PERSONYZE® Terms and conditions

Personyze Terms of Subscription Service

Last updated: October 2026

These Terms of Subscription Service (the “Agreement”) are a binding agreement between Personyze and you for the Service defined below. By creating an account, accepting this Agreement, signing an order form that references it, or using the Service, you agree to this Agreement. If you accept on behalf of a company or other legal entity, you confirm that you have authority to bind it, and “you” means that entity. If you do not agree, do not use the Service.

You may not use the Service if you are a direct competitor of Personyze, or on behalf of or for the benefit of one.

1. Your account

You need an account to use the Service (the “Account”). Keep its information accurate and your login details confidential. You are responsible for all activity in your Account, except where caused by Personyze’s breach of this Agreement, and you will tell us promptly about any unauthorized use. Personyze staff may access your Account and Client Data only as needed to provide, support, secure or improve the Service, to answer your requests, or as required by law; that access is logged and limited to staff bound by confidentiality.

2. The Service

“Service” means the Personyze software-as-a-service under the plan and add-ons you choose in your Account or in an order form (an “Order”). During the Term you may place the Personyze tracking code on websites, apps and other channels you own or control (“Client Websites”) to collect data for the Service, and use our documentation (the “Documentation”). We may improve or change the Service, the tracking code and the Documentation from time to time. The limits of your plan are set out in the Service schedule below.

3. Acceptable use

You and the people you allow to use your Account (“Users”) will not: (i) resell, sublicense or make the Service available to anyone other than Users, except under a separate partner agreement with Personyze; (ii) copy, modify or reverse-engineer the Service, or use it to build a competing product; (iii) disrupt the Service, or try to gain unauthorized access to it or to related systems; (iv) use it to send viruses or other malicious code; or (v) use it to collect or process unlawful material, or data in violation of anyone’s privacy rights or of applicable law. You are responsible for your Users’ compliance with this Agreement, and for the legality of Client Data and of how you obtained it. You may publish the results you achieve with the Service. Personyze may use its own products to analyze how the Service is used, in order to improve it.

4. Ownership

The Service, the tracking code, the Documentation, our APIs and all related intellectual property belong to Personyze and its licensors, and Personyze keeps all rights not expressly granted to you. All data collected and analyzed for your Account (“Client Data”) belongs to you.

5. Fees and payment

You will pay the fees for your plan and add-ons shown in your Account or Order (the “Service Fees”), in the currency shown there. Service Fees exclude taxes; you are responsible for any sales tax, VAT, GST or similar taxes. Except where a money-back guarantee applies (as stated on our pricing page or in your Order) or this Agreement says otherwise, Service Fees are non-refundable. If a payment is more than thirty (30) days overdue, Personyze may suspend or end your access to the Service.

6. Privacy and data protection

6.1 Processing. You authorize Personyze to collect, store and process Client Data under this Agreement and the Data Processing Addendum in Annex A (the “DPA”). For personal data, you are the controller (or business) and Personyze is your processor (or service provider), except for data Personyze processes for its own account administration, billing, security and fraud prevention. If this Section and the DPA conflict on personal data, the DPA applies.

6.2 Your notices and consents. Each Client Website must have a privacy notice that tells visitors it uses an analytics and personalization service, what data is collected (including through cookies and similar technologies), why, and how visitors can exercise their rights. You are responsible for obtaining any consents the law requires (including cookie consent) and honoring opt-outs (such as Global Privacy Control signals) before data is collected, and for complying with the privacy laws that apply to you, including the GDPR, the UK GDPR and the CCPA.

6.3 Data you must not send. Unless Personyze has agreed in writing, do not use the Service to collect or send government identification numbers, financial account or payment card numbers, passwords, health or medical information, precise geolocation, biometric or genetic data, special categories of data under GDPR Article 9, personal data of children under 13 (or under 16 where that applies), or any other data the law treats as sensitive.

