Privacy Policy

1. Who We Are

Data controller. Peruze Technology Limited is the data controller responsible for your personal information. That means we decide what is collected and why, and we are accountable for it.

How to reach us.
Peruze Technology Limited
hey@peruze.co
ICO registration number: ZC226048

2. Scope

What this covers. This policy applies to all personal information we process in connection with the Services.

What it does not cover. It does not apply to the retailers, brands, or other websites you visit through the Services — those have their own privacy practices, and we encourage you to read them.

3. What We Collect, Why, and Our Lawful Basis

Every category below names what we collect, why, and the lawful basis we rely on under UK data protection law.

A. Account data

What we collect. Your email address. Sign-in is passwordless — we email you a link, and we never collect, store, or process a password. You may optionally add a name in Settings; it is not requested when you sign up, and you can clear it at any time.

Why, and lawful basis. To create and operate your account — performance of a contract.

B. Items, collections and stores you save

What we collect. The product URL you save, and the metadata our systems retrieve from it — title, brand, retailer, price, and images. We also store the collections you create, the stores you bookmark, and any photo you choose to attach to an item.

Why, and lawful basis. To provide the save-and-organise function that is the core of the Services — performance of a contract.

C. Preferences

What we collect. Your currency, and the styles and categories you select during setup.

Why, and lawful basis. To set up your account and shape what you see — performance of a contract.

D. Your taste profile

What we collect. A profile derived from your own saved items — the categories, styles, brands, retailers and price range you tend to save. It is recalculated periodically as your saves change.

Why, and lawful basis. To rank recommendations and personalise your feed — our legitimate interests in providing a useful product.

How we weighed that. We have balanced this against your rights: the profile is built only from items you chose to save, it produces no legal or similarly significant effects, and you can object at any time (see section 9).

E. Searches

What we collect. The text you type into search, and the filters you apply. Recent searches are also cached on your device.

Why, and lawful basis. To return results and let you revisit a previous search — performance of a contract.

F. Notifications

What we collect. A push token identifying your device, and your time zone so notifications arrive at a reasonable local hour.

Why, and lawful basis. To send the notifications you allowed — consent, given through your device's notification permission. You can withdraw it at any time in iOS Settings.

G. Diagnostics

What we collect. Crash reports, performance traces, screen names, and — where a save fails — the URL involved. These are processed by Sentry and tagged with your account identifier so we can tell one user's errors from another's. We do not send your email address to Sentry, and we do not record your screen or session.

Why, and lawful basis. To find and fix faults and keep the Services secure — our legitimate interests. We minimise what is sent and attach no directly identifying details.

H. AI processing

What and why. Described in full in section 4.

Lawful basis: performance of a contract. Determining what a saved item is — its brand, category, colour and materials — is what turns a URL into something Peruze can organise, search and recommend from. It is necessary to deliver the service you have signed up for, not an optional addition, so we rely on contract rather than consent.

We still tell you before it starts. You are shown what is sent, and to whom, before you create an account, and you have to accept it to continue. We record the date and version of what you accepted.

I. Legal and financial records

What we collect. Correspondence with us, and — for retail partners only — transaction and commission records.

Why, and lawful basis. To answer you, keep required accounting records, and handle rights requests — legitimate interests and legal obligation.

Withdrawing consent. Where we rely on consent you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand.

4. AI and Automated Processing

Our AI provider. Peruze uses Google's Gemini API to work out what a saved item actually is, and to interpret what you type into search. This is the only AI provider we use.

A. What we send

• the product's name, brand, retailer, and price
• a short extract of the product description, where the page provides one
• the product image
• the text you type into search, when it is too complex for us to interpret on your device
• summary statistics from your taste profile — your top styles, categories and brands, and a price range — when generating a written description of your taste

B. What we never send

Nothing that identifies you. Not your name, your email address, your account identifier, or any other information that identifies you to the provider. We share product information, not your identity. There is no chat feature in Peruze, and no conversation is ever sent.

C. Retention and training

Not used to train models. We use the paid Gemini API. Under its terms, Google does not use the information we send to train its models, and does not retain it beyond what is needed to return a result.

