Privacy Policy 

With respect to our customers, this Privacy Policy below ("Privacy Policy"), along with our Data Processing Addendum, is incorporated by reference into, and forms part of, the applicable agreement, either Terms of Service or Cloud Services Agreement, between Customer.io and customer (the "Agreement"). This Privacy Policy governs our obligations as a data processor with respect to customer data. In the event of any conflict between this Privacy Policy and the Data Processing Addendum, the Data Processing Addendum shall control.

This Privacy Policy describes the personal information that we, Peaberry Software Inc. d/b/a Customer.io (“Customer.io,” “we,” “our” or “us”), collect (1) from individuals when they visit our website (the “Site”), interact with our marketing communications, register to attend events that we host, interact with our social media profiles and otherwise engage with us, and (2) the information we collect on behalf of our customers who employ our technology to use our digital marketing services, including location-based features that a customer chooses to enable and communications services that a customer chooses to connect to the Services (the “Services”). Individuals should refer to our customers’ privacy policies for information about how our customers collect, use and share information about their own end users. In this Privacy Policy, we describe where we collect information on our own behalf, for our business purposes, and where we collect information on our customers’ behalf as a service provider or data processor.

This Privacy Policy does not apply to our employees or to job applicants. We do not knowingly collect information from children. If we discover that we have inadvertently collected information from anyone younger than the age of 16, we will delete that information.

This policy includes the following sections:

1. Personal Information We Collect, Purpose for Processing & Categories of Third Parties Personal Information is Shared with
2. How We Collect Personal Information
3. How We Use Personal Information
4. How We Share Personal Information
5. European Privacy Rights
6. U.S. Data Privacy Rights
7. How We Protect Personal Information
8. How Long We Retain Personal Information
9. Your Choices
10. Changes to this Privacy Policy
11. Contact Us

Personal Information We Collect, Purpose for Processing & Categories of Third Parties Personal Information is Shared with

How We Collect Personal Information

We collect information in the following ways:

1. When you provide it to us, including when you complete forms, request information from us, or respond to our emails or otherwise communicate with us.
2. Directly from our customers, including contact information, demographic information, device information, location-derived event data if a customer enables location-based features, SMS recipient data, message content, sender information, delivery events, inbound message activity, opt-out or preference data, business identifiers, campaign or use-case information, and any other information that our customers provide us in connection with their use of the Services.
3. From service providers, including information about our customers and their employees, or about how our customers use our Services, the messages our customers send and how recipients interact with those messages.
4. From third party business partners, including information about our customers and their employees, about how our customers use our Services or the messages our customers send, how recipients interact with those messages, or our own sales and marketing providers. These third parties include communications providers, third party messaging platforms that send or receive communications, third party analytics providers (e.g., Google Analytics), or third party social media providers (e.g., LinkedIn) or third party sales and marketing providers.
5. Through automatic tracking technologies, including IP address, device ID or similar types of identifying information that we collect via cookies or other automatic tracking technologies. We also collect activities (links clicked, length of session, time/date, type of device, coarse geolocation) that we associate with IP address, device ID or other unique identifiers. We collect this information when you visit our Site, use our Services, or engage with our marketing materials. We also use automatic tracking technologies in the Services and to collect information about the messages our customers send. These automatic tracking technologies collect information about our customers’ end users, including how they interact with our customers’ messages, and whether they open or click links in any communication, and, where a customer enables location-based features, whether they entered or exited a customer-configured geofence.

Information We Collect Automatically

When you interact with the Site or Services, certain information about your use of our Site and Services is collected automatically. This information is collected automatically when you visit our Site and when you open communications from our customers. This includes:

1. Details of your visit and your activity and information generated in the course of your interaction including, but not limited to, traffic data, location data (coarse geolocation), weblogs and other communication data, the resources that you access, and referring and exiting website.
2. IP address and details regarding the device you use, including operating system, device ID, and browser type.
3. Information about how you interact with our ads and newsletters or our customers messages, including whether you open communications or click links.
4. Some customers may choose to use location-based features in the Services. When a customer enables these features, the customer is responsible for their configuration and use, and all notices, consents, and user choices required for the customer’s use of the features. Customer.io processes location-derived event data on behalf of the customer, such as whether an end user entered or exited a customer-configured geofence.

