Parfit Privacy Policy

This Privacy Policy explains how Parfit Inc. ("Parfit," "we," "us," or "our"), collects, uses, stores, discloses, and otherwise processes personal information in connection with the Parfit websites, applications, software, artificial intelligence features, integrations, and related services (collectively, the "Services").

This Privacy Policy applies to individuals who use or interact with the Services. If you use Parfit through an organization that provides or administers your account, that organization may separately determine how certain information is processed and may have its own privacy practices.

1. Information We Process

The information we process depends on the Services you use, the features you enable, the information you provide, and the permissions you grant.

1.1 Account and Profile Information

We may process information associated with your Parfit account, such as your name, email address, account identifier, organization, authentication information, subscription information, preferences, and account settings.

1.2 Connected Services Data

If you choose to connect Parfit to a third-party service, such as Google Workspace, email services, storage services, productivity tools, or other accounts, Parfit may access and process information from that service as authorized by you.

Depending on the connected service, the functionality you choose to use, and the permissions you grant, this information may include:

• account and identity information;
• email messages and other communications;
• message metadata, including senders, recipients, timestamps, labels, folders, and similar information;
• attachments and files;
• contacts and related information;
• calendar, document, workspace, or other connected-service content; and
• other information necessary to provide the connected functionality you request.

We refer to this information collectively as "Connected Services Data."

For this Policy, "Inbox Data" means connected-inbox emails, attachments, and associated metadata, together with user-linked prompts, outputs, summaries, extracted knowledge, indexes, embeddings, and other information derived from that inbox content.

1.3 Content You Provide

We process information that you provide directly through the Services, including prompts, instructions, queries, uploaded files, messages, notes, feedback, and other content.

1.4 Derived and Generated Information

To provide features such as search, retrieval, organization, knowledge management, summarization, automation, and AI-assisted functionality, Parfit may generate or process information derived from your content or Connected Services Data.

This may include summaries, extracted information, structured knowledge, indexes, embeddings, semantic representations, classifications, relationships between information, and other machine-readable representations.

Where such information is derived from Google Workspace user data, we treat it as Google Workspace user data for purposes of the restrictions described in Section 4 below.

1.5 Usage, Device, and Technical Information

We may automatically collect information concerning your interaction with the Services, such as IP address, device and browser information, application version, session information, diagnostic information, feature usage, performance data, and security and operational logs.

We may use cookies and similar technologies where applicable to operate, secure, remember preferences for, and understand use of the Services.

1.6 Support and Communications

If you communicate with us, we may process your contact information, correspondence, support requests, feedback, and related records.

2. How We Use Information

We may process personal information as reasonably necessary to:

• provide, operate, maintain, and support the Services;
• authenticate users and maintain accounts;
• connect and synchronize authorized third-party services;
• organize, retrieve, search, analyze, summarize, or otherwise process information at the user's request;
• provide AI-assisted and agentic functionality requested by the user;
• generate user-specific knowledge, indexes, embeddings, and related functionality necessary to provide the Services;
• respond to user instructions, queries, and support requests;
• maintain the reliability, integrity, and security of the Services;
• detect, investigate, prevent, and respond to fraud, abuse, security incidents, and technical problems;
• administer subscriptions and business relationships;
• comply with applicable legal obligations and enforce our agreements; and
• improve the functionality and user experience of the Services, subject to the additional restrictions applicable to Google Workspace user data described below.

We do not use personal information for purposes materially incompatible with those described in this Privacy Policy without providing any additional notice or consent required by applicable law. Any use of Google Workspace Data to improve the Services remains limited to prominent, user-facing functionality permitted by Google and never includes training shared or general-purpose AI models.

3. Connected Services

Connecting a third-party service to Parfit is optional.

When you connect a service, you authorize Parfit to access the categories of information necessary to provide the functionality you have chosen, subject to the permissions made available by the connected service.

The amount and type of information Parfit may access may therefore vary over time based on:

• the features you use;
• the permissions you grant;
• changes you make to those permissions; and
• changes to Parfit or the connected service.

