Privacy Policy

Persistent Workforce is a sales and marketing hub for small service businesses, run by AI employees. To run the Service we process two categories of personal data: (1) data about you and your team, the account holders, and (2) data about your customers and leads that you keep in the Service or that reaches you through it. This policy explains what we collect, why, who we share it with, and how to exercise your rights.

Account data. When you sign up we collect your email, full name, and password (stored as a one-way hash by Supabase Auth — we never see your plaintext password).

Business profile and brand data. Information you choose to add — business name, service area, website, brand colors, logo, voice and tagline.

Customer and lead data. Names, emails, phone numbers, companies, notes, pipeline stages, invoices, form submissions, and the emails, texts and calls your AI employees send or receive for you. This data is yours; we process it on your behalf as a service provider.

Posts and content. The posts, graphics, articles, videos, forms and pages you and your AI employees create, and their publishing schedule.

Connected-account data. Tokens and account details for the accounts you connect, and what your AI employees read from them to do the work you ask for (section 5).

Billing data. When you subscribe, Stripe processes payment-card details directly. We receive only the customer ID, subscription status, plan, and period end. We do not store full card numbers.

Usage analytics. Page views, clicks, and feature interactions captured by PostHog with anonymized IP. We use this to understand which features matter and to fix bugs.

Server logs. Standard request metadata (IP, user agent, timestamp, URL) retained for security and debugging, typically up to 30 days.

• To provide, secure, and improve the Service.
• To process payments and prevent fraud.
• To send transactional email (welcome, billing, password reset, drip notifications you opt into).
• To respond to support requests.
• To enforce our Terms of Service.
• To meet legal obligations (e.g. tax records).

We do not sell your personal data, and we do not use Customer Content to train AI models that benefit other customers.

Customer Content is stored in Supabase(US region), encrypted at rest, and access-scoped using row-level security so that one customer cannot read another’s rows. File uploads (logos, photos, graphics, videos) live in Supabase Storage with the same access scoping.

The Service relies on these sub-processors:

Each sub-processor handles data under its own privacy commitments. We share with them only what is needed for them to perform their function — for example, Stripe receives billing data but never your customer notes. Connected platforms (Meta, LinkedIn, Google, TikTok, Slack, HubSpot) receive data only when you connect them and only for the work you approve.

Persistent Momentum and its affiliates. Persistent Workforce is a product of Persistent Momentum, LLC. Starting November 9, 2026, your account data and profile and brand data (section 1) may be shared with and used by Persistent Momentum, LLC and its affiliates (companies Persistent Momentum owns or controls, or that are under common ownership or control with it) for the purposes in section 2 and to tell you about their products where the law allows. This never includes customer and lead data or other Customer Content, data received from connected accounts (section 5), or mobile opt-in information (section 11). Where the law requires your consent before an affiliate contacts you for marketing, we ask first. You can opt out of this sharing at any time by emailing legal@persistentmomentum.com.

You can connect third-party accounts so your AI employees can work in them. Each connection asks you to approve specific permissions on the provider’s own sign-in screen. For every connected account we store: the OAuth access and refresh tokens, encrypted with AES-256-GCM in a table only our server can read; an account label (such as the Gmail address, Slack workspace or Facebook Page name); the permissions you granted; and the per-employee settings you choose. We use these tokens only to perform the actions you enable, and we never sell data received from a connected account or use it for advertising. These are the accounts you can connect today:

• Google Workspace. Read inbox, Send email, Read calendar, Book meetings. The connected account's name and ID, the permissions you granted, and the sign-in tokens Google issued. Never your password. Inbox search results (sender, subject, date and Gmail's short preview) are also kept in your employee's chat history.
• Google Business Profile. Read reviews, Publish posts. The connected account's name and ID, the permissions you granted, and the sign-in tokens the provider issued. Never your password.
• Slack. Read channels, Post messages. The Slack workspace name and ID, the permissions you granted, and the bot token Slack issued. Never your password. Channel names you ask for in Chat are also kept in your employee's chat history.
• HubSpot. Read contacts and deals, Update contacts and deals, Log notes. The HubSpot account name and ID, the permissions you granted, and the sign-in tokens HubSpot issued. Never your password. Contacts you look up in Chat (name, email, stage) are also kept in your employee's chat history.
• Meta (Facebook + Instagram). Read page & posts, Publish posts. The connected account's name and ID, the permissions you granted, and the sign-in tokens the provider issued. Never your password.
• LinkedIn. Read comments & page stats, Publish posts. The connected account's name and ID, the permissions you granted, and the sign-in tokens the provider issued. Never your password.
• TikTok. Read profile stats, Publish posts. The connected account's name and ID, the permissions you granted, and the sign-in tokens the provider issued. Never your password.
• Custom tools. Run read-only tools, Run tools that change things, Trigger tasks from inbound events, Deliver outbound events, Read SEO rank data, Read places & business data, Read legislative data. Your server URL or webhook destination, the signing secret or API key you pasted, the permissions you granted, and your MCP server's tool list. Results of MCP tools run in Chat are also kept in your employee's chat history.
• Microsoft 365 (Outlook + Teams). Read inbox, Send email, Read calendar, Book meetings, Post in Teams. The connected account's name and ID, the permissions you granted, and the sign-in tokens the provider issued. Never your password.
• Calendly. Read your schedule, Book meetings. The connected account's name and ID, the permissions you granted, and the sign-in tokens the provider issued. Never your password.

