Privacy Policy

Last updated: 17 August 2026

PRE-LAUNCH — NOT YET REVIEWED BY COUNSEL

Peraly is preparing for early access. This policy describes accurately what the software stores, who it shares data with and how it is secured — those parts are read off the code. It has not yet been reviewed by counsel, and a small number of items settle once the operating entity is incorporated: its registered name and address, the lawful bases relied on in the EU and UK, and concrete backup and log retention periods.

Introduction

Peraly is a social media management and automation platform. When you connect an Instagram or YouTube account, we process content and conversations from that account so you can publish, reply, automate and analyse them in one workspace.

This policy explains what we collect, why, who we share it with, and the controls you have. It applies to the Peraly web application and to this website.

Information We Collect

Three sources: what you give us, what the platforms you connect send us, and what the product records as it runs.

Information you provide — account details, workspace settings, the content you compose, and anything you put in the knowledge base.
Information from connected platforms — whatever the Instagram and YouTube APIs return under the permissions you grant, listed section by section below.
Information generated by use — which automations ran, whether a message was delivered, and the reason when one was not.

Account Information

Your name, email address and — if you set one — a password hash, plus workspace names, team membership and role assignments.

Passwords are hashed with argon2id and are never stored or recoverable in plain text. There is no magic-link sign-in.

You can also sign in with Google. If you do, we receive from Google your account identifier, email address, name and profile picture, and we store those; we never see your Google password. We request only the “openid email profile” scopes — nothing that can read a mailbox, a calendar or a channel — and we keep no Google token afterwards, because signing in is a one-off question and there is nothing for us to do with your Google account later. An account created this way has no password at all until you set one through “forgot password”.

Password Resets

Asking to reset a password creates a single-use link that expires in 30 minutes and is emailed to the address on the account. We store only a hash of that link, so a copy of our database does not contain a working one.

Completing a reset signs you out of every device, including the one you are on. That is the point of it: if the reason for the reset was that somebody else had your password, leaving their session alive would make the exercise decorative.

We do not tell the person asking whether that address has an account — the response is identical either way, for the same reason a failed sign-in does not say which half was wrong.

Instagram / Meta Data

For a connected Instagram account we may process comments, direct messages, story replies, live comments, the media you publish through Peraly, and the account and media metadata the Meta APIs return.

The permissions requested are instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments and instagram_business_manage_messages. Nothing outside those scopes is requested, and insights permissions are deliberately not among them.

Peraly's use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including their limited use requirements.

YouTube / Google Data

This application uses YouTube API Services. For a connected channel we may process channel information, video metadata, comment threads and the figures the YouTube Analytics API returns for your own channel.

The scopes requested are youtube.upload for publishing videos and Shorts, youtube.readonly for reading the channel and its videos, and youtube.force-ssl for moderating and replying to comments. No monetisation scope is requested.

By connecting a channel you agree to the YouTube Terms of Service. Google’s handling of data obtained through Google APIs is governed by the Google Privacy Policy. You can revoke Peraly’s access to your Google account at any time at myaccount.google.com/permissions, and disconnecting the channel inside Peraly deletes the stored tokens immediately.

Messages, Comments and Content

To operate the unified inbox we store copies of the messages and comments the connected platforms deliver to us, together with your replies, internal notes, labels, assignments, snoozes and status changes.

Media you upload to the library and drafts you create in the composer are stored so they can be scheduled and published. Knowledge base entries are stored so AI steps can answer from your facts rather than the model’s — treat anything you put there as content you are choosing to send to your AI provider.

CRM / Contact Data

When someone comments on your posts or messages your account, the platform sends us their platform-scoped ID, username, display name and profile picture, and Peraly creates a contact record. That record may also carry the tags, notes, custom fields, lead score and lifecycle stage you add, plus the conversation history held in Peraly.

This information originates from interactions on the connected platform or from what you record yourself. You are responsible for handling it lawfully — see “People who message you” below.

AI Processing

AI features generate replies, captions, hashtags, descriptions, summaries and content suggestions, and classify conversations by intent and sentiment. There are six distinct AI jobs — flow steps, intent, flow generation, copy polishing, video analysis and inbox assist — and each can be pointed at a different provider.

When you use one, the relevant content is sent to that provider: the message being answered, the post being written, the knowledge base entries you supply, or the video being analysed. If you do not use an AI feature, nothing is sent to any provider.

AI output is a suggestion. It fills a box for you to edit, send or ignore; nothing is published or sent on your behalf because a model produced it. It can also be wrong, and reviewing it before it goes out is your responsibility.

How We Use Information

We use the information above to:

Provide and operate the features you have enabled.
Publish, schedule and deliver content to connected platforms.
Run the automations, rules and flows you configure.
Generate the AI output you ask for.
Produce analytics about your content, conversations and automations.
Secure the service, prevent abuse and diagnose faults.
Contact you about your account, billing and service changes.

