Introduction
Peraly, Inc., a Missouri corporation (“Peraly,” “we,” “us,” or “our”), is responsible for processing the personal information described in this Privacy Policy.
Peraly is a social media management and automation platform. When you connect an Instagram, Facebook, YouTube, TikTok or LinkedIn account, we process content and conversations from that account so you can publish, reply, automate and analyse them in one workspace.
This policy explains what we collect, why, who we share it with, and the controls you have. It applies to the Peraly web application and to this website. It is the same entity that contracts with you under the Terms of Service.
Information We Collect
Three sources: what you give us, what the platforms you connect send us, and what the product records as it runs.
- Information you provide — account details, workspace settings, the content you compose, and anything you put in the knowledge base.
- Information from connected platforms — whatever the Instagram, Facebook, YouTube, TikTok and LinkedIn APIs return under the permissions you grant, listed section by section below.
- Information generated by use — which automations ran, whether a message was delivered, and the reason when one was not.
Account Information
Your name, email address and — if you set one — a password hash, plus your notification, language and time-zone preferences.
Organisation and workspace information: the workspace and organisation names you choose, who belongs to each, the job role and permissions assigned to each member, invitations you send, and the billing contact for the account. Where an organisation owns a workspace, its members can see the workspace’s content according to those roles.
Passwords are hashed with argon2id and are never stored or recoverable in plain text. There is no magic-link sign-in.
You can also sign in with Google. If you do, we receive from Google your account identifier, email address, name and profile picture, and we store those; we never see your Google password. We request only the “openid email profile” scopes — nothing that can read a mailbox, a calendar or a channel — and we keep no Google token afterwards, because signing in is a one-off question and there is nothing for us to do with your Google account later. An account created this way has no password at all until you set one through “forgot password”.
Password Resets
Asking to reset a password creates a single-use link that expires in 30 minutes and is emailed to the address on the account. We store only a hash of that link, so a copy of our database does not contain a working one.
Completing a reset signs you out of every device, including the one you are on. That is the point of it: if the reason for the reset was that somebody else had your password, leaving their session alive would make the exercise decorative.
We do not tell the person asking whether that address has an account — the response is identical either way, for the same reason a failed sign-in does not say which half was wrong.
Instagram / Meta Data
For a connected Instagram account we may process comments, direct messages, story replies, live comments, the media you publish through Peraly, and the account and media metadata the Meta APIs return.
The permissions requested are instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments, instagram_business_manage_messages and instagram_business_manage_insights. Nothing outside those scopes is requested. The insights permission is what lets Peraly show you reach, impressions and engagement for your own posts; it returns aggregate figures about your account, not the identities of the people who saw them.
For a connected Facebook Page we request pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_engagement and read_insights, and we process the Page’s posts, comments and the metadata and insights the Graph API returns for it.
Peraly's use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including their limited use requirements.
YouTube / Google Data
This application uses YouTube API Services. For a connected channel we may process channel information, video metadata, comment threads and the figures the YouTube Analytics API returns for your own channel.
The scopes requested are youtube.upload for publishing videos and Shorts, youtube.readonly for reading the channel and its videos, youtube.force-ssl for moderating and replying to comments, and yt-analytics.readonly for the figures shown on your own analytics screens. No monetisation scope is requested.
By connecting a channel you agree to the YouTube Terms of Service. Google’s handling of data obtained through Google APIs is governed by the Google Privacy Policy. You can revoke Peraly’s access to your Google account at any time at myaccount.google.com/permissions, and disconnecting the channel inside Peraly deletes the stored tokens immediately.
Data obtained from YouTube API Services is stored only for as long as it is needed to operate the features you are using, and is deleted when you disconnect the channel or close your account. We do not use YouTube data to build a profile of anyone, we do not sell it, and we do not combine it with data from other sources for advertising.
To have YouTube data held by Peraly deleted without disconnecting the channel, write to [email protected]. Google’s own security settings page revokes Peraly’s access at their end.
TikTok Data
For a connected TikTok account we request user.info.basic, user.info.profile and user.info.stats for the account’s own profile and public counts, video.list to read the videos on it, and video.upload and video.publish to post on your behalf.
We process the video files and captions you publish through Peraly and the metadata TikTok returns for them. Your use of TikTok through Peraly is also governed by TikTok’s own terms and privacy policy.
LinkedIn Data
For a connected LinkedIn account we request openid and profile to identify the account, w_member_social to post as you, and r_organization_social, w_organization_social and rw_organization_admin to read and post on the company Pages you administer.
We process the posts you publish through Peraly, the Pages you are entitled to manage, and the metadata LinkedIn returns for them. Your use of LinkedIn through Peraly is also governed by LinkedIn’s own terms and privacy policy.
Messages, Comments and Content
To operate the unified inbox we store copies of the messages and comments the connected platforms deliver to us, together with your replies, internal notes, labels, assignments, snoozes and status changes.
Posts, media, captions and scheduled content: the media you upload to the library, the captions, hashtags and descriptions you write, the subtitles and edits you make, the approval decisions recorded against a draft, and the time a post is scheduled for. These are stored until you delete them so the post can be reviewed, scheduled and published, and so the record of what was published survives the platform’s own retention.
Knowledge base entries are stored so AI steps can answer from your facts rather than the model’s — treat anything you put there as content you are choosing to send to your AI provider.
CRM / Contact Data
When someone comments on your posts or messages your account, the platform sends us their platform-scoped ID, username, display name and profile picture, and Peraly creates a contact record. That record may also carry the tags, notes, custom fields, lead score and lifecycle stage you add, plus the conversation history held in Peraly.
This information originates from interactions on the connected platform or from what you record yourself. You are responsible for handling it lawfully — see “People who message you” below.
AI Processing
AI features generate replies, captions, hashtags, descriptions, summaries and content suggestions, and classify conversations by intent and sentiment. There are six distinct AI jobs — flow steps, intent, flow generation, copy polishing, video analysis and inbox assist — and each can be pointed at a different provider.
When you use one, the relevant content is sent to that provider: the message being answered, the post being written, the knowledge base entries you supply, or the video being analysed. If you do not use an AI feature, nothing is sent to any provider.
AI output is a suggestion. It fills a box for you to edit, send or ignore; nothing is published or sent on your behalf because a model produced it. It can also be wrong, and reviewing it before it goes out is your responsibility.
How We Use Information
We use the information above to:
- Provide and operate the features you have enabled.
- Publish, schedule and deliver content to connected platforms.
- Run the automations, rules and flows you configure.
- Generate the AI output you ask for.
- Produce analytics about your content, conversations and automations.
- Secure the service, prevent abuse and diagnose faults.
- Contact you about your account, billing and service changes.
Third-Party AI Providers
The supported providers are Google (Gemini), Anthropic (Claude) and OpenAI. Only the ones you configure are ever contacted, and content sent for processing is subject to that provider’s own terms and privacy commitments.
From the Starter plan up you can supply your own API key. It is encrypted at rest, used only for your workspace, and billed by the provider rather than metered by us. We do not use your content or your contacts’ messages to train any model.
Data Storage
Relational data — accounts, workspaces, contacts, posts, flows — in PostgreSQL. Message and comment content in MongoDB. Uploaded media in S3-compatible object storage. Short-lived queue and cache state in Redis.
Peraly runs on Amazon Web Services in the US East (N. Virginia) region. PostgreSQL is Amazon RDS, Redis is Amazon ElastiCache, media is Amazon S3, and the application itself runs on Amazon ECS behind Amazon CloudFront. Both databases sit in private subnets with no route to the internet. MongoDB is hosted by MongoDB Atlas. If you are located elsewhere, your data is processed in the United States.
