, integrations, exports, and business-data retention, subject to their agreement.
• Authorised users may export information to finance, payroll, or other customer systems; the customer controls those recipients and subsequent uses.

Perslace may provide forecasts, performance comparisons, anomaly detection, recommendations, or limited AI-assisted insights. These features may analyse configured performance and compensation data and may constitute profiling under some laws.

Where applicable, you may ask the relevant customer for information about a decision, request human review, provide your point of view, or contest the outcome. We assist customers with such requests as required by law and contract.

We may disclose personal information only as reasonably necessary to:

• the customer that controls the relevant account and its authorised administrators and users;
• hosting, database, storage, security, communications, form, analytics, support, and other service providers acting under contract;
• integration providers and downstream systems that a customer or user chooses to enable;
• professional advisers, auditors, insurers, lenders, and financing partners subject to appropriate duties;
• courts, regulators, law enforcement, and public authorities when disclosure is required or permitted by law; and
• a buyer, investor, successor, or counterparty in a merger, financing, restructuring, acquisition, or sale, subject to appropriate confidentiality and privacy protections.

We do not sell personal information for money. When you permit optional advertising technologies, disclosures to advertising providers may be treated as a sale or sharing under some privacy laws. You can reject Marketing in Cookie Settings, and we keep Marketing off when your browser sends Global Privacy Control.

Depending on the Services and customer configuration, providers may support cloud hosting and storage, transactional email, security, public forms, marketing communications, consented analytics, and customer-selected integrations. These include AWS for the production platform, Amazon SES for service email, Microsoft Teams for authorised notifications, Brevo for permitted marketing, Formspark and Cloudflare Turnstile for website forms and abuse prevention, Google Analytics 4, Microsoft Clarity, and Cloudflare Web Analytics for consented website analytics, and LinkedIn for consented campaign measurement and advertising.

A customer may also connect CRM, ERP, finance, payroll, collaboration, or other third-party systems. Data sent to a customer-selected integration is governed by the customer's configuration and the provider's terms and privacy practices. Our customer agreements and data processing terms govern subprocessor use and any applicable change-notice process. Contact [email protected] for current subprocessor information relevant to your service.

The primary Perslace production environment is hosted in AWS Europe in Frankfurt, Germany (eu-central-1). Some service providers, customer-selected integrations, and authorised support activities may process or access limited personal information from other countries.

Where personal information is transferred from the EEA, United Kingdom, Switzerland, or another jurisdiction that restricts transfers, we use an approved legal mechanism where required, such as an adequacy decision, standard contractual clauses, the UK International Data Transfer Addendum or Agreement, and supplementary safeguards appropriate to the transfer. You may contact us for information about the safeguards applicable to a transfer.

We keep personal information only for as long as reasonably necessary for the stated purpose, our contract, customer instructions, security and continuity needs, and legal or accounting obligations. We also consider the sensitivity, volume, risk, and whether the purpose can be achieved with aggregated or anonymised information.

We may retain a limited record longer when required for an active security investigation, legal hold, dispute, or legal obligation. When retention ends, information is deleted, anonymised, or isolated until secure deletion is possible.

We use technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Measures include, as appropriate, role-based access restrictions, logical tenant and environment separation, encryption, logging and monitoring, authentication controls, vulnerability and incident management, and backup and recovery procedures.

• Production Customer Data is hosted in the AWS Frankfurt region.
• Development and demo environments are logically separated and use synthetic data rather than production copies.
• Application, authentication, security, and administrative events are logged with restricted access.
• Production databases use encrypted daily backups and point-in-time recovery with a 35-day backup lifecycle.
• Controlled restores reapply deletion records before a restored environment returns to production.

No system is completely secure. You are responsible for protecting account credentials, using authorised devices, and promptly reporting suspected misuse or vulnerabilities to [email protected].

Depending on your location, our role, and applicable law, you may have the right to:

• request access to and a copy of personal information;
• correct inaccurate or incomplete information;
• request deletion or erasure;
• restrict, object to, or opt out of certain processing;
• receive portable information or ask for it to be transferred where technically feasible;
• withdraw consent without affecting earlier lawful processing;
• opt out of marketing at any time;
• request information about and human review of certain automated decisions;
• use an authorised agent or nominate another person where applicable; and
• appeal our response or complain to an appropriate privacy or data-protection authority.

