1. Introduction
This Privacy Policy describes how Aperisa Technologies Inc. ("Aperisa," "we," "us") collects, uses, and shares information about you when you use aperisa.com, the Aperisa web application, and any related services we provide (together, the "Services").
Aperisa is a personal knowledge graph that organizes data you choose to connect — such as documents, email, calendar, and financial accounts — into a structured profile you can query directly or expose to AI agents you trust. Because the Services are built around your personal data, we treat privacy as a core part of how the product works, not an afterthought.
If anything in this Policy is unclear, contact us using the details in Section 13.
2. Scope
This Policy applies to information we collect through the Services. It does not apply to third-party services you connect to Aperisa (for example, your email or banking provider), which are governed by their own privacy policies. When you authorize a connection, you should also review the policy of that provider.
3. Information We Collect
3.1 Account information
When you create an account, we collect identifiers needed to operate it — typically your name and email address — plus authentication information. If you sign in with a third-party provider, we receive the basic profile information that provider releases to us.
3.2 Data you connect
Aperisa is designed to ingest data sources you explicitly connect. Today this includes:
- Google Drive (files you select)
- Gmail (messages and attachments)
- Google Calendar
- Bank and financial-account data via Plaid
We may add additional connectors over time; new sources are activated only when you connect them. When you connect a source, we receive the data covered by the permissions you grant, and you can disconnect any source at any time from your account settings.
3.3 Data we derive
Aperisa processes the data you connect to produce a structured "personal knowledge graph" — organized records such as accounts, bills, policies, organizations, vehicles, contacts, and key dates, along with vector and graph representations that make this data searchable and useful to AI agents. We treat derived data with the same protections as the underlying source data.
3.4 Usage and device information
When you use the Services, we collect basic technical information such as IP address, browser type, device type, language, and pages or features used. We use first-party analytics to understand how the Services are used and to improve them. We do not run third-party advertising networks on the Services and we do not sell your personal information.
3.5 Cookies
We use cookies and similar technologies for essential functions (such as keeping you signed in) and for first-party analytics. You can configure your browser to refuse cookies; some features of the Services will not work without them. We do not use cookies for cross-site advertising.
3.6 Communications
If you contact us for support or otherwise communicate with us, we retain those communications and any information you provide so we can respond and improve the Services.
4. How We Use Information
We use information to:
- Provide, operate, and maintain the Services
- Build, organize, and present your personal knowledge graph
- Respond to your queries and execute actions you initiate
- Make your data available to AI agents and integrations you explicitly authorize
- Detect, prevent, and address fraud, abuse, security, and technical issues
- Improve the Services, including model and product quality, using aggregated or de-identified information where feasible
- Comply with legal obligations and enforce our Terms of Service
- Communicate with you about your account, the Services, and important updates
5. How Your Data Is Processed
This section describes which third-party AI providers process your data, what they receive, and what we can and cannot promise about it.
5.1 Document and message extraction by Google
When Aperisa ingests a document, email, or attachment, it is classified and its fields are extracted by Google's Gemini model through Google Cloud's Vertex AI, using Aperisa's Google Cloud account. The text is sent to Google for this purpose. Under Google Cloud's terms, Google will not use that content to train or fine-tune its models without our permission, and we have not given it. Google may cache prompts for up to 24 hours, may log and review prompts that its automated abuse-detection systems flag, and processes these requests in locations we do not choose.
5.2 Search indexing by Voyage AI
To make search work, the text of your documents and emails, and the text of your questions, are sent to Voyage AI to be converted into numeric embeddings. Voyage's standard terms allow it to use customer content to train its models unless the customer opts out. Aperisa has opted out; under Voyage's terms, content sent after the opt-out is deleted after it is processed.
5.3 Answers by Anthropic
Some questions are answered with help from Anthropic's Claude. When this happens, your question and the records needed to answer it are sent to Anthropic under Anthropic's Commercial Terms, which include its Data Processing Addendum. Under those terms Anthropic may not train models on your content. Anthropic automatically deletes API inputs and outputs within 30 days, except content that its safety systems flag, which it may keep longer. We do not have a zero-data-retention agreement with Anthropic. When you fill a form, only the form's blank field labels are sent. The question you type is sent as written, so avoid typing information you do not want sent.
