Privacy policy

Welcome to Persyst.

The protection of your personal data is a priority. This policy explains what data we collect, why we process it, how it is protected, and what your rights are.

Data controller

The data controller is:

Persyst — TILTED SAS — 200 Route de Bellavillet – 73600 Les Belleville — SIREN: 851545749

For any question about this policy or your personal data: rgpd@persyst.ai

About Persyst

Persyst is a SaaS platform that connects an organization's tools to the artificial intelligence assistants chosen by its team members (ChatGPT, Claude, Grok, Cursor…), deciding who can access what and keeping a record of every call.

Data we collect

Depending on your use of Persyst, we may collect the following categories of data:

Customer Account data

• Last name
• First name
• Email address
• Organization
• Role
• Profile picture (optional)
• Password (encrypted)

Data related to your use of Persyst

• Logins
• IP address
• Session identifier
• Browser type
• Operating system
• Time zone
• Language
• Pages visited
• Session duration
• Technical logs

This information is used in particular to ensure security, diagnose incidents and improve the service.

Content of connected tools

You can connect tools to Persyst containing, in particular:

• documents
• knowledge bases
• files
• tasks and tickets
• business tools
• CRM
• ERP
• collaborative spaces
• source code
• wikis

This content remains the property of your organization. Persyst keeps a copy or an index of it when search requires it (for example the code of a repository or the tasks of a project management space).

Credentials for connected tools

To call your tools, Persyst keeps the access tokens, OAuth credentials and database connection details they require. They are stored encrypted and used only to make the calls you or your organization authorize.

Call log

When an artificial intelligence assistant uses a tool through Persyst, we record usage information: the User concerned, the assistant, the tool and source used, the date, duration and status of the call (success or error) and, on failure, a sanitized error message, along with the technical identifiers needed for tracking.

We also keep the contents of each call: the parameters sent by the assistant and the result returned by the tool. The result is truncated beyond a certain size, stripped of binary content (images, audio, files) and stored encrypted with a key specific to your organization. These contents are used to analyze tool usage and improve the Solution. Calls made from the playground are not included.

For PostgreSQL and ClickHouse database connections, a separate technical log stores the SQL query text, its status, duration, row count and any error messages. It does not store the rows returned by the database.

Conversations between a User and their artificial intelligence assistant do not go through Persyst: only tool calls reach us.

Technical data

We may collect:

• technical identifiers
• error logs
• performance data
• system metrics
• diagnostics

Purposes of processing

We process your data in order to:

• provide the Persyst services;
• create and maintain your workspace;
• enable search across connected tools;
• keep the log of calls made by artificial intelligence assistants;
• analyze tool usage from the contents of these calls;
• ensure the security of the platform;
• prevent fraud;
• respond to your support requests;
• improve our Solution;
• comply with our legal obligations.

Legal bases

Depending on the processing involved, the legal bases are:

• performance of the Terms of Service;
• legitimate interest;
• compliance with a legal obligation;
• consent where required.

Artificial intelligence

Persyst does not provide an artificial intelligence assistant to its Users: each User connects the one of their choice, under their own subscription. Data returned by a tool to that assistant is then processed by the assistant's provider, under its own terms and privacy policy.

The only exception is the playground, reserved for an organization's administrators: it lets them check a member's tools by chatting with an artificial intelligence model provided by Persyst and operated by OpenAI. During that conversation, the administrator's messages and the results of the tools called are sent to OpenAI. Persyst asks OpenAI not to store these exchanges; OpenAI may still keep them for up to 30 days in its abuse monitoring logs, under its own terms. The conversation is not saved by Persyst: it stays in the administrator's browser. Every tool call is logged, with the administrator as its author.

Your organization's content is not used by Persyst to train artificial intelligence models.

You can cut off an assistant's access at any time from your settings, and your organization's administrators can cut off their members' assistants.

Data sharing

We never sell your personal data.

We may share certain data with:

• our cloud infrastructure providers;
• our hosting providers;
• our authentication providers;
• our payment providers;
• our customer support tools;
• OpenAI, for the administrators' playground only (see "Artificial intelligence"), with storage of the exchanges turned off;
• authorities where required by law.

All our processors are bound by contractual confidentiality obligations.

Hosting

Data is hosted in data centers with an appropriate level of security.

Where possible, data from European customers is hosted within the European Union.

Where a transfer outside the European Economic Area is necessary, it is carried out in accordance with the GDPR.

Our hosting provider is disclosed in our Legal Notice.

Security

We implement technical and organizational measures to protect data, including:

• encryption of communications (TLS);
• encryption of sensitive data at rest where applicable;
• access control;
• logging;
• secure authentication;
• backups;
• security monitoring.

As no system can guarantee absolute security, we continuously improve our protective measures.

Data retention

Data is kept only for as long as necessary for the purposes described in this policy.

Data may be deleted:

• when the account is closed;
• at the customer's request;
• in accordance with legal obligations.

Certain backups may be kept temporarily to ensure service continuity.

Your rights

Under the GDPR, you have in particular the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction;
• right to object;
• right to data portability;
• right to withdraw your consent where the processing is based on consent.

You can exercise these rights by writing to: rgpd@persyst.ai.

We may request proof of identity where necessary.

Cookies

Persyst uses cookies and similar technologies to:

• maintain your session;
• ensure security;
• remember your preferences;
• measure performance;
• produce usage statistics.

Where required by law, your consent will be obtained before the relevant cookies are placed.

Website audience measurement

On persyst.ai, we count visits whatever you chose in the cookie banner: pages viewed, landing page, referring site, campaign, pricing page views and clicks on the sign-up and demo buttons. These measures are used only to produce traffic statistics for the website.

• They never identify a person, an account or an organization, and are not matched with sign-ups or customers.
• They stay with Persyst: nothing is sent to any third party, neither Google nor an advertising network.
• Your browser is recognized by a random identifier kept for at most 13 months after your first visit. Measures are deleted after 25 months. We keep neither your IP address nor your city: location stops at the country.
• You can opt out of being measured at any time, from this page. Your browser then stops being counted and its identifier is deleted.

Google Analytics and the recording of clicks and scrolling on pages only run with your consent, given in the cookie banner.

Origin of sign-ups

When you create an account from the website, we keep where you came from: referring site (for example a search engine or a social network), campaign if there is one, the website page you arrived on and the button you clicked. This information travels in the link from the website to the application; nothing is stored in your browser to remember it.

It is used only to understand what brings sign-ups, on the basis of our legitimate interest. It is never sent to a third party or combined with the website audience measurement. You can ask for it to be deleted by writing to rgpd@persyst.ai.

Minors

Persyst is intended for professional use and is not designed to be used by persons under the age of 16.

Changes

We may update this policy to reflect changes:

• to our Solution;
• to our legal obligations;
• to our practices.

The last update date will always appear at the bottom of the document.

Supervisory authority

If you believe that the processing of your data does not comply with applicable regulations, you can lodge a complaint with the competent authority in your country.

For users located in France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL).