Privacy policy

What this covers

Pearl is an AI agent your organization connects to its own tools. This policy explains what we collect, how we use it, and the controls you keep. It covers the Pearl product and this website.

What we collect

Demo requests. If you request a demo, we collect the work email address you submit and use it to respond. Temporary delivery records help us handle retries and prevent abuse.

Account information. Your name, email address, and organization membership: what we need to sign you in and route you to the right workspace.

Connected content. When your organization connects a source (for example Google Drive, Gmail, Notion, or a direct upload), we sync the content that source authorizes so the agent can answer from it with citations. What is synced is governed by the permissions of the connecting account and by your organization’s settings.

Usage and billing. Operational records of how the service is used (for reliability and metering) and, where billing applies, payment details handled by Stripe. We do not use advertising trackers.

How we use it

One purpose: providing the service. We index and search your connected content, generate answers grounded in it with citations back to the source, keep it synced and permission-aware, and carry out the recurring work your organization configures under its own approval policies.

We do not use your content to train generalized AI or machine learning models. Your content is retrieved for your organization’s answers and nothing else. It is never used to develop features for other customers and never sold.

Access inside your workspace follows source permissions and deliberate sharing. When an authorized person shares source content into a Space, its members can read that content through Pearl. Sharing does not override an explicit denial of access at the source. Access is checked when content is retrieved.

Google user data

Pearl’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: Google user data is used only to provide the features described here, is not transferred to third parties except as necessary to provide those features (the service providers below), is never used for advertising, and is never used to train generalized AI or machine learning models. Humans do not read it except with your permission for support, where required for security, or to comply with law.

Service providers

We use a small set of infrastructure providers to run the service, each processing data only on our instructions: Google Cloud (file storage and key management); Supabase (database and authentication); Ramp (model routing); Vercel (model gateway); Anthropic, OpenAI, Microsoft Azure, Google, and xAI (language-model inference); Fireworks and Baseten (inference for open models); Voyage AI (search embeddings); Turbopuffer (search indexing); LlamaParse (document parsing); Liveblocks (collaborative editing); Stripe (billing); Resend (transactional email); and Railway (hosting). A current list is available on request.

Retention and deletion

Disconnecting a source removes its synced content from your workspace and our search indexes. Deleting your organization erases its content, indexes, and stored credentials. Operational records needed for security and billing are kept only as long as required.

Security

Data is encrypted in transit and at rest. Credentials your organization entrusts to us are envelope-encrypted with per-organization keys in a cloud key-management service. Search results are permission-filtered before they reach anyone.

Contact

Questions or requests about your data: hello@betapearl.com. If we change this policy, we will update this page and its effective date.