On our Site, we use the following types of cookies and similar technologies for the following purposes:

1. Statistics Cookies: Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously. We use these cookies to understand traffic to our Site and how visitors use our Site. This may include the number of visitors, the websites that referred them to our Site, the pages they visited on our Site, what time of day they visited, whether they have visited our Site before, and other similar information. We use this information to help operate and improve our Site and to monitor activity.
2. Necessary Cookies: Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.
3. Preference Cookies: Preference cookies enable a website to remember information that changes the way the website behaves or looks, like your preferred language or the region that you are in.
4. Marketing Cookies: We use these cookies to remember your preferences, understand how visitors interact with our Site, and help us and our advertising partners show more relevant advertising. These cookies may track browsing activity across websites or apps and may use approximate location or other information made available by your browser or device to help show locale-specific content.

Where required by law, we ask for your consent before using non-essential cookies. Depending on your location, our cookie banner may let you accept all non-essential cookies or manage your preferences. You can reject non-essential cookies through Manage Preferences, and in certain locations we may also provide a Reject All option directly on the first banner.

How We Use Personal Information

We use the personal information that we collect to:

1. Provide the Site, Services, and our content to you.
2. For the purpose for which you provided it, to process your transactions or communicate with you.
3. Provide you with information about products, services, offers, deals, or other information that is relevant to you.
4. For research and development purposes, to study our products and services and to create new products and services.
5. Administer, provide and communicate with you about contests, promotions and sweepstakes, upcoming events, or other news about products and services that we may offer.
6. Provide you with information, products, or services that we believe will interest you.
7. Display marketing to you on other websites.
8. Monitor and analyze trends, usage, engagement, and other activities in connection with our Site, Services or other communications or content.
9. Provide certain features or functionality to you, including customer-configured integrations and communications channels.
10. Identify you, relate you to a segment, personalize the Site, content, or the Services.
11. Provide, support, secure, monitor, and improve our Site and content.
12. Analyze our Site, the Services and any content or message, to support or trouble shoot issues related to our Site, Services or content, or for other internal business purposes.
13. Contact you with administrative communications, including changes to terms or policies.
14. Send you technical notices, updates, security alerts, support or administrative messages and to respond to your comments, questions, or other messages or requests.
15. Detect, investigate, and prevent fraudulent transactions or other illegal or harmful activities.
16. Protect our, our customer’s or our third party partner’s rights and property.
17. Protect the security or integrity of the Site or our Services.
18. Comply with regulatory and legal obligations.
19. For other purposes that may be disclosed to you at the time of collection.

How We Share Personal Information

We share personal information with the following categories of third parties:

1. Customers: We share information about a customer’s end user or end recipient with that customer. This includes information that we collect automatically through tracking technology.
2. Service Providers: We share information that our customers upload to our Service or that we collect about our customer’s end users with our service providers that support the delivery of our Services, which are listed here. We also share information that we collect for our own business purposes with our own service providers, including to provide, support and improve the Site and Services and for our own administrative purposes. Our service providers may include support ticketing systems, engineering ticketing systems, customer relationship management systems, accounting systems, and legal, accounting, and other professional service providers.
3. Third Party Messaging Applications and Customer-Selected Communications Providers: We share information about a customer’s end user or end recipient with limited third parties, including SMS/MMS text message service providers, customer-selected communications providers and other similar third parties. For example, if a customer connects its own SMS provider account to the Services, we may transmit SMS recipient data, message content, sender identity, delivery events, inbound message activity, opt-out or preference data, registration information, and related metadata to or from that provider at the customer's direction. These third party messaging applications and customer-selected communications providers are not service providers or subprocessors of Customer.io unless Customer.io engages them directly to provide the Services, and their own terms of use and privacy policies apply to the information they collect or process.
4. Third Party Business Applications: We share information about our customers (and their employees and contractors) with certain third party business applications, including Stripe or referral partners. These business applications collect information for their own business purpose and their Privacy Policy applies to the information that they collect.
5. Third Party Marketing Applications: We share information about our prospective customers and our customers (and each of their employees and contractors) with certain third party marketing applications, like Google Analytics, ZoomInfo or LinkedIn. These marketing applications may collect information as our service provider and for their own purposes, including via automatic tracking technologies.
6. We also share personal information with the following third parties as we deem necessary:
   1. With legal authorities or third parties if we deem necessary to enforce our rights, or the rights of third parties (including in connection with your breach of this Privacy Policy or any other agreement between us).
   2. When required by any applicable law, rule regulation, subpoena, or other legal process.
   3. In connection with the negotiation or execution of a merger or sale of our business.
   4. To prevent illegal, harmful, fraudulent, or damaging activities.

EEA, UK, & Swiss Data Privacy Rights

Data Subject Rights

If you are a resident of the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, you are entitled to certain rights. These rights include:

1. Right of access and/or portability: You have the right to access any personal information that we hold about you and, in some circumstances, have that data provided to you so that you can provide or “port” that data to another provider.
2. Right of erasure: In certain circumstances, you have the right to the erasure of personal information that we hold about you (for example, if it is no longer necessary for the purposes for which it was originally collected).
3. Right to object to processing: In certain circumstances, you have the right to request that we stop processing your personal information and/or stop sending you marketing communications.
4. Right to rectification: You have the right to require us to correct any inaccurate or incomplete personal information.
5. Right to restrict processing: You have the right to request that we restrict processing of your personal information in certain circumstances (for example, where you believe that the personal information we hold about you is not accurate or lawfully held).

To submit a request to exercise your rights, please contact us at legal@customer.io. If you submit a request related to the Services, we will direct you to submit a request to exercise your rights directly with our customer. We may have a reason under the law why we do not have to comply with your request or may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.

Customer.io complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Customer.io has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Customer.io has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov.

We process personal information, or “Personal Data” as that term is defined in the EU General Data Protection Regulation, on the following legal bases: (1) with your consent; (2) as necessary to perform our agreement to provide Services; and (3) as necessary for our legitimate interests where those interests do not override your fundamental rights and freedom related to data privacy. We may also process personal information as necessary to comply with legal obligations. Information we collect may be transferred to, and stored, and processed in, the United States or any other country in which we or our affiliates or subcontractors maintain facilities, as described above.

Users that reside in the EEA, UK, or Switzerland have the right to lodge a complaint about our data collection and processing actions with the supervisory authority concerned. Contact details for data protection authorities are available here.

Cross-border Transfer of Data

If you use our Services outside of the United States, you understand that we may collect, process, and store your information in the United States and other countries. The laws in the US regarding information may be different from the laws of your state or country. Any such transfers will comply with safeguards as required by relevant law. Where a customer connects a customer-selected communications provider, information may also be routed to, processed by, or stored in the countries or regions supported by that provider and the customer's configuration. Any data residency or regional routing benefit available through a customer-selected communications provider depends on the provider, the customer's account with that provider, and the customer's configuration.

Data Privacy Framework Notice

Customer.io is responsible for the processing of personal information it receives under the DPF and subsequently transfers to a third party acting as an agent on its behalf. Customer.io complies with the DPF Principles for all onward transfers of personal information from the EU, UK, and Switzerland, including the onward transfer liability provisions.