6.4 Security. Personyze maintains administrative, technical and physical safeguards to protect Client Data, as described in the DPA. If Personyze confirms a security incident affecting Client Data, it will notify you without undue delay and within seventy-two (72) hours, and will help with your investigation and with any notifications you must make.

6.5 Indemnities. You will defend and indemnify Personyze against third-party claims, fines and reasonable costs arising from your or your Users’ collection or use of Client Data in breach of this Agreement, the DPA or the law. Personyze will defend and indemnify you against third-party claims, fines and reasonable costs arising from Personyze’s breach of Section 6.4 or the DPA. The party seeking indemnity must notify the other promptly, let it control the defense and settlement (no admission of liability without consent), and cooperate reasonably.

7. Client Data

Personyze retains Client Data according to the retention settings in your Account and its data retention practices, which it describes on request. You can export Client Data at any time during the Term, and for a reasonable period after it as described in the DPA, using the Service’s export functions and APIs. Data you upload from other sources is treated as Client Data and counts toward your plan. Use of our APIs is subject to the API documentation. If you connect a third-party application, you allow its provider to access Client Data as needed for it to work, and that provider’s own terms apply.

8. Support

Your plan includes the support described for it. Setup help, managed services and other professional services are included only as stated in your plan or Order, or under a separate agreement.

9. Warranty and disclaimer

Personyze warrants that it has the right to provide the Service and will provide it in a professional manner consistent with industry standards. This warranty does not cover any part of the Service modified by anyone other than Personyze. Apart from this warranty, the Service, the tracking code, the Documentation, reports and Client Data are provided “as is”, and Personyze, its suppliers and licensors make no other warranties, express, implied or statutory, including warranties of merchantability, fitness for a particular purpose and non-infringement, and do not warrant that the Service will be uninterrupted or error-free.

10. Limitation of liability

Personyze, its suppliers and licensors will not be liable for any indirect, special, incidental, punitive or consequential damages, including lost profits or lost data, however caused and even if advised of their possibility. Personyze’s total liability arising out of or relating to this Agreement or the Service will not exceed the fees you paid to Personyze for the Service in the six (6) months before the event giving rise to the claim.

11. Term, renewal and cancellation

11.1 Term and renewal. This Agreement starts when you open your Account or when Personyze confirms your Order, and continues while you have a subscription (the “Term”). Your subscription renews automatically at the end of each billing period, monthly or yearly as you chose, unless you cancel. Personyze will tell you in advance of any price change that applies to a renewal.

11.2 Renew, change or cancel at any time. You can renew, cancel, upgrade or downgrade your subscription at any time from your Account. The change takes effect immediately; there is no notice period. Fees already paid are refunded only as Section 5 provides.

11.3 Termination for cause. Either party may terminate this Agreement by written notice if the other materially breaches it and does not cure the breach within thirty (30) days of being notified. Personyze may terminate immediately by notice if you materially breach Section 3 or Section 6. If you terminate because of Personyze’s uncured material breach, Personyze will refund prepaid fees for the unused part of the Term. Personyze may also end your subscription at the end of a billing period by telling you in advance by email.

11.4 After termination. Your access ends, and you must remove the Personyze tracking code from your Client Websites. You may delete your Account from its settings; otherwise Personyze deletes it and its data as described in the DPA. Sections 4, 6, 7, 9 and 10 and the DPA’s return-and-deletion terms survive termination.

12. Changes to this Agreement

Personyze may update this Agreement by posting a new version on www.personyze.com. For a change that materially reduces your rights or increases your obligations, Personyze will give you at least thirty (30) days’ notice by email or in the product; if you object, you may cancel before the change takes effect and receive a pro-rata refund of prepaid fees for the unused part of the Term. Using the Service after a change takes effect means you accept it.

13. AI features

Some features of the Service use artificial intelligence, for example to write page content, emails and campaigns, to recommend products and content, and to answer your visitors in the AI chat. AI output can be inaccurate or incomplete. Review AI-written content before you publish it. You are responsible for the content you publish and for the material you give the AI chat to answer from, and you should check that its answers suit your business. Some AI features use AI credits; your plan states how many credits are included and how further use is charged. To provide these features, Personyze sends the data each feature needs to the AI providers listed in Annex 3.

14. General

This Agreement, with any Orders, is the entire agreement between the parties on its subject and replaces any earlier agreements or proposals; terms in your purchase orders do not apply. Changes to it must be in writing, except as described in Section 12. Personyze is not responsible for delays or failures caused by events beyond its reasonable control. If any provision is unenforceable, the rest remains in force. A waiver of one breach is not a waiver of any other. You may not assign this Agreement without Personyze’s consent, except to a successor in a merger or a sale of substantially all your assets that is not a competitor of Personyze; Personyze may assign it in a merger, reorganization or sale of its business. Each party will comply with applicable export control and sanctions laws, and you confirm you are not on any U.S. government restricted-party list. This Agreement is governed by the laws of the State of New York, without regard to its conflict-of-laws rules, and disputes will be brought exclusively in the state or federal courts in New York County, New York. The UN Convention on Contracts for the International Sale of Goods does not apply.

Service schedule

Your plan sets your allowances, such as monthly pageviews, the number of domains and any managed-service hours. Pageviews, API calls and email-delivery requests count toward your pageview allowance. Usage above your allowance is billed at your plan’s overage rate, and extra managed-service hours at your plan’s hourly rate. Personyze tries to alert you as you approach your allowance, but you are responsible for monitoring your usage.

Annex A — Data Processing Addendum (DPA)

This DPA is part of the Agreement and governs Personyze’s processing of personal data on behalf of the customer (the “Customer”) in connection with the Service. Terms not defined here have the meanings given in the Agreement or in Applicable Data Protection Law.

1. Definitions. “Applicable Data Protection Law” means the data protection and privacy laws that apply to the processing, including the GDPR, the UK GDPR, the CCPA and other U.S. state privacy laws, Canada’s PIPEDA and Brazil’s LGPD. “Personal Data” means personal data in Client Data that Personyze processes for Customer. “Controller”, “Processor”, “Data Subject”, “Processing”, “Sub-processor”, “Business”, “Service Provider”, “Sell” and “Share” have the meanings given in Applicable Data Protection Law. “Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data; unsuccessful attempts such as failed logins, pings or port scans are not Security Incidents. “SCCs” means the EU Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, and “UK IDTA” means the UK International Data Transfer Addendum to them.

2. Roles and instructions. Customer is the Controller (or a Processor acting for its own controller) and Personyze is the Processor. Under the CCPA and similar U.S. state laws Personyze is a Service Provider: it does not Sell or Share Personal Data, does not use it outside the business relationship with Customer, and does not combine it with personal data from other sources except as the law permits; the Service Fees are not consideration for Personal Data. Customer may take reasonable steps to ensure Personyze uses Personal Data in line with the CCPA and to stop and remedy unauthorized use, and Personyze will tell Customer if it can no longer meet these obligations. Personyze processes Personal Data only on Customer’s documented instructions (the Agreement, this DPA and Customer’s configuration of the Service) or as the law requires, and will tell Customer if it believes an instruction breaks the law. Personyze may process limited operational data (account contacts, usage logs, billing, security and fraud prevention, and aggregated or de-identified data) as an independent controller under its privacy notice. Customer confirms it has given the notices and obtained the consents this processing requires.

3. Personnel and security. Personnel with access to Personal Data are bound by confidentiality, trained, and given access only as needed. Personyze maintains the measures in Annex 2 and will not materially reduce their overall level of protection.

4. Sub-processors. Customer authorizes Personyze to use Sub-processors (Annex 3). Personyze will give thirty (30) days’ notice by email of a new Sub-processor that materially affects the processing. Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees. Personyze binds each Sub-processor to data-protection terms at least as protective as this DPA and remains liable for them.

