Privacy Policy

Updated 6 November 2026.

This Privacy Policy explains how Commonplane, Inc., doing business as Perfloop ("Perfloop," "we," "us," or "our"), processes personal information that we collect through our digital and online properties or services that link to this Privacy Policy, including, as applicable, our websites such as perfloop.ai and our web application (collectively, the "Services"), as well as when you contact customer support, or otherwise interact with us.

This Privacy Policy does not apply to:

Information that we process on behalf of our business customers while providing services to them. Our use of that information is governed by our agreements with those customers. If you have questions about personal information that we process on behalf of a business customer, please direct your questions to the business customer with which you have a relationship.
Information we process about our employees, independent contractors, or job candidates.

The Services are designed to be used for business or professional purposes. We do not offer products or services for use by individuals for their personal, family, or household purposes. Accordingly, we treat all personal information we collect as pertaining to individuals in their capacities as business representatives and not their individual capacities.

Information we collect

Information you provide. When you request early access or subscribe to updates, we collect your email address. When you contact us, we collect your email address and any other information you choose to provide. When you create an account, we collect your name and email through our authentication provider.

Payment information. When an Admin saves a card or buys Usage, our payment processor, Stripe, collects the card details on a page it hosts. Perfloop does not receive or store the card number or security code. We keep basic card details, such as the brand and last four digits, purchase records, and top-up settings. For a contracted plan, our invoicing provider holds the billing records.

Free budget. To give each code-host account at most one free budget, we keep a keyed one-way hash of the code host and the account ID where its App is installed. This claim record does not hold the raw account ID.

Information we collect automatically. When you access or use the Services, we automatically collect device and usage information: the type of browser and device you use, operating system, IP address, access times, pages viewed, and the webpage you visited before navigating to our Services.

The Services use cookies only where they are necessary for sign-in, session security, and related product functions. We do not use cookies, pixels, or similar technologies for analytics, advertising, or cross-site tracking.

When you sign in to the Services, we record your IP address in security audit records and send it to WorkOS, our authentication provider, to help secure your account. The address can belong to a proxy or network that you share with other people.

Information we collect from other sources. We may also receive information about you from other sources. For example, we may receive information about you from the business customer that invited you to the Services, from the service you choose to sign in with, such as Google, Microsoft, GitHub, Apple, or your organization's single sign-on provider, and from a code host, such as GitHub, when you connect an account.

AI clients. You can connect an AI client, such as ChatGPT or Claude, to the Perfloop MCP server. You authorize it by signing in through our authentication provider or, for automation, with a Perfloop API key. Perfloop checks that credential on each request.

We process account and request-security information for our own purposes under this Privacy Policy. Tool arguments and saved workspace content that we process for a business customer are governed by that customer's agreement. The following details explain what the connection sends and keeps in either case.

The client sends Perfloop its tool calls and their arguments, and basic technical data such as its name and the IP address of the machine that sends the request. Perfloop does not receive or ask for your conversation history. Some tools take text that you or your agent write. No tool asks for a password, API key, or other credential.

The Services keep text that a tool saves as a record of your workspace, as it does for the same action in the app. Text that a tool takes can also go to the model providers below for the work it starts.

Our traces of these requests record technical details such as identifiers and the tool name. They do not record the text you or your agent write or the result, except that the error message of a failed call can repeat part of what the call sent.

How we use information

We use personal information to:

provide, maintain, secure, and support the Services;
authenticate users and protect against fraud, abuse, and security incidents;
process payments, keep purchase records, and give each code-host account at most one free budget;
communicate with you about your account and product updates and respond to your inquiries;
communicate with you, including by email, about the Services and other products and services we may offer and that we think will be of interest (see the "Your choices" section below for information about how to opt out of these communications at any time);
monitor and analyze trends, usage, and activities in connection with the Services;
improve the Services;
comply with legal obligations and enforce our terms.

We may create aggregated, de-identified, and/or anonymized data from your personal information and use this data and share it with third parties for our lawful business purposes, including to analyze and improve the Services and promote our business.

We do not sell your personal information. We do not use personal information (or aggregated, de-identified, and/or anonymized data derived from personal information) to train or fine-tune AI models or authorize our service providers to do so.

Selected source code, prompts, tool results and telemetry, including private code, can be sent to OpenAI for model inference or to Anthropic Claude through Google Cloud Vertex AI. Where enabled, Research on one public repo can also use DeepSeek-V4.1-Flash through Vertex AI. Where enabled, security work on a repo, including private code, can use DeepSeek-V4.1-Flash through Fireworks AI. No model provider receives this content without zero-data-retention terms confirmed first. Google's terms allow it to log prompts its abuse classifiers flag, for up to 90 days, for abuse review. This data is not used to train models. Details are on the Security page.