The Federal Trade Commission has jurisdiction over Customer.io’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain situations, Customer.io may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Where Customer.io acts as a processor for a customer, Customer.io processes personal data only on that customer's instructions. This includes location-derived event data, such as whether an end user entered or exited a customer-configured geofence, where a customer chooses to enable location-based features. This also includes information processed through customer-selected integrations or communications providers, such as SMS recipient data, message content, sender identity, delivery events, inbound message activity, opt-out or preference data, registration information, and related metadata, where a customer chooses to connect those providers to the Services. In that context, the customer is responsible for providing notices, choices, permissions, consents, lawful bases, and means to its end users for limiting the use and disclosure of their personal data, and Customer.io does not independently offer those choices or means. Customer-selected integrations or communications providers are not Customer.io subprocessors unless Customer.io engages them directly to provide the Services, and customers are responsible for their own accounts, billing, provider relationships, provider agreements, and provider configurations. If we receive a request relating to personal data that we process on behalf of a customer, we will direct the individual to submit the request to the applicable customer and will support the customer as appropriate in responding to the request. For personal data covered by the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF that Customer.io processes for its own business purposes, Customer.io offers individuals the opportunity to choose whether their personal data is disclosed to a non-agent third party or used for a purpose that is materially different from the purpose for which it was originally collected or subsequently authorized. Individuals may exercise this choice by contacting us at legal@customer.io or by submitting a request through our Personal Information Rights Request Form. Customer.io does not intentionally collect sensitive personal data for its own purposes. If Customer.io processes sensitive personal data under the DPF and uses it for a materially different purpose or discloses it to a non-agent third party, Customer.io will obtain affirmative express consent where required by the DPF Principles.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Customer.io commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Customer.io at: legal@customer.io.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Customer.io commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit jamsadr.com/dpf-dispute-resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

For complaints regarding DPF compliance not resolved by any of the other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration. Further information can be found on the official DPF website.

U.S. State Privacy Rights

If you are a resident of California, Virginia, Colorado, Connecticut, or Utah, or any other state that grants you specific data privacy rights, you may have additional rights regarding our use of your personal information. The rights outlined in this section do not apply to information exempted under applicable state privacy law. Further, the rights described in this Section are not absolute, are subject to exceptions and limitations, and may not be afforded to residents of all states. In certain cases, we may decline requests to exercise these rights where permitted by law.

Persons with disabilities may obtain this notice in alternative format upon request by contacting us at legal@customer.io.

U.S. Privacy Rights

To the extent you are provided additional privacy rights in the state you reside, you have the following rights with respect to the information that we collect (in each case, subject to applicable law):

1. Right to Know: To know the categories and specific personal information we have collected, the categories and sources from which we collected the personal information, the categories of third parties with whom we share personal information, and the business or commercial purpose for collecting or selling (if applicable) personal information, and the right to request information about and opt out of automated decision making (if applicable).
2. Right to Access: To request a copy of the personal information that we have collected about you during the past 12 months.
3. Right to Opt-Out of Sales or Sharing: To opt out of sales of personal information (if applicable) or sharing personal information for Cross-Contextual Behavioral Advertising.
4. Right to Delete: To request that we delete the personal information that we have collected from you.
5. Right to Correct: To correct inaccurate information that we maintain about you.
6. Right to Limit Disclosure of Sensitive Information: To limit the disclosure of sensitive personal information, if we use or disclose sensitive personal information.
7. Freedom from Discrimination: To exercise the rights described above free from discrimination or retaliation as prohibited under applicable law.

Right to Opt Out of the Sale or Sharing of Personal Information to Third Parties

You have the right to opt out of our sale of your personal information or our sharing your personal information for behavioral advertising purposes. To exercise your right to opt out of the sale of your personal information, please visit our “Do Not Sell My Personal Information” webpage.

Exercising Your State Privacy Rights

If you reside in a state that provides specific data privacy rights, you may contact us:

1. By filling out a Consumer Data Request Form available here.
2. By email as indicated in the Contact Us section below.

Your rights may only be exercised by you or by your designated agent. You may submit a request to know twice within a 12-month period unless applicable data privacy law grants you additional rights.