Analytics
The analytics inside the product are computed from your own workspace data — your messages, your posts, your automation runs, and the reach and engagement figures the connected platforms return for your own accounts — and are shown only to your workspace.
Usage and operational information is recorded as the product runs: which automations and jobs executed and with what result, publishing and delivery outcomes and the platform’s reason when something failed, audit-log entries for sensitive actions in a workspace, and server-side request and error logs containing IP address, user agent and timestamps. This is used to operate the service, diagnose faults, enforce plan limits and prevent abuse — not to build a profile of you and not for advertising.
This build ships no third-party analytics, product-telemetry or session-recording script on the website or in the application.
Payments and Stripe
Paid subscriptions are processed by Stripe. Stripe collects and processes your payment details directly; Peraly never receives or stores full card numbers. We retain the subscription status, plan, billing contact and invoice records associated with your workspace.
Stripe’s handling of your payment information is governed by Stripe’s own privacy policy.
Data Retention
Account and workspace data is kept for as long as the account exists. Delete a contact, message, post or media file and it is removed from the live databases.
Message and comment history is additionally subject to a per-plan retention window: 30 days on Free, 365 days on Starter, and unlimited on Pro and Agency. A 30-day grace period is applied on top of the plan window before anything is swept, so a plan change never destroys history retroactively.
Data Security
Passwords are hashed with argon2id. Platform access tokens and AI provider keys are encrypted at rest with AES-256-GCM and are never returned by the API once stored. Password reset links are stored hashed, single-use, and expire in 30 minutes. Sessions use short-lived access tokens with rotating refresh tokens.
Access to a workspace is limited to the members you invite, with per-role permissions and an audit log of the sensitive actions. Outbound HTTP steps in flows cannot be pointed at private network addresses or cloud metadata endpoints.
No system can be guaranteed completely secure, and we hold no security certification. We do not claim one.
If There Is a Breach
If we become aware of a security incident involving personal information, we will investigate and provide notifications as required by applicable law.
Where you use Peraly to hold your own contacts’ data, we are your processor for it. In that case we will inform you of an incident affecting that data as required by applicable law, so that you can meet your own obligations to the people concerned.
Data Sharing
Peraly, Inc. does not sell personal data and does not share it for advertising. We do share it, because running the service requires it: the providers below receive the data described against each, they act on our instructions, and they are not permitted to use it for their own purposes. We also disclose information where the law requires it, and to a successor if the business is acquired.
If you configure a Slack, webhook or email destination for alerts, we send that destination the alert: what failed, on which workspace and channel, and when. Webhook deliveries are signed so you can verify they came from us. You choose those endpoints and are responsible for where they point.
Other members of your workspace can see the content and contacts in it, according to the roles you assign.
The service providers we rely on today are listed below. We will update this list before adding one that processes personal data.
- Amazon Web Services — application hosting, PostgreSQL, Redis, media storage and email delivery (Amazon SES), in the US East (N. Virginia) region.
- MongoDB Atlas — message and comment content.
- Stripe — subscription billing and payment processing.
- Google, Anthropic and OpenAI — AI processing, and only the providers you have configured.
- Cloudflare — DNS for peraly.com.
- The social platforms you choose to connect — Meta (Instagram, Facebook), Google (YouTube), TikTok and LinkedIn — receive and return data under the permissions you granted them.
User Rights
Depending on where you live you may have rights to access, correct, export, restrict or delete your personal information, to know what we collect and who we share it with, and to object to certain processing. Most of these can be exercised directly in the product without asking us: every record is editable or deletable, contacts export to CSV, and closing your account deletes its contents.
To make a request that the product cannot satisfy on its own, write to [email protected]. We will verify that the request comes from you or someone authorised to act for you before acting on it — for an account holder, from the email address on the account. We do not charge for a request and we will not treat you differently for making one.
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in US state privacy laws. There is no advertising in Peraly and no advertising identifier is collected.