Parfit will not intentionally request access to third-party account information that is unnecessary for the applicable functionality.

You may disconnect a connected service through Parfit or, where available, through the third-party provider. Disconnecting a service stops future access through that authorization but may not, by itself, delete information previously processed by Parfit. You may use the deletion controls described in Section 8 to request deletion of stored information.

4. Google Workspace User Data

This Section applies specifically to information obtained through Google Workspace APIs, including Gmail and other Google Workspace services ("Google Workspace Data").

Google Workspace Data may include the categories described in Section 1.2, depending on the Google services you connect, the features you use, and the permissions you authorize.

4.1 Limited Use

Parfit's access to, use of, and transfer of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy and the Google Workspace user data and developer policy, including their Limited Use requirements.

Parfit uses Google Workspace Data only as necessary to provide or improve user-facing features that you request and that are visible within the Services.

We do not use or transfer Google Workspace Data for:

• targeted, personalized, retargeted, or interest-based advertising;
• sale to data brokers, information resellers, or similar parties;
• determining creditworthiness or for lending purposes; or
• creating, training, or improving shared, generalized, or other non-personalized artificial intelligence or machine-learning models.

These restrictions apply to information obtained directly through Google Workspace APIs and to information derived from that data, including summaries, indexes, extracted knowledge, embeddings, and similar user-linked representations.

4.2 Human Access

Parfit personnel and contractors are not permitted to access the contents of Google Workspace Data except where access is:

• expressly authorized and documented by the user for access to specified messages, files, or other data for a particular support purpose;
• reasonably necessary to investigate or address security, abuse, fraud, or technical incidents; or
• required to comply with applicable law.

Access permitted under these exceptions is subject to appropriate authorization and access controls.

4.3 Storage and Security

Parfit protects stored Google Workspace Data, including authorized inbox content and OAuth credentials, through appropriate safeguards and encryption in transit and at rest.

Parfit retains Google Workspace Data only for as long as reasonably necessary to provide the user-requested functionality, subject to the retention and deletion rules described in Section 7.

5. Artificial Intelligence

Parfit may use artificial intelligence and machine-learning technologies to provide features requested by users, including search, retrieval, organization, summarization, knowledge management, automation, recommendations, and agentic functionality.

5.1 No General-Purpose Model Training Using Inbox Data

Parfit does not use customer Inbox Data, including emails, attachments, prompts, outputs, extracted knowledge, or embeddings derived from inbox content, to train, fine-tune, develop, evaluate, or improve shared, foundation, or general-purpose AI or machine-learning models.

This restriction applies to inbox content and user-linked information derived from that content, including extracted knowledge and embeddings.

5.2 Third-Party AI Providers

Parfit may use third-party AI providers to process information when necessary to provide AI-powered functionality requested by a user.

Except solely for the limited customer-specific model processing expressly authorized under Section 5.3, any third-party AI provider that receives customer Inbox Data is required to process that data solely for the user-requested operation under binding no-training and zero-retention terms. Zero-retention means the provider does not keep inbox content, prompts, responses, or user-linked derived data after completing the operation, other than strictly transient processing that is necessary to complete it.

Except solely for the limited customer-specific model processing expressly authorized under Section 5.3, Parfit does not disclose or route customer Inbox Data to an AI provider that does not satisfy these no-training and zero-retention requirements.

Third-party AI providers may process information only for the purpose of providing the relevant functionality to Parfit and its users and may not independently use customer inbox data to train shared or general-purpose models.

5.3 Separately Purchased Organization-Specific Models

Parfit offers a separately purchased organization-specific AI model service. It is available only after the Organization expressly opts in to the special Customer-Specific Model Terms in Section 6.4 of our Terms of Service and designates the company data to be used. Standard use of Parfit does not constitute model-training authorization.

