Privacy Policy

1. Who this policy covers

This policy explains how Performance Local (“Performance Local”, “we”, “us” or “our”) handles personal information when you visit performancelocal.com, use our app at app.performancelocal.com, or use our services, including Callscribe, our call and form tracking product (together, the “Service”).

It covers:

• our customers and their team members, who have accounts;
• visitors to our website;
• people whose information our customers handle through the Service, such as callers, people who fill in forms or send texts, visitors to our customers’ websites, and people who leave reviews.

For that last group, we process information on behalf of our customer, the business you contacted. That business decides how the information is used, so please contact it first with questions or requests. We’ll help the business respond.

2. Information we collect

Account information

Your name, email address and password (which we store only in a protected, hashed form), your workspace and business names, the team members you invite and their roles, your settings and time zone, and the messages you send us.

Business profile data from Google

When you connect Google Business Profile, we access the profiles you manage and choose to use: business details such as name, address, phone number, hours, categories and description; posts; reviews and replies, including reviewers’ names as Google shows them; photos; and verification status.

Data from other tools you connect

If you connect them, we receive reporting data from Google Search Console, Google Analytics and Google Ads. Through Windsor.ai you can also connect sources such as Meta Ads, Microsoft Ads and HubSpot for your reports. If you connect HubSpot to send leads, we send lead details to your HubSpot account.

Call, form and text data

When you use call and form tracking, including Callscribe, we collect:

• callers’ phone numbers and the numbers they called, and the time, length and outcome of each call;
• call recordings and voicemails, transcripts, and AI-generated summaries and classifications, only where you turn these features on;
• form submissions, including the fields your forms collect (such as name, email address, phone number and message) and any attachments;
• text messages, including their content, the phone numbers involved and when they were sent;
• how a visitor found the business: the page they visited, the referring website, campaign tags and ad click identifiers (such as Google and Microsoft click IDs).

Payment information

Payments are processed by Authorize.Net. Your card details go directly from your browser to Authorize.Net and are never stored on our servers. We keep the card type, the last four digits of the card, and records of your payments and receipts.

Usage and log information

Like most online services, we automatically collect information such as your IP address, browser and device type, the pages and features you use, the date and time of your requests, and error and security logs. So that you can see and sign out of your devices, we keep a record of your signed-in sessions, including the IP address, browser and time of last activity.

3. Cookies and similar technologies

• Our app uses essential cookies to keep you signed in and to protect your account against forged requests. The app can’t work without them.
• Our website doesn’t use advertising or analytics cookies.
• If you play a customer video on our website, Vimeo’s video player loads with its “do not track” option turned on. Vimeo handles that data under its own privacy policy.
• Maps in our app load map images from OpenStreetMap, which receives your IP address when your browser requests them.
• Our tracking code on customers’ websites uses the browser’s session storage, not cookies, to connect a visit with a call or form. It lasts only for that browser session.

4. How we use information

• To provide the Service: sign-in, workspaces, publishing to Google as you choose, rank scans, call routing and recording, forms, texts, reports and integrations.
• To carry out the automations you turn on.
• To create content with AI, such as drafts of posts and review replies, images, and call transcripts and summaries, using the information needed for each task.
• To process payments, send receipts and manage your subscription.
• To send service messages, such as account, security and billing emails, and the alerts and summaries the Service provides.
• To give you support when you ask for it.
• To keep the Service secure, prevent fraud and abuse, and fix problems.
• To understand and improve the Service, using aggregated or de-identified information where we can.
• To meet our legal obligations and enforce our terms.

We don’t sell personal information. We don’t use personal information for targeted advertising, and we don’t send marketing messages to our customers’ callers, visitors or contacts.