On Vertex AI, DeepSeek-V4.1-Flash is a Preview model. Google's Cloud Data Processing Addendum does not cover it.

Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on: your consent (for example, marketing emails); our legitimate interests in operating and securing the Services and in responding to you; performance of a contract where you are a customer; and compliance with legal obligations. You may withdraw consent at any time.

How we share information

We may share your personal information with the following parties:

Our business customers, whose accounts you use to access the Services.
Affiliates. In some cases, our affiliates might have access to personal information.
Service providers. Third parties that provide services on our behalf or help us operate the Services or our business (such as hosting, information technology, authentication, customer support, email delivery, logs and monitoring, and model inference).
Payment processors. Any payment card information you use to make a purchase on the Services is collected and processed directly by our payment processors, such as Stripe. Stripe may use your payment data in accordance with its privacy policy, https://stripe.com/privacy.

Our service providers include the providers below. Each name links to that provider's privacy policy or privacy terms:

Google Cloud: hosting, storage and model inference with Anthropic Claude through Vertex AI, including private code, and DeepSeek-V4.1-Flash for eligible public-code Research
OpenAI: model inference
Fireworks AI: model inference with DeepSeek-V4.1-Flash for security work, where enabled, including private code
WorkOS: authentication and sign-ups
Axiom: logs and monitoring
Amp: operations agents: account identifiers, alert text and feedback you send, including any code you choose to include
Vercel: website hosting
Stripe: payments
Mercury: invoicing and banking
Postmark: product email (Inbox email and weekly digests)
Slack: alerts and support
Google Workspace: email and support

We may also disclose information where you have instructed us to do so; where required by law or legal process, or to protect rights, safety, and security; with our professional advisors, where necessary; and in connection with an actual or prospective merger, acquisition, sale of assets, or other corporate transaction. The Security page lists which of these providers are subprocessors for the Services.

International transfers

We are based in the United States and may use service providers that operate in other countries. We and our providers can process information in the United States and other countries. Where required, we use the transfer safeguards in our provider and customer agreements. These can include the Standard Contractual Clauses.

Data retention

We retain personal information as long as needed for the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. Customer-data retention for the Services is specified in the data-access contract on the Security page. This is how long we keep account and product data:

Account and workspace records, including records saved through the MCP server, are kept while the customer account is active.
An authorized account deletion stops access at once and removes the account's product data after a recovery period of up to 30 days. We keep one summary record of the deletion, without customer content.
After an account is deleted, its backups and recovery copies are kept for a limited period and then expire.
Operational logs and traces are kept for about a year, also after an account is deleted. Security and audit logs may be kept longer where needed for security, legal or compliance reasons.

When a workspace is deleted, we remove its saved cards and payment records. We keep the code-host account claim hash, without a link to the workspace, so the same code-host account cannot earn a second free budget. Finance records are kept as law requires. Comments that the Service posted on a code host stay there until someone with access removes them. Our sign-in provider keeps your sign-in identity, because it can belong to other workspaces; email privacy@perfloop.ai to delete it.

Security

We protect information with the technical and organizational measures described on our Security page, including encryption in transit and at rest, least-privilege access, and a contained agent-execution architecture. No method of transmission or storage is completely secure.

Your choices

We offer users the following choices:

Access or update your information. You may update certain personal information through your account settings.
Opt out of communications. You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us. It may take time for your opt-out to be effective. Please note that if you choose to opt out of marketing-related emails, you may continue to receive service-related and other non-marketing emails.
Declining to provide information. We need to collect personal information to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services.
Delete your information or close your account. You can choose to delete certain information through your account. An Admin can delete the account's workspace, and the data in it, from Setup in the app. The deletion takes effect 14 days later unless an Admin cancels it before then. For a contracted plan, its signed agreement also applies. If you wish to request to close your account, please contact us.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to the processing of your personal information, and to withdraw consent.

EEA, UK, Switzerland: you may exercise the GDPR rights above and lodge a complaint with your supervisory authority.
California, where applicable: you may request to know, access, correct, and delete personal information. We do not sell or "share" personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.

To access, correct, export, or object to the processing of your personal information, or to exercise any other right, email privacy@perfloop.ai. We will verify your request and answer within 30 days.

Children

The Services are for adults aged 18 or older. We do not offer accounts to children. If you believe a child has provided personal information directly to us, contact privacy@perfloop.ai.

Changes

We may update this Privacy Policy from time to time. If we make changes, we will notify you by revising the date above and, in some cases, we may provide you with additional notice. We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you.

How to contact us

Commonplane, Inc.
2093 Philadelphia Pike #9449
Claymont, DE 19703
privacy@perfloop.ai