Submit a request to [email protected]. We may verify your identity and authority, ask for information needed to locate the record, and apply lawful exemptions. We will not discriminate against you for exercising a privacy right.

If your request concerns Customer Data, please identify the customer organisation. Because that customer is normally the controller, we may refer the request to it or act on its instructions.

EEA, United Kingdom, and Switzerland

You may have rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and protection relating to solely automated decisions. You may complain to the supervisory authority where you live or work, or where you believe an infringement occurred. When we rely on legitimate interests, you may ask for information about our balancing assessment. Your right to object to direct marketing is unconditional.

India

Where Indian data-protection law applies and the relevant provisions are in force, you may have rights to information about processing, correction and erasure, grievance redressal, and nomination, subject to applicable conditions. You may first raise a grievance with our data protection contact and, where available, use the statutory complaint process.

United States

If a US state privacy law applies to us and to your information, you may have rights to know, access, correct, delete, and obtain a portable copy, and to opt out of sale, targeted advertising, sharing, or certain profiling. Consented advertising disclosures may constitute a sale or sharing under those laws; use Cookie Settings or Global Privacy Control to opt out. We do not use sensitive personal information to infer characteristics about consumers.

The categories described in Section 4 are the categories we may have collected and disclosed for business purposes during the preceding 12 months. Recipients are described in Sections 10 and 11. We honour legally recognised opt-out preference signals, such as Global Privacy Control, where required. Browser "Do Not Track" signals are not consistently defined across the industry and may not receive a separate response where no legal standard applies.

We use necessary technologies to deliver, secure, and operate our website and Services. Google Analytics 4, Microsoft Clarity, and Cloudflare Web Analytics load only after you allow Analytics. Marketing technologies additionally require Marketing consent. You can withdraw consent at any time using Cookie Settings in the footer. Our Cookie Policy explains the technologies, durations, and controls.

Google Analytics measures website visits and navigation. Microsoft Clarity provides heatmaps and session recordings of interactions such as clicks and scrolling to help us improve the website. These services process page URLs, browser and device information, interaction events, and pseudonymous identifiers. Our GA4–Clarity integration uses visitor and session identifiers to relate analytics activity to recordings. Cloudflare Web Analytics is a separate, privacy-first page-view count from Cloudflare, Inc. Cloudflare’s RUM beacon documentation says the script does not store data in the browser or access cookies or localStorage, and that the IP address is discarded at the edge and is not stored. We mark our contact form for content masking and exclude submitted contact details from our custom analytics events. Please avoid placing personal or confidential information in website URLs. Read Cloudflare’s description of the Web Analytics beacon.

Microsoft receives data through Clarity and may use it to provide and improve its services, support security, and provide Microsoft Advertising, subject to applicable consent signals. Read the Microsoft Privacy Statement for its practices. LinkedIn may process website visits and identifiers for campaign measurement and advertising after Marketing consent; see the LinkedIn Privacy Policy. These providers may process information internationally as described in Section 12.

You may unsubscribe from marketing emails using the link in the message or by contacting us. Even after opting out, you may continue to receive non-marketing service, security, billing, or legal communications. We may retain a minimal suppression record so we can honour your choice.

Perslace is an organisation-controlled B2B service intended for business users aged 18 or over. It is not directed to children or consumers, does not permit unrestricted public registration, and does not knowingly collect children's personal information. Contact us if you believe a child's information has been submitted contrary to these restrictions.

The Services may link to or integrate with third-party websites and services. A third party acting for its own purposes is responsible for its privacy and security practices. Review its terms and privacy notice before providing information or enabling an integration. This policy does not govern a customer's independent use of exported data or a third party's independent processing.

We may update this policy to reflect changes in the Services, our practices, providers, or legal obligations. We will post the revised version here and change the "Last updated" date. If a change is material, we will provide additional notice where appropriate, such as through the Services or by email. Earlier versions may be requested from our data protection contact.