This Privacy Policy explains what information Pursor, LLC ("Pursor") collects, how we use and share it, and the rights you have over it. It applies to our website, dashboard, mobile apps, and AI tools (the "Service").
Pursor handles two distinct types of personal data:
We use your information to:
When you use AI features, the text and context you provide are sent to our AI model provider(s) — currently Anthropic — to generate drafts. We have contractual protections in place: AI providers do not retain your data for training, and content is not used to train general models.
When a customer texts your business, the text of that message may be sent to TypeSafe AI to classify what it’s about and how urgent it is, so your Inbox can label and order it. We never send the customer’s name, phone number or other contact details from their record, and we remove phone numbers and email addresses from the message text before it is sent. TypeSafe does not use this data to train models, processes it under a data processing agreement in the United States, and retains no message content: under its zero-data-retention setting, enabled for Pursor’s account, the text is deleted as soon as the classification is returned.
When you connect your Google account, Pursor requests access to: read your Gmail messages (gmail.readonly); send email on your behalf (gmail.send); and manage events on calendars you own (calendar.events.owned) for scheduling.
How reading works: on a short polling schedule, Pursor checks your inbox for recent unread messages and reads the sender, subject, headers, and the beginning of the message body. Pursor never replies to automated mail: no-reply and bounce addresses, automatic and out-of-office replies, mailing lists and newsletters (mail with list or unsubscribe headers, or marked as bulk), your own address, and mail from Pursor itself. It won’t draft a reply to those even if you ask. Mail in Gmail’s Promotions, Social, Updates and Forums tabs, and mail from addresses like info@ or notifications@, is not drafted automatically, but you can ask for a draft and send it yourself. For messages that look like a real person writing to your business, the message content is sent to our AI provider (Anthropic — see above) to generate a reply draft, which waits for your approval. Sending happens only when you approve a draft, and your reply goes into the same Gmail conversation as the original email. We do not label, modify, archive, or delete your email.
Pursor's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data to train AI models, for advertising, or for any purpose other than providing the features you enable. The Google access tokens we hold are encrypted at rest with a dedicated key.
You can disconnect Google at any time in Settings → Connections → Disconnect Google. Disconnecting revokes Pursor's access with Google (we call Google's token-revocation endpoint), deletes the access tokens we stored, and deletes the email content Pursor stored: the text, senders and subjects of email drafts (including the original emails they answered) and of emails Pursor skipped. We keep only the count of drafts written, with no content, for your plan's draft allowance and your Results. You can also remove Pursor's access from your Google Account at myaccount.google.com/permissions. See How to delete your data.
We keep information only as long as needed for the purposes above:
How to do each of these, step by step: How to delete your data.
Depending on your state, you may have the right to:
To exercise any of these rights, email privacy@pursor.co. To delete your account you can also use Settings → Plan & account → Delete my account. We respond within 45 days. We will verify your identity before processing the request.
You may designate an authorized agent in writing to make a request on your behalf. We will require proof of authorization.
California residents may request a notice describing what personal information we share with third parties for their direct marketing purposes. We do not share personal information for third-party marketing, so the answer is "none."
If you are in the European Economic Area or the United Kingdom and you are using Pursor as a business customer, our legal bases for processing are: contract (to provide the Service you signed up for), legitimate interest (security, fraud prevention, product improvement), legal obligation (tax, TCPA-like requirements), and consent (where we ask for it). You have rights under GDPR/UK GDPR to access, rectify, erase, restrict, port, and object to processing. Contact us at privacy@pursor.co.
We use commercially reasonable safeguards including encryption in transit (TLS 1.2+) and at rest (AES-256) — sensitive fields such as business EINs and Google OAuth tokens carry an additional layer of application-level AES-256-GCM encryption, each under its own dedicated key — plus least-privilege access controls. We use two-factor authentication on the accounts that run Pursor. No system is perfect — we encourage you to use a strong password and enable account security features. If we discover a security incident affecting your information, we will notify you and applicable regulators as required by law, and we report incidents involving Google user data to Google. Our security and incident-response policy, and how to report a problem: Security.
The Service is not directed to children under 13 (or 16 in some jurisdictions), and we do not knowingly collect personal information from children. If you believe we have collected information from a child, contact privacy@pursor.co and we will delete it.
Pursor is operated from the United States, and your data is processed in the United States: our database (Supabase) is in Oregon (us-west-2), and our hosting (Vercel) and error tracking (Sentry) use US regions. Our workflow tool, n8n Cloud, processes some data in Germany (EU): the missed-call events it turns into texts and the recent Gmail messages it reads to draft replies. If you need specific data-transfer terms, contact us at privacy@pursor.co.
When a business uses Pursor to send text messages, those messages are sent to the business's own customers, who have provided their phone number to that business and agreed to receive texts in connection with a service relationship.
For the full rules that govern messaging through Pursor, including how consent is obtained, see our SMS Consent Flow and Terms of Service.
We may update this Policy as our practices change. We will update the "Last updated" date at the top and, for material changes, notify you by email or an in-app prompt at least 14 days before they take effect.
For privacy questions or to exercise your rights: