Performm Privacy Policy

1. Introduction and scope

Performm is operated by Amove Technologies Inc, a Delaware corporation ("Amove," "we," "our," or "us"). This Privacy Policy describes how Amove collects, uses, discloses, retains, and protects personal data in connection with the following (the "Services"):

• our websites, including https://amove.io and the Performm website (the "Sites");
• Performm, including its web interface, desktop applications and virtual drive extensions for macOS, Windows, and Linux, command line tools, SDKs, APIs, and MCP server;
• the tools delivered through Performm, including Access, AI Search, Edit, Transfer, Sync, Collaborate, Migrate, and Archive;
• Editfly storage;
• beta programs, support, events, and marketing communications that link to this Privacy Policy.

This Privacy Policy does not apply to:

• Customer Content we process on behalf of a Customer, which is governed by the Customer's agreement with Amove, including any data processing addendum;
• Amove software that a Customer, licensee, or partner installs, hosts, or operates in its own environment or under its own brand;
• storage providers, identity providers, AI clients, and other third-party services you connect to the Services.

If this Privacy Policy conflicts with a signed agreement between Amove and a Customer, the signed agreement controls as to that Customer. By using the Services you acknowledge the processing described here. Where the law requires consent, we ask for it separately and do not treat this acknowledgment as consent.

2. Definitions

3. Our role

When we act as a processor, we process Customer Content only on the Customer's instructions. We do not sell it, share it for advertising, combine it with other personal data for our own purposes, or use it outside our relationship with the Customer. The Customer is responsible for having a lawful basis for Customer Content and for any notices and consents it requires, including from people who appear in footage, images, audio, or documents.

Where Amove hosts the Services for a reseller, OEM, or white-label partner that serves its own customers, Amove acts as a sub-processor to that partner, and the partner's privacy notice governs its customers' data.

If you use the Services as an Authorized User, your organization controls your account and may access your account data, activity logs, and the content you store. Direct requests about Customer Content to your organization. If we receive one, we will forward it to the Customer and will not respond directly unless the Customer authorizes us or the law requires it.

4. Personal data we collect

We collect only the personal data needed for the purposes in Section 7. Where you must provide data, we say so when we collect it. If you do not, we may be unable to provide some or all of the Services.

4.1 Data you provide

We do not request sensitive personal data, such as government ID numbers, health data, or demographic characteristics, in account, support, or marketing forms. Please do not include it in support requests.

4.2 Data collected automatically

4.3 Data from third parties

5. Customer Content, data movement, and storage

How Customer Content moves depends on the feature. For access, streaming, and local transfers, file content moves directly between your device and your storage provider over encrypted TLS connections and is never stored on Amove servers. Cloud-to-cloud migrations and AI requests are routed through Amove infrastructure on Amazon Web Services in US East regions, as described below. File data is encrypted on your device, in transit, and at rest.

5.1 Credentials

We encrypt Credentials at rest, restrict access to systems that need them, and use them only to perform operations you initiate or schedule. We never sell Credentials or use them for any other purpose. Use scoped, least-privilege keys, and revoke Credentials with your storage provider when you disconnect storage or close your account.

5.2 Amove access to Customer Content

Amove personnel do not access Customer Content except: (1) as needed to provide the Services you request; (2) to provide support you request, with your authorization, limited to what is necessary, and logged; (3) to investigate or address security incidents, fraud, abuse, or technical issues; or (4) to comply with law, as described in Section 8.

5.3 Content you may not upload

Unless Amove agrees in a signed writing, do not use the Services for: protected health information under HIPAA (Amove does not sign business associate agreements by default); payment card data subject to PCI DSS; data controlled under ITAR or classified under an Export Control Classification Number other than EAR99; classified government information or criminal justice information subject to CJIS; or personal data of children collected for a child-directed service. You are responsible for having the rights, notices, and consents needed for all Customer Content, including releases from people depicted in media.

6. AI Features

Amove does not use Customer Content, Input, Output, or search embeddings to train, fine-tune, or improve any AI or machine learning model, whether Amove's or a third party's, unless the Customer opts in through a signed writing.