If we decline a request, we will say why, and you may appeal by replying to our response. Several US state privacy laws give you the right to appeal a refusal and then to complain to your state Attorney General.
Data Export
Contacts export to CSV and analytics reports can be downloaded from within the product. Export is a paid feature — it is available from the Starter plan up, and is not gated behind a support request at any tier.
Account and Data Deletion
You can disconnect any social account at any time, which deletes its stored access and refresh tokens immediately and stops everything aimed at it. Disconnecting is not the same as deleting: the contacts and conversation history the channel gathered stay in your workspace until you delete them or close the account.
Closing your account removes your workspaces and their contents from the live service — contacts, conversations, message content, drafts, media and connected-channel records.
Deletion removes data from the live databases. Copies may persist in encrypted backups until those backups expire on their normal cycle.
Instagram and Facebook Data Deletion
Meta requires an app to accept two callbacks, and Peraly implements both. They are the route a person uses when they want their data removed and would rather not sign in here to do it.
Deauthorisation. If you remove Peraly from your Instagram or Facebook account inside Meta’s own settings, Meta calls Peraly and we disconnect the matching channel and delete its stored tokens. You do not have to come here and do it a second time.
Data deletion. Choosing to delete your data from within Meta’s settings sends Peraly a signed deletion request. We verify the signature, erase what is held for that account — the connection, the contacts and conversations it gathered, and the message content — and return a confirmation code with a status URL, as Meta requires. Opening that URL says whether the deletion is in progress, has completed, or found nothing to delete, and it needs no account and no sign-in.
If the erasure fails, the request is recorded and finished by hand rather than dropped; the status page says so and gives you the code to quote.
The callbacks are registered with Meta at /api/webhooks/instagram/data-deletion and /api/webhooks/facebook/data-deletion, with the confirmation page at /api/webhooks/instagram/data-deletion/status. You can also simply write to [email protected] and ask.
Third-Party Services
Peraly integrates with services we do not control — Instagram, YouTube, Stripe, the AI providers you configure, and Google if you sign in with it. Their handling of your information is governed by their own policies, and we are not responsible for their acts or omissions.
People Who Message You
If you use Peraly, you are the controller of your contacts’ data and we are your processor. You are responsible for having a lawful basis to store and message them, and for honouring their requests.
If someone asks you to delete their data, deleting the contact in Peraly removes it from our systems.
Children's Privacy
Peraly is not intended for children. You must meet the minimum age set out in our Terms of Service to use it, and we do not knowingly collect personal information from anyone below that age.
International Data Processing
Peraly, Inc. is based in the United States and the service runs in the US East (N. Virginia) region. If you use Peraly from outside the United States, your information is transferred to and processed in the United States, under United States law, which may give it different protection from the law where you live.
Where required, we rely on appropriate safeguards for those transfers.
Changes to This Policy
We may update this Privacy Policy from time to time. When required by applicable law, we will provide appropriate notice of material changes. The updated policy will display a revised effective date.
We encourage you to review this page periodically. Continuing to use Peraly after an update takes effect means the updated policy applies to you.
Contact Information
The controller responsible for the processing described here is Peraly, Inc., a Missouri corporation.
Written correspondence about this policy can be addressed to:
Peraly, Inc.
212 W 99th Ter
Kansas City, MO 64114-4304
United States
Questions about this policy, about how your information is handled, or a request to access, export or delete it can be sent to [email protected]. It is a monitored mailbox and a person reads it.
Peraly’s website is peraly.com. What we will not tolerate from people using Peraly — including anything resembling spam — is set out in the Acceptable Use Policy, and the agreement you are under is the Terms of Service.
Social Platform APIs
Peraly reaches a connected account only through the platform’s official API, and only within the scopes you approved. Nothing scrapes a page, drives a headless browser or signs in as you.
Platform capabilities, rate limits and data availability are controlled by those platforms and can change without notice.