Google. Persistent Workforce’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train generalized AI models, and no person reads it unless you ask us to or it is needed for security or to comply with law.

Meta. We store tokens only for the Facebook Pages you select, along with your app-scoped Facebook user ID so we can honour a deletion request.

Retention and disconnecting.Disconnect any account from Connections in your workspace; its stored tokens are deleted immediately. You can also revoke our access from the provider’s own settings (for example your Google Account permissions or Facebook Business Integrations). The account label and permission settings stay with your workspace until you delete your account, and are then handled as described in Retention.

Deletion. To delete data from a connected account, disconnect it or email legal@persistentmomentum.com. If you remove Persistent Workforce from your Facebook account, Meta sends us a deletion request (handled at /api/integrations/meta/data-deletion): we delete every Page connection and stored token linked to your Facebook account and give Meta a confirmation code and a status page you can check.

We keep Customer Content for as long as your account is active. After cancellation, we retain it for 90 days to allow data export, then delete or anonymize it (subject to limited legal retention requirements such as tax records). You can request earlier deletion at any time — see “Your rights” below.

Subject to applicable law, you may request: (a) access to the personal data we hold about you; (b) correction of inaccurate data; (c) deletion of your data; (d) export of your data in a portable format; (e) objection to specific processing; (f) that we stop sharing your data with Persistent Momentum’s affiliates (section 4).

To exercise any of these rights, email legal@persistentmomentum.com. We respond within 30 days. We may ask you to verify your identity before acting on a request that involves another user’s personal data.

EU / UK residents. Self-service GDPR data portability is queued for a future release. Today, please email us and we will fulfill your request manually. We do not currently process special-category personal data (e.g. health, genetic) and ask that you not upload such data to the Service.

We use first-party cookies for authentication (Supabase session) and product analytics (PostHog with anonymized IP). We do not use third-party advertising trackers. Marketing pages may load Google Fonts; web font requests can be observed by Google but contain no identifying information beyond the request itself.

We use industry-standard practices: TLS in transit, encryption at rest, row-level security in the database, principle-of-least-privilege for service credentials. No system is perfectly secure, and we encourage you to choose a strong unique password and report suspected vulnerabilities to legal@persistentmomentum.com.

Our infrastructure is hosted in the United States. If you are outside the US, your data will be transferred to and processed in the US under standard contractual clauses or similar mechanisms where applicable.

If you request a Persistent Workforce demo on our website and check a text-message box, Persistent Momentum uses your phone number only for the texts you chose: messages about your demo request and account (demo scheduling, follow-up on your questions and account setup) if you checked that box, and product news and offers only if you separately checked the optional marketing box. Each consent is recorded on its own, and neither is required to submit the form.

A business that uses Persistent Workforce can have its AI employees text that business’s own customers and leads. Those texts go only to people who consented to receive texts from that business, and the business is responsible for obtaining and keeping that consent. We process those phone numbers on the business’s behalf, solely to send and receive its messages.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except as required to deliver the messages (our SMS service provider) or as required by law.

You can opt out at any time by replying STOP to any message. Reply HELP for help. Message and data rates may apply; message frequency varies.

The Service is not directed at individuals under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact legal@persistentmomentum.com and we will delete it.

We may update this policy from time to time. Material changes will be communicated by email to your account address or by an in-app notice at least 30 days before they take effect, except where required for legal or security reasons.

Privacy questions? Email legal@persistentmomentum.com.