Any such service will:

• be expressly opted into by the customer;
• use only the data designated and authorized for that purpose;
• be logically or otherwise appropriately isolated from other customers;
• not contribute customer data to shared or general-purpose model training; and
• be subject to the special Customer-Specific Model Terms in our Terms of Service, which limit retention to the authorized service and require deletion of designated data and destruction of related model artifacts when authorization ends.

The limited exception in Section 5.2 permits Parfit and its contracted providers to train or fine-tune only the isolated customer-specific model and to retain only Designated Model Data and related model artifacts reasonably necessary for the separately purchased and expressly authorized service, within the scope of the Organization's recorded purchase and express authorization and subject to Section 6.4 of our Terms of Service. Any participating provider must be contractually bound to the same purpose limitation, isolation, retention, deletion, and model-destruction requirements. The exception does not cover other Inbox Data, ordinary AI processing, or a provider's independent use. The prohibition on shared or general-purpose model training and the restrictions on Google Workspace Data remain unchanged.

Use of ordinary Parfit Services does not, by itself, constitute authorization to train such a customized model.

Google Workspace Data may be used in a personalized model only for the permitted, customer-authorized user-facing purpose, with the model specifically tailored to that user or organization and without mixing Google data across customers or using it in foundation or generalized models.

6. How We Disclose Information

6.1 Service Providers

We may disclose information to vendors and service providers that perform services on our behalf, such as:

• cloud hosting and infrastructure;
• data storage;
• security and monitoring;
• AI and machine-learning processing;
• customer support;
• communications;
• analytics;
• payment and subscription administration; and
• other technical or operational services.

These providers may process information only to deliver authorized services on Parfit's behalf. We disclose Google Workspace Data to service providers only to provide or improve the user-facing features you authorize, or under another specific exception permitted by Google's policies. Our providers may not use such data for their own advertising, general model training, or unrelated commercial purposes.

Additional restrictions applicable to providers that receive Google Workspace Data or customer inbox data are described in Sections 4 and 5.

6.2 Your Organization

If your Parfit account is provided or managed by an employer, business, school, or other organization, information concerning your account and use of the Services may be available to authorized administrators of that organization, subject to applicable contractual arrangements and law.

6.3 Legal, Security, and Protection Purposes

We may disclose information where reasonably necessary to:

• comply with applicable law, regulation, legal process, or valid governmental request;
• protect the rights, safety, and security of Parfit, our users, or others;
• investigate fraud, abuse, or security incidents; or
• establish, exercise, or defend legal claims.

6.4 Corporate Transactions

Information may be transferred in connection with a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, subject to applicable law and contractual restrictions.

Parfit will not transfer Google Workspace Data as part of a merger, acquisition, or asset sale without obtaining the explicit prior user consent required under Google's Limited Use restrictions.

6.5 No Sale or Behavioral Advertising

Parfit does not sell personal information.

Parfit does not use or disclose personal information for cross-context behavioral advertising, targeted advertising based on activity across unrelated services, or similar advertising purposes.

In particular, Google Workspace Data is never used or transferred for advertising purposes.

7. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it is processed, taking into account:

• the duration of the user's account and use of the relevant feature;
• whether the information is needed to provide user-requested functionality;
• the nature and sensitivity of the information;
• applicable contractual requirements;
• security, fraud-prevention, and operational requirements;
• applicable legal, regulatory, accounting, or reporting obligations; and
• applicable third-party platform requirements.

Our principal retention rules are as follows:

Information retained solely in backups following a deletion request will not be restored to active use except where necessary for legitimate disaster-recovery or security purposes. If a backup is restored, applicable deletion records will be reapplied.

Parfit does not rely on anonymization of user-linked email content, attachments, knowledge, or embeddings as a substitute for honoring a valid deletion request.

8. Your Choices and Controls

8.1 Managing Connected Accounts

You may revoke or modify third-party permissions using the controls provided by Parfit or the applicable third-party service.

For Google accounts, you may also manage Parfit's access through your Google account permissions.

8.2 Access and Export

You may access certain information through the Services.