5. Legal bases

If you’re in the European Economic Area, the United Kingdom or another place with similar laws, we rely on these legal bases:

• Contract: to provide the Service you signed up for.
• Legitimate interests: to keep the Service secure, prevent fraud, support customers and improve the Service. We balance these interests against your rights.
• Consent: where we ask for it, such as when you connect an account. You can withdraw consent at any time; this doesn’t affect what we did before.
• Legal obligation: where the law requires us to keep or share information.

For information our customers handle through the Service, the customer is responsible for its own legal basis.

6. Google user data

What we access and why

How we limit its use

• We use Google user data only to provide and improve the features you use in the Service.
• We don’t sell Google user data, and we don’t use or transfer it for advertising, including retargeting and personalized or interest-based ads.
• We transfer Google user data only as needed to provide those features (for example, to our hosting and AI service providers), to comply with the law, to protect security, or as part of a merger or acquisition with your prior consent.
• People at Performance Local don’t read your Google user data unless you ask us to (for example, for support), it’s needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.
• We don’t use Google user data to develop, improve or train generalized AI or machine-learning models.
• We don’t use Google user data to decide creditworthiness or for lending.

How we store it

We store Google access tokens encrypted. For some connections, such as Google Ads and Search Console, the sign-in tokens are held for us by Nango, a service provider that manages account connections. We keep profile details and reviews retrieved from Google Business Profile for no more than 30 days before we refresh or delete them.

How to revoke access

• In the app, disconnect Google from your workspace. This deletes the Google access tokens we hold for that connection and removes the Google reviews we had saved from it.
• At any time, you can also remove Performance Local’s access in your Google Account at myaccount.google.com/connections.

After you revoke access, we can no longer get new data from Google. To have us delete Google data we still hold, email us at [email protected].

7. How we share information

• With your team. Members of your workspace can see its information according to their roles. For client workspaces, the agency and the client team members it invites can see the workspace.
• With people you share reports with. Anyone who has a report link you share can view that report until the link expires or you turn it off. You can also protect a link with a password.
• With Google and other platforms, when you direct us. For example, we publish posts, review replies, photos and profile updates to Google, and send lead details to HubSpot if you connect it.
• With our service providers, who help us run the Service and may use information only to provide their services to us. They’re listed in the next section.
• For legal reasons, when we believe in good faith that the law requires it, or to protect the rights, property or safety of our customers, the public or Performance Local.
• In a business transfer, such as a merger, acquisition or sale of assets. We’ll tell you before your information becomes subject to a different privacy policy.
• With your consent or at your direction.

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising.

8. Our service providers

We use these service providers to run the Service:

• DigitalOcean: cloud hosting for our servers and databases, in the United States.
• Cloudflare: domain name services, content delivery and protection for our websites.
• Authorize.Net: payment processing.
• Twilio: tracking phone numbers, call routing and recording, and text messages.
• Brevo: delivery of the emails we send.
• Nango: secure management of connections to some of the tools you connect.
• Windsor.ai: retrieving reporting data from the marketing platforms you connect through it.
• OpenAI: AI writing and suggestions for posts and review replies, call transcription and call summaries.
• Google (Gemini API): AI image creation and photo quality checks.
• Google Maps Platform: turning addresses into map locations.
• DataForSEO: local search ranking data for rank scans. We send it the keywords and map points to check.
• Bunny.net: hosting and delivery of post promotion and citation pages.
• Web hosting, cloud storage and blogging platforms: publishing citation pages that contain your public business information, where your plan includes them.

Our app also shows map images from OpenStreetMap, and our website can play videos from Vimeo. When your browser loads them, those services receive your IP address and browser information. Integrations you choose to connect, such as HubSpot, receive information under your own agreement with them.

9. How long we keep information

• Account and workspace data: for as long as your account is active. Cancelling a plan doesn’t delete your data, so you can reactivate later.
• Deleted workspaces: when an owner deletes a workspace, it’s removed from view, and the owner can restore it for 30 days. Deleting a workspace in the app doesn’t erase its data. To have your data permanently deleted, email us at [email protected].
• Call recordings, transcripts and AI summaries: deleted at the end of the recording retention period for the location, which is never more than 90 days.
• Lead details: caller numbers, form entries and text messages are kept for the retention period set for each location, from 7 to 365 days (90 days unless you change it). After that, we remove the contact details and keep only anonymous counts.
• Notifications and emails: notifications in the app are deleted after 90 days, and our records of the emails we send you after 180 days. Downloaded report files (PDFs) are deleted after 30 days.
• Data from Google Business Profile: profile details and reviews retrieved from Google are kept for no more than 30 days before we refresh or delete them.
• Payment and billing records: as long as we need them for tax, accounting and legal purposes.
• Server logs: kept for a limited period and then automatically deleted or overwritten.
• Backups: copies of deleted information may remain in our backups until those backups are deleted.

We may keep information for longer where the law requires it, or to resolve disputes and enforce our agreements.

10. Security

We use safeguards designed to protect your information, including:

• encryption in transit (HTTPS) for our website and app;
• passwords stored only as secure hashes, and access tokens for connected accounts stored encrypted;
• call recordings encrypted and kept in private storage;
• role-based access within workspaces, and a list of your active sessions that lets you sign out other devices;
• card details handled by Authorize.Net rather than our servers.

No online service is completely secure. Please use a strong, unique password, and tell us at [email protected] if you suspect a problem. If a security incident affects your personal information, we’ll notify you as the law requires.

11. Your rights and choices

• Access: ask for a copy of the personal information we hold about you.
• Correction: update most account details in the app, or ask us to correct information.
• Deletion: ask us to delete your account and personal information. We’ll delete it unless we need to keep it for a legal reason, such as billing records.
• Connections: disconnect Google or other connected tools at any time.
• Emails: we send service emails about your account, security and billing, which you can’t turn off while you have an account. We don’t send marketing emails without giving you a way to unsubscribe.

To make a request, email [email protected] from the email address on your account. We may need to verify your identity before we act, and we’ll respond within the time the law requires.

If you called, texted or filled in a form for one of our customers, please contact that business, because it controls that information. We’ll help it respond.

If you’re in the EEA, the UK or a place with similar laws, you also have the right to restrict or object to our use of your information, to data portability, and to complain to your local data protection authority.

12. US state privacy rights

Depending on where you live, for example in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another state with a privacy law, you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale or sharing of personal information, targeted advertising and certain profiling;
• limit the use of sensitive personal information.

We don’t sell or share personal information, use it for targeted advertising, or use it for profiling that has legal or similarly significant effects. We use sensitive information, such as account sign-in details and the contents of calls and messages you track, only to provide the Service.

In the last 12 months we collected the categories of information described in “Information we collect”: identifiers (such as names, email addresses, phone numbers and IP addresses), commercial information (such as purchase history), internet activity (such as use of the Service), audio recordings (where call recording is on) and business information. We collected it from you, from your devices, from the tools you connect and from the people who contact our customers, and we used and disclosed it for the purposes described in this policy.

To use these rights, email [email protected]. You can use an authorized agent, and we may ask for proof that the agent acts for you. We won’t treat you differently for using your rights. If we decline your request, you can appeal by replying to our decision. If you’re not satisfied with the result of an appeal, you can contact your state attorney general.

13. Children

The Service is for businesses and isn’t directed to children. We don’t knowingly collect personal information from children under 16. If you think a child has given us personal information, email us and we’ll delete it.

14. International transfers

Performance Local is based in the United States, and our servers are in the United States. Some of our service providers may process information in other countries. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live. Where the law requires, we use appropriate safeguards for these transfers, such as standard contractual clauses.

15. Changes to this policy

We may update this policy from time to time. When we do, we’ll post the new version on this page and change the “Last updated” date. If a change is significant, we’ll tell you by email or in the app before it takes effect.

16. Contact us

Questions or requests about privacy? Email us at [email protected]. Please include “Privacy” in the subject line.