Privacy policy

This policy applies to the Perkamo website, Console accounts, billing contacts and support conversations. Perkamo is the controller when it decides how this data is used. Contact us at support@perkamo.com.

When a Perkamo customer sends data about people using its own app or service, that customer normally acts as controller and Perkamo acts as processor under the customer's instructions. If your data came from a customer's product, contact that customer first; Perkamo will assist them with valid requests.

Account and workspace

Data: Name, email address, hashed password or Google sign-in identifier, company and Space membership, roles and interface preferences.

Why: Create and secure your account, provide the Console, administer access and communicate about the service.

Legal basis: Performance of the service contract and Perkamo's legitimate interest in secure account administration.

Service and customer data

Data: Program configuration, customer identifiers supplied by a customer, event payloads, wallet balances, progress, benefits and webhook delivery data.

Why: Run the loyalty and progression service on the customer's documented instructions.

Legal basis: The Perkamo customer normally determines the legal basis and acts as controller; Perkamo acts as its processor for this data.

Operations and security

Data: IP address, browser and request metadata, request IDs, audit records, security and error diagnostics, and observed SDK package versions.

Why: Protect accounts, prevent abuse, troubleshoot failures, maintain availability and guide safe SDK upgrades.

Legal basis: Performance of the service contract and legitimate interests in operating a secure and reliable service.

Billing

Data: Company and usage information, Stripe customer identifiers, historical billing references and records required for invoicing.

Why: Manage payments, invoicing and pay-as-you-go access.

Legal basis: Performance of the service contract and applicable legal obligations.

Support and optional analytics

Data: Messages and contact details you send to support; website or feature usage only after optional analytics consent.

Why: Answer requests and, when you consent, understand how the website and product are used.

Legal basis: Contract or legitimate interests for support; consent for optional product analytics.

Account and service records are kept while needed to provide the service, secure it and meet contractual or legal duties. Operational records use a bounded retention period based on security and troubleshooting needs. Customer service data is retained and erased according to the customer's instructions and agreement with Perkamo.

Required storage supports security, sign-in, consent records and interface settings. It stays available regardless of your analytics choice and is not used for advertising.

cookie_consent

Cookie

Remembers whether you accepted or rejected optional product analytics.

12 months after acceptance; 6 months after refusal

perkamo_color_mode / perkamo-color-mode

Cookie and local storage

Keeps your chosen light or dark appearance across requests.

Up to 12 months or until you remove site data

perkamo_session

HTTP-only cookie

Keeps an authenticated Console session secure.

Up to 7 days or until sign-out

perkamo_google_oauth

HTTP-only cookie

Protects the Google sign-in flow when you choose it.

Up to 10 minutes

perkamo.sidebarCollapsed and session storage

Browser storage

Remembers Console layout and temporary navigation state.

Until site data is removed; navigation state lasts for the tab

Optional product analytics is off until you actively allow it. Perkamo does not currently activate an analytics provider. If one is introduced, we will identify the provider, data, retention and transfer details here and ask for a fresh choice before collection begins. Operational security and error monitoring, including Sentry where configured, is separate from optional analytics and has default collection of personal identifiers disabled.

Perkamo shares data only as needed to run the service: with hosting and infrastructure providers, email delivery services, Sentry for error monitoring, Stripe when billing is used, and Google when you choose Google sign-in or explicitly request optional Gemini AI assistance. Data may also be shared with professional advisers, authorities or another party where law or a corporate transaction requires it.

We do not sell personal data and do not use it for personalized advertising or cross-site profiling. If a provider processes personal data outside the EEA, an applicable transfer mechanism such as an adequacy decision or standard contractual clauses is used where required. Contact us for information about safeguards relevant to your data.

Before your first AI message, you choose whether to enable AI data sharing. Perkamo saves this choice, its version and the time for your Console account across Spaces, not for your team. When enabled, each message you send shares your message, up to four recent completed turns from this conversation and a limited structural snapshot of the selected program to Google Gemini. This can include event keys, Goal targets and windows, point awards and caps, Reward costs and Perk dependencies. The engagement-analysis tool, whether selected manually or by automatic detection, also shares aggregate activity and event-outcome counts for the last two completed 14-day periods. These aggregates contain no customer identifiers or individual event payloads. Customer profiles, individual event payloads, credentials and revenue history are not included automatically. Do not enter personal data, secrets or confidential customer information in your brief.

Perkamo stores conversations privately for your Console account in the selected Space until you delete them or the account or Space is removed. You can delete conversations from the assistant. Daily beta credit counters protect service capacity and are not restored by deleting history. A draft you explicitly save becomes normal program configuration. Google processes submitted content under its Gemini service terms, including applicable abuse-prevention retention; this is not a zero-retention service. AI is optional and the manual editor remains available.

You can withdraw AI data sharing in the assistant's Privacy settings. This blocks new messages without deleting your conversations. A request already in progress may finish, and withdrawal or deletion does not recall content already sent to Google. A material change to the sharing disclosure requires a new choice before further messages.

Depending on the circumstances, you may ask for access, correction, deletion, restriction or portability of your personal data, or object to processing based on legitimate interests. You may withdraw analytics consent at any time without affecting processing that occurred before withdrawal.

You may also complain to the supervisory authority where you live, work or believe an infringement occurred. The EDPB publishes an EU and EEA supervisory authority directory. We may need to verify your identity before completing a request.

Perkamo uses technical and organizational safeguards designed to protect personal data. No system is risk-free, so we review controls and limit access according to operational need.

We will update this page before using personal data for a materially new purpose. For privacy questions or requests, email support@perkamo.com with the subject "Privacy request".