5.4 Future: sealed and self-controlled inference
Not available today: We are working toward chat inference that runs inside a hardware-sealed environment where neither Aperisa nor our cloud provider can read your data while it is being processed, and where decryption requires your authorization. We will update this Policy and notify users as these capabilities become available.
5.5 Encryption
We use TLS to encrypt data in transit. Data at rest is protected by platform disk encryption. On top of that, we encrypt sensitive data at the application layer with a key unique to your account, including document text, email bodies, contacts, calendar details, financial accounts and transactions, identity numbers and chat history. This encryption is database-enforced and continuously checked. Authentication credentials are stored using one-way hashes, never as plain text. We operate the key service, so this protection is not zero-knowledge: someone with the necessary access to our systems could decrypt your data.
5.6 Companies that receive your data
Supabase, Google Cloud, Anthropic, Voyage AI, Plaid, Pipedream, Vercel, Sentry, Resend. Each processes data only to provide its service to us under its terms and data processing addendum. Google, Anthropic, and (through our opt-out) Voyage AI additionally may not use your content to train their models.
6. How We Share Information
We do not sell your personal information. We share information only as described below.
6.1 With agents and integrations you authorize
Aperisa exposes your knowledge graph to AI agents and integrations — including via the Model Context Protocol (MCP) and similar interfaces — only when you explicitly authorize it. You can revoke any such authorization at any time, which prevents future access. Information already shared with a third party prior to revocation is governed by that third party's terms.
6.2 Service providers
We share information with vendors that help us operate the Services — for example, cloud hosting, payment processing, error monitoring, customer support, and the AI providers that help answer your questions. These vendors are bound by contractual obligations to protect your information and to use it only for the purposes for which we engaged them.
6.3 Legal and safety
We will disclose information if we have a good-faith belief that disclosure is reasonably necessary to: comply with a law, regulation, subpoena, or other valid legal process; enforce our Terms of Service; investigate or address fraud, security, or technical issues; or protect the rights, property, or safety of Aperisa, our users, or the public.
6.4 Business transfers
If Aperisa is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred to the successor entity. Unless required otherwise by law, the successor will be bound by the commitments in this Policy or will provide you with notice and an opportunity to object.
7. Retention and Deletion
We retain information for as long as needed to operate your account and provide the Services. You can disconnect any data source at any time, and you can request deletion of your account or specific data through your account settings or by contacting us.
When you delete data or close your account, we remove the data from our active systems within a reasonable period. Backups containing residual copies are overwritten on our standard rotation schedule. We may retain limited information where required by law, to resolve disputes, or to enforce our agreements.
8. Your Rights and Choices
Depending on where you live, you may have rights under applicable law to:
- Access the personal information we hold about you
- Correct inaccurate information
- Delete information
- Export a copy of your information in a portable format
- Object to or restrict certain processing
- Withdraw consent where processing is based on consent
- Lodge a complaint with your local data-protection authority
To exercise any of these rights, contact us at the address in Section 13. We will respond within the timeframes required by applicable law. We will not discriminate against you for exercising your rights.
9. California Residents (CCPA/CPRA)
If you are a California resident, you have the rights described in Section 8, including the right to know what personal information we collect about you, the right to delete it, the right to correct it, and the right to opt out of any "sale" or "sharing" of personal information as those terms are defined under California law. We do not sell or share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that require an opt-out right under the CPRA.
10. International Users
Aperisa is operated from the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States and other countries where we or our service providers operate. These countries may have data-protection laws that differ from those of your country. By using the Services, you consent to these transfers.
For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses issued by the European Commission.
11. Children
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us using the details below and we will delete it.
12. Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will provide notice through the Services or by email before the changes take effect. The "Last revised" date at the top reflects the most recent update. Continued use of the Services after a change indicates your acceptance of the updated Policy.
13. Contact Us
If you have questions about this Policy or how we handle your information, contact us:
Aperisa Technologies Inc.
1730 East Holly Ave
El Segundo, CA 90245
Email: support@aperisa.com
Phone: +1 (310) 871-1269