You may also request or, where available, directly export a portable copy of information associated with your account, subject to applicable law, platform requirements, technical feasibility, and the rights of other individuals.

8.3 Correction

You may correct certain account information directly through the Services or request correction of inaccurate personal information where applicable.

8.4 Deletion

You may delete individual information where the applicable feature provides that functionality.

You may also request deletion of your Parfit account and the personal information linked to that account.

Account-level deletion covers the following categories of user-linked information maintained by Parfit, as applicable:

• email messages and other connected content;
• attachments;
• extracted or structured knowledge;
• embeddings and related machine-readable representations;
• customer-specific model data and model artifacts when the Organization terminates or revokes the applicable model authorization;
• authentication credentials and tokens; and
• applicable account-linked logs and backups,

subject only to specific retention permitted or required by applicable law, such as legally required records or preservation necessary for security incidents or legal claims, and to protected backups awaiting deletion under Section 7.

Following receipt and verification of a valid deletion request, Parfit will delete the covered information from active production systems within 30 calendar days, or sooner where applicable law or Google platform requirements mandate a shorter period. Information that Parfit is legally required or permitted to retain for a specific and limited purpose will be restricted to that purpose and deleted when the exception no longer applies. Protected backup copies will be purged within the period stated in Section 7.

8.5 Disconnecting a Third-Party Service

Disconnecting a third-party service prevents Parfit from continuing to access new information through that authorization.

If you also want Parfit to delete information previously obtained from that service, you should use the applicable deletion control or account-deletion process.

9. U.S. State Privacy Rights

Depending on where you live and whether the applicable law applies to Parfit's processing, you may have certain privacy rights, including the right to:

• confirm whether we process your personal information;
• request access to or obtain a copy of your personal information;
• request correction of inaccurate personal information;
• request deletion of personal information;
• obtain certain personal information in a portable format;
• obtain information regarding categories of information collected, purposes of processing, sources, and recipients;
• opt out of certain sales, targeted advertising, sharing, or profiling activities where applicable;
• limit certain uses or disclosures of sensitive personal information where applicable;
• appeal certain decisions regarding a privacy request; and
• exercise applicable privacy rights without unlawful discrimination.

Parfit does not sell personal information or use personal information for cross-context behavioral or targeted advertising as described in Section 6.5.

To exercise a privacy right, contact us at board@parfit.ai or use the applicable controls in the Services.

We may need to verify your identity before fulfilling certain requests. Where permitted by law, an authorized agent may submit a request on your behalf.

If your information is processed by Parfit on behalf of an organization that controls your account, we may direct your request to that organization or assist the organization in responding to the request.

10. Information Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized or unlawful access, use, disclosure, alteration, loss, or destruction.

These safeguards include access controls, encryption of stored inbox content and OAuth credentials, encryption in transit, credential protection, and appropriate personnel and vendor restrictions.

No information system can be guaranteed to be completely secure. Users are also responsible for protecting their credentials and maintaining appropriate security over their accounts and devices.

11. International Processing

Parfit and its service providers may process information in the United States and other countries in which Parfit or its service providers operate.

Where applicable law requires specific safeguards for international transfers of personal information, we will use appropriate mechanisms required by that law.

12. Children

The Services are not directed to children under 13, and Parfit does not knowingly collect personal information from children under 13 through the Services.

If we learn that personal information has been collected from a child in circumstances prohibited by applicable law, we will take appropriate steps to delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Services, our information practices, legal requirements, or third-party platform requirements.

If we make material changes, we will provide notice as required by applicable law.

Where a change materially affects how we access, use, store, or disclose Google Workspace Data, we will update this Privacy Policy and any required in-product disclosures before implementing the materially changed practice.

The "Effective Date" above indicates when this Privacy Policy was last updated.

14. Contact Us

If you have questions, requests, or concerns regarding this Privacy Policy or Parfit's privacy practices, contact:

Parfit Inc.

Parfit

Registered office (Delaware): 251 Little Falls Drive, Wilmington, DE 19808

Email: board@parfit.ai