Your request must include enough information to allow us to reasonably verify that you are the person about whom we collected personal information or an authorized representative, which may include: (1) verifying your account information if you have an account with us; or (2) requesting two forms of identification that are reliable for verification purposes, unless the request includes sensitive information and, in which case, we may require three forms of verification and a signed declaration. The information included in your request must allow us to properly understand, evaluate, and respond to it.

We cannot respond to your request if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you. If we cannot verify your identity or authority, we will not fulfill your request. We will only use personal information provided in the request to verify the requestor’s identity or authority to make it.

You may submit a request through a designated agent. You must instruct that agent that they will need to state that they are acting on your behalf when making the request, have reasonably necessary documentation, and be prepared to provide the necessary personal information to properly verify your request.

We will acknowledge receipt of your request. We will provide a substantive response within 45 calendar days or inform you of the reason and extension period (up to a total of 90 days) in writing.

Special Information for Nevada Residents

Residents of the State of Nevada have the right to opt-out of the sale of certain pieces of their information to other companies who will sell or license their information to others. At this time, Customer.io does not engage in such sales. If you are a Nevada resident and would like more information about our data-sharing practices, please email legal@customer.io.

California Shine the Light

Residents of the State of California have the right to request information from Customer.io regarding other companies to whom the company has disclosed certain categories of information during the preceding year for those companies’ direct marketing purposes. If you are a California resident and would like to make such a request, please email legal@customer.io or write to us at 9450 SW Gemini Dr. Suite 43920 Beaverton, Oregon 97008

How We Protect Personal Information

We use a combination of physical, technical, and administrative safeguards to protect the information we collect through the Services. While we use these precautions to safeguard your information, we cannot guarantee the security of the networks, systems, servers, devices, and databases we operate or that are operated on our behalf.

How Long We Retain Personal Information

We retain your personal information for as long as we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax, or accounting requirements).

The criteria used to determine appropriate retention period for personal information include:

1. The amount, nature, and sensitivity of the personal information.
2. The purpose(s) for which the personal information was collected and used.
3. Whether we have a legal obligation to retain personal information or whether retaining personal information is necessary to resolve disputes, including the establishment, exercise, or defense of legal claims.

Changes to This Policy

We may make changes to this Privacy Policy from time to time. We will post any changes here, and such changes will become effective when they are posted. Your continued use of the Site or our Services, or your interaction with us following the posting of any changes will mean you consent to those changes.

Your Choices Regarding Your Information

We offer the following options for updating your information or opting out of our processing of your personal information:

1. Opt-Out of Sales or Sharing: Please visit our Personal Information Rights Request Form or use the applicable privacy choices made available on our Site.
2. Change Your Cookie Preferences: You can use the cookie banner or cookie preference center on our Site to manage your cookie choices, including rejecting non-essential cookies where available.
3. Advertisements: You can learn more about ad serving companies and the options available to limit their collection and use of your information by visiting the websites for the Network Advertising Initiative, the Digital Advertising Alliance, and the European Interactive Digital Advertising Alliance.
4. Web Browser Settings: Most web browsers automatically accept cookies but, if you prefer, you can usually modify your browser setting to disable or reject cookies. If you delete your cookies or set your browser to decline cookies, some features of the Site may not be available or may not work as designed. You may also be able to opt out of or block tracking by interacting directly with the other companies that conduct tracking through our Site.

Contact Us

For questions about our privacy practices, contact us at:

Peaberry Software Inc. d/b/a Customer.io
9450 SW Gemini Dr., Suite 43920, Beaverton, Oregon 97008-7105.

Email: compliance@customer.io
Phone Number: 646-820-9503

• Prior Privacy Policy versionsView earlier versions and the dates they were in effect.