6.1 AI Search and AI model providers

AI Features are off by default and run only after a Customer administrator enables them. AI Search is not yet generally available. When enabled, AI requests are routed through Amove's Web API to these AI model providers:

• Anthropic, PBC
• OpenAI
• Google LLC (Gemini API or Vertex AI)

Amove uses these providers only under commercial terms that prohibit training on Customer data. Before AI Search launches, we will update this section with the content sent to each provider, where each processes it, and how long each retains it, and will give Customers at least 30 days' notice.

6.2 No biometric identification

Amove does not offer face recognition. The Services do not create face templates, face embeddings, face geometry scans, voiceprints, or other biometric identifiers, and do not identify, verify, or group individuals by their physical characteristics. Before offering any feature that creates biometric identifiers, we will update this Privacy Policy, publish a biometric data retention and destruction policy, and require Customers to obtain every notice, release, and consent the law requires. Amove will never sell, lease, trade, or otherwise profit from biometric data.

6.3 Output

AI Output can be inaccurate, incomplete, or biased. Review it before relying on it. Do not use AI Features to make decisions with legal or similarly significant effects on individuals, such as decisions about employment, credit, housing, insurance, education, or health care. Amove does not use AI Features to make such decisions about you.

6.4 AI agents and the MCP server

AI agents and AI clients connected through the MCP server act with the permissions granted to them and can read, modify, move, share, and delete Customer Content. We log agent actions. Scope agent tokens to the minimum access required. If you connect a third-party AI client, Customer Content returned to it is processed under that provider's terms, not this Privacy Policy.

6.5 Human review

Amove personnel do not review Input or Output except to provide support you request, to address security or abuse, or to comply with law.

7. How we use personal data and our legal bases

The legal basis column applies to individuals in the European Economic Area, the United Kingdom, and Switzerland.

We do not use Customer Content for marketing, advertising, profiling, or AI training. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We do not use personal data for a new, incompatible purpose without notice and, where required, consent. Where we deidentify data, we keep it deidentified, do not attempt to reidentify it, and require recipients to do the same.

8. How we disclose personal data

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not use advertising cookies or pixels.

8.1 Legal process

We disclose personal data to government authorities only when we believe in good faith that a valid subpoena, court order, warrant, or other legal process requires it. For requests concerning Customer Content we will require valid legal process directed to Amove, redirect the requester to the Customer where possible, notify the Customer before disclosure unless legally prohibited, challenge requests we believe are overbroad, and disclose only the minimum required. We may also disclose personal data where we believe in good faith it is necessary to prevent imminent death or serious physical injury, or to protect the rights, property, or safety of Amove, our users, or the public, including by enforcing the Performm User Agreement.

8.2 Corporate transactions

If Amove is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale or license of all or part of its business or technology, personal data may be disclosed to the counterparty and its advisors under confidentiality obligations. Personal data transferred in a completed transaction remains subject to commitments at least as protective as this Privacy Policy, and we will notify affected individuals before their data becomes subject to a different privacy policy. Customer Content belongs to Customers and is not an Amove asset for sale.

8.3 With your consent

We disclose personal data for other purposes only with your consent.

8.4 Subprocessors and service providers

We will give Customers at least 30 days' notice before a new Subprocessor processes Customer Content. Customers may object on reasonable data protection grounds by writing to contact@amove.io with "Subprocessor Objection" in the subject line within 15 days of notice.

9. Cookies and analytics

Where the law requires consent for non-essential cookies, we ask for it before setting them. You can change your choices through our cookie settings, where offered, or your browser controls. Google Analytics may collect information about your activity on other websites under Google's own policies; see https://www.google.com/policies/privacy/partners/.

Email tracking. Our marketing emails may record whether and when an email was opened and which links were clicked. We do not track whether or to whom you forward our emails. You can disable tracking by blocking images in your email client or by unsubscribing.

Browser signals. We honor Global Privacy Control (GPC) signals as a request to opt out of any sale, sharing, or targeted advertising for the browser sending the signal. There is no accepted standard for "Do Not Track" signals, and we do not respond to them.