Third-Party AI Providers

The supported providers are Google (Gemini), Anthropic (Claude) and OpenAI. Only the ones you configure are ever contacted, and content sent for processing is subject to that provider’s own terms and privacy commitments.

From the Starter plan up you can supply your own API key. It is encrypted at rest, used only for your workspace, and billed by the provider rather than metered by us. We do not use your content or your contacts’ messages to train any model.

Data Storage

Relational data — accounts, workspaces, contacts, posts, flows — in PostgreSQL. Message and comment content in MongoDB. Uploaded media in S3-compatible object storage. Short-lived queue and cache state in Redis.

Peraly runs on Amazon Web Services in the US East (N. Virginia) region. PostgreSQL is Amazon RDS, Redis is Amazon ElastiCache, media is Amazon S3, and the application itself runs on Amazon ECS behind Amazon CloudFront. Both databases sit in private subnets with no route to the internet. MongoDB is hosted by MongoDB Atlas. If you are located elsewhere, your data is processed in the United States.

Cookies and Authentication

Peraly does not set cookies. Your session is held in your browser’s own storage under the key “peraly-auth”, as a short-lived access token and a rotating refresh token. Signing out clears it, and so does clearing site data for this domain.

Where it is held is your choice at sign-in. With “keep me signed in” ticked it goes to local storage and survives closing the browser; unticked it goes to session storage and is discarded when the tab closes. Only the preference itself — one value recording which of the two you chose — is kept in local storage either way.

There are no advertising, tracking or preference cookies to consent to, because there are none at all. This storage is necessary for the application to work — with it blocked, you cannot stay signed in.

Analytics

The analytics inside the product are computed from your own workspace data — your messages, your posts, your automation runs — and are shown only to your workspace.

This build ships no third-party analytics, product-telemetry or session-recording script on the website or in the application.

Payments and Stripe

Paid subscriptions are processed by Stripe. Stripe collects and processes your payment details directly; Peraly never receives or stores full card numbers. We retain the subscription status, plan, billing contact and invoice records associated with your workspace.

Stripe’s handling of your payment information is governed by Stripe’s own privacy policy.

Data Retention

Account and workspace data is kept for as long as the account exists. Delete a contact, message, post or media file and it is removed from the live databases.

Message and comment history is additionally subject to a per-plan retention window: 30 days on Free, 365 days on Starter, and unlimited on Pro and Agency. A 30-day grace period is applied on top of the plan window before anything is swept, so a plan change never destroys history retroactively.

Data Security

Passwords are hashed with argon2id. Platform access tokens and AI provider keys are encrypted at rest with AES-256-GCM and are never returned by the API once stored. Password reset links are stored hashed, single-use, and expire in 30 minutes. Sessions use short-lived access tokens with rotating refresh tokens.

Access to a workspace is limited to the members you invite, with per-role permissions and an audit log of the sensitive actions. Outbound HTTP steps in flows cannot be pointed at private network addresses or cloud metadata endpoints.

No system can be guaranteed completely secure, and we hold no security certification. We do not claim one.

User Rights

Depending on where you live you may have rights to access, correct, export, restrict or delete your personal information, and to object to certain processing. Most of these can be exercised directly in the product: every record is editable or deletable, and contacts export to CSV.

Data Export

Contacts export to CSV and analytics reports can be downloaded from within the product. Export is a paid feature — it is available from the Starter plan up, and is not gated behind a support request at any tier.

Account and Data Deletion

You can disconnect any social account at any time, which deletes its stored tokens immediately. Closing your account removes your workspaces and their contents from the live service.

Deletion removes data from the live databases. Copies may persist in encrypted backups until those backups expire on their normal cycle.

Third-Party Services

Peraly integrates with services we do not control — Instagram, YouTube, Stripe, the AI providers you configure, and Google if you sign in with it. Their handling of your information is governed by their own policies, and we are not responsible for their acts or omissions.

People Who Message You

If you use Peraly, you are the controller of your contacts’ data and we are your processor. You are responsible for having a lawful basis to store and message them, and for honouring their requests.

If someone asks you to delete their data, deleting the contact in Peraly removes it from our systems.

Children's Privacy

Peraly is not intended for children. You must meet the minimum age set out in our Terms of Service to use it, and we do not knowingly collect personal information from anyone below that age.

International Data Processing

Peraly and its service providers may process your information in countries other than the one you live in. Where required, we rely on appropriate safeguards for those transfers.

Changes to This Policy

We will revise the date at the top of this page when this changes, and tell account holders in the product before any change that materially affects how their data is used.

Contact Information

Questions about this policy, about how your information is handled, or a request to access, export or delete it can be sent to [email protected]. It is a monitored mailbox and a person reads it.

Peraly’s website is peraly.com. What we will not tolerate from people using Peraly — including anything resembling spam — is set out in the Acceptable Use Policy.