Privacy Policy

1. Who we are

PeerX is a subscription platform where professionals and their teams run AI agents on their own work. This policy explains how PairOx Pty Ltd (ABN 82 154 477 728), a company registered in Australia, based in New South Wales, Australia ("PeerX", "we", "us"), handles personal data. You can contact us about privacy at [email protected].

Controller and processor. We are the controller of the personal data we use to run accounts, billing, security and our website. When a customer uses PeerX to process personal data about other people, such as their own clients, the customer is the controller, and we process that data on the customer's behalf under our Data Processing Addendum. Please send requests about that data to the customer.

2. What we collect

Account details: your name, email address, password (stored only as a hash), and, if you give them, your phone number, business name and industry. We also record your organisation, your role in it, and whether you have verified your email address or phone number.
Sign-in provider details: if you sign in with Google, we receive your name, email address and account identifier from Google. Google is the only sign-in provider our website offers today; the PeerX app for iPhone also offers Sign in with Apple (see section 12). The same would apply to any other we add (see section 5).
Acceptance records: which versions of our Terms of Service and this Privacy Policy you accepted, when, and the IP address and browser user agent you accepted them from.
Billing details: your subscription, invoices and payment status. Card details are entered on and held by Stripe. We do not receive or store full card numbers.
Content you give the Service: prompts, instructions, documents and other content you submit to agents, the output agents produce, and data from third-party accounts you connect (for example Google, Microsoft Outlook, Slack, Salesforce, HubSpot, DocuSign or Zoom), together with the access tokens for those connections.
Usage and security data: agent runs and other usage counted against your plan, sign-in sessions and attempts, IP addresses, user agents, audit logs of account and administrative actions, security events, request logs, and error reports.
Newsletter and sales enquiries: if you subscribe to our newsletter, your email address and whether you are subscribed; if you contact our sales team, the name, email address, company, phone number and message you send.
Website analytics: when you visit peerx.ai, Cloudflare Web Analytics, which Cloudflare adds to every page, counts page views and visits. With each page it reports the page's address, the site you came from, moves between our pages, how quickly the page loaded and which parts of it were slow to appear or moved while loading, the kind of your last tap or click, and your browser and operating system with their versions; Cloudflare also sees what any visit to a website carries, such as your IP address. We see only totals, such as page views, visits, top pages, referring sites, countries, device types, browsers and load times. Cloudflare states that it does not use cookies or browser storage for this and does not fingerprint visitors. It runs without asking for a choice. Our website can also use Google Analytics, which sets cookies, but we do not use it today (see section 5); if we do, it will wait until you accept analytics cookies. See our Cookie Policy.

3. How we use it, and our legal bases

To provide the Service (create your account, run agents, connect integrations, count usage against your plan): performance of our contract with you.
To bill you and keep financial records: performance of our contract, and compliance with legal obligations.
To keep the Service secure (authentication, multi-factor authentication, fraud and abuse prevention, audit logs, error monitoring): our legitimate interest in protecting the Service and our customers.
To send service messages (verification codes, security alerts, account deletion notices, billing and payment notices): performance of our contract.
To record that you accepted our terms: our legitimate interest in being able to show what was agreed, and compliance with legal obligations.
To send you our newsletter: your consent, which you can withdraw at any time with the unsubscribe link in each email.
To answer a sales enquiry: steps you ask us to take before entering into a contract, and our legitimate interest in responding to people who contact us.
To understand how our website is used: your consent where the law requires it, otherwise our legitimate interest.
To improve AI features using your content: only if you opt in. This is off by default.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

4. AI processing

When you run an agent, the content it needs, such as your prompt, relevant documents and data from connected accounts, is sent to an AI model provider to generate a response. Today we use OpenAI's hosted model API, which processes the content to return a result to us. From 10 December 2026 at the earliest, we may use Anthropic's Claude models first, with OpenAI kept as the backup: the content is sent to Anthropic, and if Claude does not return an answer, the same content is sent to OpenAI. The content sent is the same as today, whichever of the two receives it. Anthropic is based in the United States, and as section 6 says, your content may be processed outside your own country. This paragraph is our notice of that change. Our software can also use NVIDIA, but we do not use it today, and we will tell you before we start (see section 5).

Agent output is generated automatically and may be wrong. We do not use it to make decisions about you that have legal or similarly significant effects.

We share personal data with service providers who process it for us:

AI model providers: OpenAI, to run agents. From 10 December 2026 at the earliest, Anthropic may also run them, as section 4 describes; until then Anthropic receives none of your data.
Stripe: payments, subscriptions, invoices and refunds.
Email delivery: Resend, to send account and service emails.
Migadu: hosts our peerx.ai mailboxes, so it holds the emails you send us, for example to [email protected] or [email protected].
Sign-in provider: Google, if you choose to sign in with it.
Hetzner (Hetzner Online GmbH, Germany): rents us the servers the Service, its databases and the files you upload run on, in Germany or Finland, and processes them only on our instructions, under a data processing agreement.
Cloudflare: runs the domain name system for peerx.ai, carries and protects all traffic between you and our servers, counts visits to peerx.ai with Cloudflare Web Analytics (see section 2), and stores the backup copies of our databases, in its Oceania region.
Integrations you connect: when you connect a third-party account, we exchange data with that service as you instruct.

Our software can also work with other providers, but we do not use them today, so none of them receives your data: NVIDIA (AI models), Twilio SendGrid and Amazon SES (email delivery), Apple, Microsoft, Facebook, LinkedIn and GitHub (sign-in), Google Analytics (website analytics), Twilio (SMS), Google Firebase Cloud Messaging and Apple Push Notification service (push notifications), Sentry (error monitoring), Serper, Microsoft Bing and Google (web search and maps), PagerDuty (incident alerts) and PayPal (payouts to professionals). We will update this policy and our list of subprocessors at least 30 days before we start using any of them.