5. Security incidents. Personyze will notify Customer without undue delay, and within seventy-two (72) hours, after confirming a Security Incident, with what is then known about its nature and scope, the data and Data Subjects affected, its likely consequences and the measures taken, and will cooperate with Customer’s investigation and notifications. A notification is not an admission of fault.

6. Data subject requests and assessments. The Service lets Customer access, correct, delete, restrict and export Personal Data to answer Data Subject requests; where it cannot, Personyze will help on request. Personyze will not answer a Data Subject directly except to refer them to Customer. Personyze will reasonably assist with data protection impact assessments and consultations with regulators.

7. International transfers. Where Personal Data subject to the GDPR is transferred outside the EEA to a country without an adequacy decision, the SCCs are incorporated by reference: Module Two (controller to processor) or Module Three (processor to processor), as applicable; Clause 7 applies; Clause 9 Option 2 applies, with the notice period in Section 4; the optional wording in Clause 11 does not apply; under Clauses 17 and 18, Irish law and the courts of Ireland; and Annexes 1 to 3 below complete the SCCs’ annexes. For UK transfers the UK IDTA is incorporated.

8. Audit. On reasonable request and under confidentiality, Personyze will provide the information needed to demonstrate compliance with this DPA, such as security questionnaires, penetration-test summaries or third-party audit reports. If that is not enough under Applicable Data Protection Law, Customer or an agreed independent auditor (not a Personyze competitor) may audit once a year, on thirty (30) days’ notice, during business hours and at Customer’s expense. Regulators may audit as the law requires.

9. Return and deletion. When the Agreement ends, Personyze will return or delete Personal Data, as Customer chooses, within ninety (90) days, except where the law requires it to be kept. Encrypted backups are deleted on the normal backup cycle. Aggregated or de-identified data is not covered.

10. Liability and precedence. Liability under this DPA is subject to the Agreement’s limitation of liability, except where the law does not allow it. On personal data this DPA prevails over the Agreement, and the SCCs or the UK IDTA prevail over this DPA. This DPA applies while Personyze processes Personal Data for Customer.

Annex 1 — Description of processing

Subject matter and purpose: personalization, A/B testing, targeting, product and content recommendations, email and reporting for Customer’s websites, apps and email. Duration: the Term, plus the return-and-deletion period. Data Subjects: visitors to Client Websites; Customer’s prospects, customers, users and email subscribers; Customer’s Account users. Personal Data: online identifiers (cookie and device IDs, IP addresses), browsing behavior, inferred segments, approximate location, email addresses and CRM identifiers Customer provides, and other attributes Customer chooses to send. Sensitive data: none (see Section 6.3 of the Agreement). Frequency: continuous. Retention: per Customer’s settings and Personyze’s retention practices. Supervisory authority: as determined under SCC Clause 13; where Customer has no EU establishment, the Irish Data Protection Commission.

Annex 2 — Technical and organizational measures

Encryption of Personal Data in transit (TLS); role-based, least-privilege access limited to personnel who need it; firewalls and access logging; regular patching of production systems; a written incident-response process; personnel under confidentiality with privacy and security training; reputable cloud hosting for physical security; backups of production data; and data minimization where practicable. More detail is available on request.

Annex 3 — Sub-processors

Personyze uses these Sub-processors. Personal Data is hosted in the European Union (Ireland); where a Sub-processor processes it outside the EEA, Section 7 applies.

• Amazon Web Services — hosting, database, content delivery and email sending
• OpenAI — AI features: writing content, recommendations and AI chat answers
• Anthropic — AI features: writing content, recommendations and AI chat answers
• Google — web push notifications and maps
• WeatherAPI.com and OpenWeather — weather for a visitor’s approximate location
• Hunter and Apollo — finding contacts at a visitor’s company, only when Customer turns on company follow-up

Personyze updates this list as described in Section 4.

Questions about these Terms or about data protection? Contact support@personyze.com.