Privacy policy
What personal data Pera handles, why, how long we keep it, and your rights. Written to be read, not just to exist.
- We collect what we need to run check-ins: email addresses, names if you give them, and the answers people send.
- Answers are kept apart from people. Once a round closes, nobody, including us, can tell who said what.
- No advertising, no tracking pixels, no selling data. The website sets no cookies.
- If your employer sends you check-ins, they decide what happens to your data, and we act on their instructions.
Who we are
Pera runs trypera.com and app.trypera.com. In these pages, “Pera”, “we” and “us” mean us. You can contact us at hello@trypera.com.
Two kinds of people, two roles
Customers. If you create a Pera account, or are invited to manage one, we are the controller of your account data. This policy explains how we handle it.
People who receive check-ins. If your employer (or another organisation) adds you to Pera so you receive check-ins, that organisation is the controller of your data, and we are its processor. We only use your data to run check-ins for them, under a contract that requires us to. If you have questions about why you’re receiving check-ins, ask the organisation that added you. We’ll help them answer any request you make.
What we collect
| Data | Whose | Why |
|---|---|---|
| Email address and name | Customers | To create your account, sign you in and send you service emails. |
| Passkeys | Customers | If you add one, we store its public key and a name for it so you can sign in. The private key never leaves your device. |
| Organisation and team names, schedules | Customers | To run your check-ins. |
| Email address and name | People who receive check-ins | To send each check-in and its reminder. |
| Answers and comments | People who receive check-ins | To show results to the organisation. Stored without any link to the person, with the date they were sent but not the time. |
| Notes from managers | Customers | The “You said, we did” notes shown to the team in the next check-in. |
| Billing details | Paying customers | To take payment. Card details are handled by our payment provider; we never see or store them. |
We record which check-in emails were sent to which address and whether they were delivered, so we can retry failures. We don’t record whether anyone opened an email or clicked a link, and we don’t record who answered.
Comments are free text, so someone could write something that identifies them or someone else. We automatically remove email addresses and phone numbers from comments before anyone sees them.
How answers stay anonymous
Each person gets their own link for each round. We never store the links themselves, only a one-way fingerprint that can’t be traced back to a person. The key that could connect links to people is deleted when the round closes. Results are only shown once a round has closed and at least five people have answered. Read the details.
While a round is open, the key exists so that each link only works once. In principle someone with full access to our servers and database could use it during that window. We restrict that access tightly, and once the round closes it’s no longer possible at all.
Our lawful bases
- Contract: to provide the service you signed up for, including your account and check-ins.
- Legitimate interests: to keep Pera secure, prevent abuse, fix problems, and send you important service messages. We don’t send marketing emails without your consent.
- Legal obligation: to keep financial records and respond to lawful requests.
For people who receive check-ins, the organisation that added you chooses the lawful basis, usually its legitimate interest in looking after its staff.
Cookies and local storage
The website (trypera.com) sets no cookies and uses no analytics or advertising trackers. The app (app.trypera.com) uses a small number of cookies that are strictly necessary to sign you in and keep you signed in. Both remember your light or dark theme choice in your browser’s local storage. Because these are strictly necessary, we don’t need to ask for consent, and there’s no cookie banner.
Who we share data with
We don’t sell personal data or share it for advertising. We use a small number of providers to run Pera:
- hosting, database and content delivery (Cloudflare and our hosting provider)
- email delivery, to send check-ins and sign-in links
- payments, for paying customers
Each provider only gets the data it needs, under a contract that requires it to protect that data. We may also share data if the law requires it, or to protect people’s safety.
International transfers
Some providers process data outside the UK. When they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, so your data has the protection UK law requires.
How long we keep data
- Sign-in links expire after 15 minutes. Sessions last up to 30 days.
- The key and links for a round are deleted when the round closes.
- People, answers, comments and notes are kept while the organisation has an account, so it can see how things change over time. Admins can remove people at any time.
- When an organisation asks us to close its account, we delete its data within 30 days, and from backups within a further 30 days.
- Billing records are kept for six years, as UK tax law requires.
Security
Everything is sent over HTTPS. Round keys are encrypted at rest. Sign-in uses single-use email links or passkeys, and session cookies can’t be read by scripts. Access to production systems is limited to the people who need it. No system is perfectly secure, but we take it seriously, and we’ll tell you and the ICO if a breach affects you, as the law requires.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you
- have it corrected if it’s wrong
- have it deleted
- restrict or object to how we use it
- receive it in a portable format
Email hello@trypera.com to use any of these. We’ll reply within one month. Because answers aren’t linked to people, we can’t find, return or delete a particular person’s answers after a round has closed; that’s the point.
If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put it right first.
Children
Pera is for workplaces. It isn’t meant for anyone under 16, and we don’t knowingly collect their data.
Changes to this policy
If we make a significant change, we’ll email customers before it takes effect. The date at the top shows when this policy last changed.