D. When we tell you

Before anything is processed. The app shows you what is sent, and to whom, on the welcome screen — before you create an account and before anything of yours has been processed. You have to accept it to continue, and we record the date and version of what you accepted. This section is the standing reference for what that covers.

E. No opt-out

You cannot opt out of this processing while your account remains open. Determining what a saved item is underpins the Services — without it there is nothing to organise, search, or recommend from — so it is not offered as an optional feature.

How to end it. If you no longer wish this processing to continue, you may end it by deleting your account, either in the app under Settings → Profile → Delete account or by contacting us at hey@peruze.co. Your saved items and taste profile are erased with it.

F. Effects

What it decides. This processing determines which items and stores appear in your feed. It produces no legal or similarly significant effects, and you can ignore or override the results at any time.

5. Connected AI Assistants

What this is. Peruze runs an MCP server that lets you connect your account to an external AI assistant. If you choose to connect one:

• the assistant accesses your account using credentials you authorise, with the permissions shown to you at the time
• it can read your saved items, collections, stores and taste profile, and save new items
• we log requests made to the MCP server for security and abuse prevention
• the assistant is operated by a separate company under its own privacy policy — please read it before connecting

Revoking access. Disconnect Peruze in your assistant's own connector settings, or email hey@peruze.co and we will revoke it for you.

Our limit. We never share your information with an external assistant except in response to a request you have authorised.

6. Who We Share Your Information With

We do not sell your personal information and we do not use it for advertising.

A. Processors we use

Each of these acts under a written contract that restricts them to acting on our instructions:

• Supabase — database, authentication, file storage and server functions. Holds all of your account data. Hosted in Ireland.
• Google (Gemini API) — classifies saved items and interprets searches, as described in section 4. United States and other locations.
• Sentry — crash and performance diagnostics. Data stored in Germany; its parent company is in the United States.
• Expo — delivers push notifications. Receives your push token and the content of the notification. United States.
• Vercel — hosts peruze.co, and keeps standard server logs including IP addresses. United States.
• Apple — App Store distribution and push delivery. United States and other locations.

B. Business-side services

Not used for app users. We also use Stripe and Resend for billing and email to our retail partners, and PhotoRoom to prepare catalogue imagery. These are business-side services: they do not receive the personal information of app users.

C. Other disclosures

Legal and safety. We may disclose information where we are legally required to, to enforce our Terms, or to protect the rights and safety of Peruze, our users and others.

Business transfers. If Peruze is involved in a merger, acquisition or sale of assets, your information may transfer as part of it, and we will tell you if it becomes subject to a different privacy policy.

7. International Transfers

Where your account data lives. Your account data — everything in section 3 — is stored in Ireland, within the European Economic Area. Transfers there are covered by the UK Government's adequacy regulations for the EEA, so no additional safeguard is required.

Processors outside the UK and EEA. Where we transfer personal data outside the UK, we rely on appropriate safeguards as required by UK data protection law. Depending on the processor, these safeguards are one or more of: the UK International Data Transfer Addendum (IDTA); the EU Standard Contractual Clauses together with the UK Addendum; or the UK Extension to the EU-US Data Privacy Framework. Copies of the relevant safeguards are available on request by emailing hey@peruze.co.

• Google (United States and other locations) — EU Standard Contractual Clauses, under Google's data processing terms.
• Sentry — data is stored in Germany, covered by EEA adequacy. Access by its United States parent is covered by the EU-US Data Privacy Framework, with Standard Contractual Clauses and the UK Addendum as fallback.
• Expo (United States) — UK Extension to the EU-US Data Privacy Framework.
• Vercel (United States) — EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
• Apple (United States and other locations) — covered under the Apple Developer Program License Agreement.

8. How Long We Keep Your Information

A. For as long as your account is open

Account data. Your email address, profile name, preferences, saved items, collections, stores and taste profile are kept for as long as your account is open.

B. Everything else, on a schedule

The following is deleted automatically, by a job that runs daily:

• Copies of retailer pages used to read product details: deleted 30 days after the item is processed.
• Search history (including cached results): 12 months.
• Records of what we have already shown you, used to avoid repetition: 90 days.
• Notification send records: 90 days.
• Push tokens, once deactivated by signing out: 90 days.
• Store view and click records: 24 months.
• Diagnostic data held by Sentry: 90 days.
• Emails you send us: 24 months after the matter is closed.
• Partner transaction records: 6 years, as required by tax law. Raw order data received from retailers is reduced to the commission record after 30 days.