10. Your choices and privacy rights

We extend the rights below to every individual, wherever located, subject only to the exceptions applicable law allows. For Customer Content, submit requests to the Customer (see Section 3).

Choices. Unsubscribe from marketing through the link in any marketing email; you will still receive service and security notices. Disconnect any storage endpoint in Performm and revoke its Credentials with your storage provider. Customer administrators can enable or disable AI Features for their organization.

How to exercise your rights. Email contact@amove.io with "Privacy Request" in the subject line. We will verify your identity by matching information we already hold and will request no more than needed. We accept requests from an authorized agent with your signed permission and may ask you to confirm the request directly. We respond within 45 days for US requests, extendable once by 45 days, and within 1 month for EEA, UK, and Swiss requests, extendable by 2 months, with notice of any extension. If we deny your request, we will explain why. You may appeal by emailing contact@amove.io with "Appeal" in the subject line within 60 days; we decide appeals within 60 days. If we deny your appeal, you may contact your state attorney general.

California notice at collection. In the past 12 months we collected the categories below. We disclosed each only to the recipients in Section 8, for the purposes in Section 7. We sold or shared none of them.

We use sensitive personal information only for purposes the law permits, so we do not offer a right to limit its use. We do not disclose personal data to third parties for their own direct marketing purposes.

11. Retention and deletion

We keep personal data only as long as needed for the purposes below. A legal hold, an active dispute, or a legal requirement to retain data overrides these periods for the affected data only.

AI model providers, once active, retain data under their own terms, which we will state in Section 6.1 before AI Search launches. To delete your account, use your account settings or email contact@amove.io. Data on your devices, in local caches, and in Connected Storage is under your control and is not deleted by Amove.

12. Security

We maintain administrative, technical, and physical safeguards designed to protect personal data and Customer Content, including: encryption of file data on the device, in transit using TLS, and at rest; encrypted storage of Credentials; role-based, least-privilege access for Amove personnel; logging and monitoring of access to production systems; confidentiality obligations and training for personnel; security review of Subprocessors before engagement; and a documented incident response process. Our SOC 2 audit is in progress.

No method of transmission or storage is completely secure, and we cannot guarantee the security of any data. You are responsible for securing your devices, Credentials, and account access, and for configuring permissions in Performm and in your Connected Storage.

Breach notification. If we confirm a security breach that leads to unauthorized access to personal data we control, we will notify affected individuals and regulators as the law requires. If a breach affects Customer Content, we will notify the affected Customer without undue delay so it can meet its own obligations.

13. International transfers

Amove is based in the United States. Account data, Service Data, Credentials, Editfly file-tree metadata, and AI Search embeddings are stored on Amazon Web Services in US East regions. Cloud-to-cloud migrations pass through Amove's migration service in an AWS US East region. Editfly storage is located in the IDrive region you select. Other file content stays with your storage provider, in the regions you choose. Amove does not guarantee that Customer Content will remain in any particular country or region unless a signed agreement says so.

When we transfer personal data from the EEA, the UK, or Switzerland to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (Decision 2021/914), the UK International Data Transfer Addendum, and the Swiss adaptations of those clauses, together with supplementary measures such as encryption. You may request a copy of the relevant safeguards at contact@amove.io.

14. Other terms

Children. The Services are for businesses and professionals and are not directed to anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided personal data to us, email contact@amove.io and we will delete it.

Third-party services. The Services link to and integrate with websites, storage providers, AI clients, and other services we do not own or control. Their own privacy policies govern their practices.

Changes. We will post changes on this page and update the "Last updated" date. For material changes, we will notify account holders by email or in the Services at least 30 days before the change takes effect. We will not apply a material change to personal data collected before the change without your consent where the law requires it.

Contact. Questions, requests, and complaints:

Amove Technologies Inc
Attn: Privacy
177 East Colorado Blvd
Pasadena, CA 91105
contact@amove.io

Privacy lead: Robert Edwards, Product and Security Lead.