Mobile apps. The PeerX apps for iPhone and Android change that for three of the providers named above, and add one. From the day the apps are released they use Apple (Sign in with Apple, and Apple Push Notification service), Google Firebase Cloud Messaging and Google Firebase Crashlytics, for people who install an app. Section 12 says what each one receives. This paragraph is our notice of that change.

We also disclose personal data when required by law, to protect rights and safety, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply.

6. Where your data is processed

We host the Service, including its databases and the files you upload, on servers we rent from Hetzner Online GmbH in Germany or Finland, in the European Union. Copies of our databases and of uploaded files made before the Service moved there are also kept on a computer PeerX operates in Australia, until we delete them. Several of our providers are based in the United States, Germany and other countries, so your personal data is processed outside Australia and may be processed outside your own country. To ask how a transfer of your data is protected, email [email protected].

7. How long we keep it

Account details and content: for as long as your account is open. If you ask us to delete your account, deletion is scheduled after a 30-day grace period. We email you a link that cancels it, and signing in during the grace period sends a new one. When the grace period ends, we delete your sign-in credentials, sessions, connected sign-in accounts, devices, API keys and preferences, remove your phone number, and replace your name and email address with anonymous values. Projects, agent conversations and other content in your organisation's workspace are not erased by this step; if you want them erased too, email [email protected].
Acceptance records: for as long as we keep your account record, including after it is anonymised, so that we can show what was agreed.
Audit trails and security logs (sign-in attempts and sessions, security events, account status changes, audit logs of account and administrative actions): 90 days.
Service telemetry (API and agent request logs, agent session status changes, tool execution logs, performance measurements, rate-limit events): 30 days.
Product analytics (events recording which features and agents are used, which agent recommendations you see and open, and where sign-up, onboarding and training steps are completed or abandoned): 180 days.
Sign-in tokens: access tokens expire after 15 minutes, and refresh tokens after 7 days.
Billing records: 7 years, as tax and accounting law requires, including after your account is deleted. Stripe keeps its own records under its privacy policy.
Newsletter subscriptions: until you unsubscribe. We then keep your email address marked as unsubscribed, so that we do not email you again.
Sales enquiries: until you ask us to delete them.
Backups: up to 35 days.

8. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to how we use it, receive a portable copy of it, and withdraw consent at any time (without affecting processing that has already taken place).

You can download a copy of your account data, and ask us to delete your account, from the privacy section of your account settings. You can also make any request, including correction, by emailing [email protected]. We may need to verify your identity first. We will respond within one month, or tell you within that time if we need longer.

You also have the right to complain to your local data protection authority. We would appreciate the chance to address your concern first.

9. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections, hashed passwords, multi-factor authentication, separation of each organisation's data, and logging of security-relevant actions. No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

10. Children

PeerX is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children.

11. Changes to this policy

We will post any change on this page with a new date. If a change is material, we will tell you by email or in the Service at least 30 days before it takes effect, and ask you to accept the new version.

12. PeerX mobile apps

The PeerX apps for iPhone and Android are a companion to a PeerX account you already have. Everything in this policy applies to them. This section says what is particular to the apps.

Signing in: you sign in with your email address and password, with Google, or, on iPhone, with Apple. From Google or Apple we receive your account identifier with that provider, your email address and, when the provider gives it, your name; Apple lets you hide your email address, in which case we receive the relay address Apple creates for you. The apps sign you in to an account that already exists. They do not create one.
Notifications: if you allow notifications, the app sends us the token that Apple or Google issued to your device for them, with whether the device is an iPhone or an Android phone. We keep it with your account and use it to tell you when an agent's answer is ready. We send notifications to iPhone through Apple Push Notification service and to Android through Google Firebase Cloud Messaging, so Apple or Google receives the device token and the notification. When you sign out, the app tells us to stop using the token, and you can turn notifications off in your phone's settings at any time.
Crash reports: if an app crashes, it sends a crash report to Google Firebase Crashlytics so that we can fix the fault. A report contains what the app was doing when it crashed, your device model, its operating system version, the app version, an identifier Crashlytics creates for the installation, and your PeerX user identifier. It does not contain your name, your email address or the content of your conversations.
Content shared with our AI model providers: agents in the apps work as section 4 describes. Before you first use an agent in an app, the app names who will receive your content, lists what will be sent and asks you to agree. Until you agree, no agent runs for you in the app and none of your content is sent to an AI model provider. You can withdraw your agreement in the app's settings, and agents then stop until you agree again.
Reporting an answer: when you report an agent's answer from an app, we keep the reason you chose, any note you wrote, the start of the answer and which conversation it came from, so that we can review it. These reports are deleted with your account.
No advertising or tracking: the apps contain no advertising, do not read your device's advertising identifier, and do not track you across other companies' apps or websites. They do not use Google Analytics or Firebase Analytics.
Deleting your account and getting your data: in an app's settings you can ask us to delete your account, which works as section 7 describes, and download a copy of your account data. If you signed in with Apple, we also ask Apple to end the app's access to your Apple account when your account is deleted.
The pages the apps open: the apps show our Terms of Service, this policy and a support page as pages of peerx.ai. Those pages do not run Cloudflare Web Analytics or Google Analytics. Cloudflare still carries the request, as it does for all traffic to peerx.ai (see section 5).

13. Contact

Privacy questions and requests: [email protected].