Privacy Policy

1. Who we are

Iris Assistant, Inc., doing business as Persona (“Persona”, “we”, “us”, “our”), provides an AI personal assistant delivered as a mobile and web application with a cloud backend (together with this website, the “Service”). We are the data controller for the personal data described in this policy.

2. Scope

This policy covers the Persona applications (iOS and web), this website (app.getpersono.com), and the backend services that power them. It does not cover third-party services you choose to connect to Persona — those are governed by their own privacy policies (see §7 and §8).

3. The short version

• Persona acts on content you choose to connect (email, calendar, messages, contacts, files, and — if you use it — voice calls) to help you get things done.
• To answer your requests, Persona sends relevant content to third-party AI model providers. We disclose which ones below, and you consent to this when you use Persona’s AI features.
• We do not sell your personal information, and we do not use your connected content for advertising or to train generalized AI models. The only “model” your data shapes is your own Persona — the private memory that personalizes it for you alone.
• You can access or delete your data at any time — see Your rights (§11).

4. Information we collect

a. Information you provide

• Account data: your name, email address, and/or phone number (used for sign-in, including one-time-passcode verification), and authentication identifiers managed through Firebase Authentication.
• Content you connect or create: when you connect an account or grant a permission, Persona accesses the data you authorize — e.g. email, calendar events, contacts, tasks, messages, and files you upload. Persona also stores your conversations with it and a memory derived from them to provide continuity and personalization.
• Voice / call data (optional): if you use Persona’s voice and calling features, we process call audio and transcripts to operate the feature and to show you what happened on the call.
• Waitlist data: if you join the early-access list on this site, we store the email address you submit so we can contact you about access.

b. Information collected automatically

• Usage and device data: app interactions, device and OS identifiers, language settings, IP address, and diagnostic logs used for security, reliability, and product improvement.
• Location (optional): if you enable location-based features, we process visit and location signals to offer relevant, in-context suggestions. You can disable this at any time in your device settings.

c. Information from integrations

When you connect a third-party account (e.g. Google or Microsoft / Outlook), we receive data from that service strictly within the scopes you grant on that provider’s consent screen. For Google, depending on what you choose to connect, this can include Gmail (reading, drafting, labeling, and sending email on your behalf), Google Calendar, Google Drive, Docs and Slides (finding, reading, creating and editing documents you ask Persona to work on), Google Contacts (including contact photos and the people you correspond with), Google Tasks (read-only), and YouTube (read-only — e.g. subscriptions and playlists used to personalize Persona for you). You can disconnect an integration at any time in the app, and revoke access from the provider’s side (e.g. your Google Account security settings).

5. How we use your information

We process your personal data for these purposes and legal bases:

We do not use your connected content (email, calendar, messages, files, voice) for advertising, we do not use it to train generalized AI models (only the private memory that personalizes Persona for you alone), and we do not sell it.

6. AI processing and third-party model providers

To fulfill your requests, Persona sends relevant content (your prompts and the connected context needed to answer) to third-party large-language-model providers, routed through OpenRouter to providers such as Anthropic (Claude), Google (Gemini), and Moonshot (Kimi).

• These providers process your content solely to generate a response to your request.
• We do not use your content to train AI models, and we select providers and configure routing to limit their use of your content to providing the service.
• This sharing is a core part of how Persona works; by using Persona’s AI features you consent to it. Apple’s App Store rules require explicit disclosure of sharing personal data with third-party AI — this section provides it.

7. Who we share data with (subprocessors)

We share data only with service providers that help us operate Persona, under contract and only as needed:

We may also disclose data to comply with law, enforce our terms, or protect rights and safety, and in connection with a corporate transaction (with notice where required). We do not sell your personal information and do not “share” it for cross-context behavioral advertising (as those terms are defined under California law).

8. Google & Microsoft user data (Limited Use)

If you connect a Google account, Persona’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• only use Google user data (e.g. Gmail messages, Calendar events, Drive files, Docs and Slides, Contacts, Tasks, YouTube activity) to provide and improve the user-facing features you request — drafting and sending replies, triaging and organizing mail, scheduling, finding and editing your documents, creating documents and presentations you ask for, and personalizing Persona’s assistance to you;
• do not transfer Google user data to third parties except as necessary to provide those features (e.g. sending relevant content to the AI providers in §6 to answer your request), for security, or as required by law;
• do not use Google user data for advertising of any kind, including retargeting or interest-based advertising, and do not use it to determine credit-worthiness or for lending purposes;
• do not transfer, sell, or use Google user data to create, train, or improve any machine-learning or artificial-intelligence model — the only exception is the personalized memory and models that serve you alone (e.g. Persona’s memory of your preferences), which never inform other users or any generalized model; and
• do not allow humans to read your Google user data unless you give explicit consent for specific data, it is necessary for security (e.g. abuse investigation), it is required by law, or the data has been aggregated and anonymized.

The same limited-use commitments apply to data we receive from Microsoft Graph if you connect an Outlook / Microsoft account.

9. Data retention

We keep personal data only as long as needed for the purposes above, then delete or anonymize it, in line with our internal Data Retention Policy. In general, account data is kept for the life of your account, and operational logs are kept for a limited period for security and reliability. When you close your account or request deletion, we delete or anonymize your personal data within a reasonable period, except where we must retain it to meet a legal obligation. You can request deletion at any time (see §11).

10. Security

We protect your data with technical and organizational measures including encryption in transit (TLS 1.2+), encryption at rest for the production database and provider-managed encryption for cloud services, per-user data isolation enforced at the database level, network firewalls, least-privilege access, monitoring, and regular backups. No system is perfectly secure, but we work to protect your information. Our security program is being assessed under SOC 2 (examination in progress).

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to the processing of your personal data, and to withdraw consent. California residents have the right to know, delete, correct, and opt out of sale / sharing (note: we do not sell or share for advertising). To exercise any right, email legal@meetiris.com or use the in-app deletion controls. You may also lodge a complaint with your local data-protection authority. We will not discriminate against you for exercising your rights.

12. International transfers

We process and store data primarily in the United States. If you access Persona from the EU, UK, or other regions, your data is transferred to the U.S. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

13. Children

Persona is not directed to children. You must be at least 18 years old to use Persona. We do not knowingly collect data from children below the applicable age; if we learn we have, we will delete it.

14. Changes to this policy

We may update this policy. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice as required.

15. Contact

Questions or requests: legal@meetiris.com · Iris Assistant, Inc. (d/b/a Persona), 801 S Miami Ave, Miami, FL 33131, USA.