C. When you delete your account

Immediately, from our live systems. This covers your saved items, collections, stores, taste profile, preferences, push tokens, search history, connected-assistant credentials and your account record itself. Backups are overwritten within 30 days. The app also clears its local caches and the in-app browser's stored data from your device.

D. What deletion does not reach

Two exceptions. Diagnostic records held by Sentry follow their own schedule and expire after 90 days as above, and we keep records we are required to by law, such as accounting records.

Partner activity records. Where these mention a deleted account, the link to you is removed and the record is left anonymous.

9. Your Rights

Under UK data protection law you have the right to:

• Access — get a copy of the personal information we hold about you.
• Rectification — have inaccurate or incomplete information corrected. You can edit your name, currency and saved items directly in the app.
• Erasure — have your personal information deleted. The quickest route is in the app: Settings → Profile → Delete account, which deletes your data as described in section 8. You can also email us.
• Portability — receive the information you gave us in a structured, machine-readable format, or have it sent to another provider where technically feasible. Email us and we will send it to you.
• Objection — object to processing based on our legitimate interests, including the taste profiling described in section 3.
• Restriction — ask us to limit how we use your information while a query is resolved.
• Withdraw consent — where we rely on your consent, withdraw it at any time.

How to exercise them. Email hey@peruze.co. We may need to verify your identity first.

How quickly we respond. Within one month. If a request is complex we may extend this by up to two further months and will tell you if so. There is no charge unless a request is manifestly unfounded or excessive.

10. Complaints

Come to us first. If you are unhappy with how we have handled your personal information or a rights request, please tell us so we can put it right. Email hey@peruze.co with "Data complaint" in the subject line.

How we respond. We will acknowledge your complaint without undue delay and respond substantively within 30 days. If we need longer we will explain why and tell you when to expect a full response.

Your right to complain to the regulator. You can complain to the Information Commissioner's Office at any time. You do not have to come to us first, though we would appreciate the chance to help.

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk

11. Children

Adults only. Peruze is an adults-only service. It is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18.

Declared, not verified. We do not collect dates of birth, so this is a condition of using the Services rather than something we verify. If you believe someone under 18 has given us personal information, email hey@peruze.co and we will delete it.

12. Security

We protect your information with measures including:

• Row-level security on our database, so a signed-in user can only ever read and write their own records
• Encryption in transit (TLS) for all traffic, and encryption at rest for stored data
• Sign-in tokens stored in the iOS Keychain on your device. A copy is also held in a private storage area shared with the Peruze share extension, so you can save items from other apps; both are removed when you sign out or delete your account.
• Access to production systems limited to those who need it

No guarantee, and what happens if something goes wrong. No system is completely secure and we cannot guarantee that unauthorised access will never happen. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as the law requires.

13. Cookies and Local Storage

peruze.co sets no advertising or analytics cookies, and we do not track you across other websites. If you sign in, we store your session in your browser's local storage so you stay signed in. That is strictly necessary to provide the service you asked for, so we do not ask for consent for it — and it is why you will not see a cookie banner.

The in-app browser. When you open a retailer inside the Peruze app, that retailer can set cookies and store data on your device exactly as it would in Safari, including keeping you signed in to their site. This data belongs to the retailer, sits on your device, and is not readable by us. It is cleared when you delete your account.

The app also stores your saved items, preferences and recent searches locally so it works quickly and offline. This is cleared when you sign out or delete your account.

14. Third-Party Websites

Not our responsibility. The Services link to retailers and other third-party sites. We are not responsible for their privacy practices, and we encourage you to read the privacy policy of any site you visit.

15. Changes to This Policy

How we notify you. We may update this policy from time to time. If we make a material change — for example adding a processor, or changing what we send to our AI provider — we will tell you in the app or by email before it takes effect, and where the change requires your consent we will ask for it again.

Version. The "Last updated" date at the top shows when this policy was last revised.

16. Contact Us

Questions, or to exercise your rights.
Peruze Technology Limited
hey@peruze.co