Privacy Policy. How we handle personal data.
For visitors of our website, for people who join the waitlist or create an account, and for the business contacts Perpetual researches so our customers can reach out to them. Written to be read, not skimmed past.
On this page
01Who we are
Perpetual (perpetualgtm.com) is based in Serbia, MB 68759196 · PIB 115933404. We are the data controller for the processing described in this policy, unless a section says otherwise.
For anything about your data, write to [email protected]. We answer within 30 days.
We process personal data under the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, “ZZPL”) and, where it applies to people in the European Economic Area, the EU General Data Protection Regulation (“GDPR”).
02What we collect and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You visit the website | IP address, browser and device type, pages requested, time of the request | Deliver the site, keep it secure, detect abuse | Legitimate interest (GDPR Art. 6(1)(f)) |
| You accept optional cookies | Usage information described in our Cookie Policy | Understand how the site is used and improve it | Consent (Art. 6(1)(a)), withdrawable at any time |
| You join the waitlist | Email address, optional company website, the page you signed up from, time of signup | Tell you when early access opens and invite you in | Consent (Art. 6(1)(a)) |
| You try onboarding without an account | The company website you enter, a temporary anonymous session, the workspace we build for it | Analyse your company and show the opportunities we find | Steps you ask for before a contract (Art. 6(1)(b)) |
| You create an account | Name, email address, password (stored only as a hash by our auth provider), or your Google sign-in identity | Create and secure your account, provide the service, send service messages | Contract (Art. 6(1)(b)) |
| You use the product | Your targeting settings, the companies and people in your workspace, drafts you edit and approve, sending history, replies to your outreach | Provide the service you configure | Contract (Art. 6(1)(b)) |
| You connect a mailbox | An encrypted access token, your mailbox address, messages sent through Perpetual, replies to them (see section 4) | Send the emails you approve, or that your automatic-sending rules allow, from your own mailbox, and stop follow-ups when someone replies or opts out | Contract (Art. 6(1)(b)) |
| You connect your CRM or Slack | An encrypted access token or webhook address, and the company, contact and outcome records we write to it | Record outreach outcomes in your own CRM and send you the alerts you configure | Contract (Art. 6(1)(b)) |
| You write to us | Your message and contact details | Answer you | Legitimate interest (Art. 6(1)(f)), or contract if it concerns your account |
| We must by law | Billing and accounting records | Meet tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
The same legal bases exist under Article 12 of the ZZPL. We do not sell personal data, and we do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
03People we research for outreach
Perpetual helps businesses find other businesses that are likely to need what they sell, and the person at that company who is best placed to talk about it. If you received an email sent through Perpetual, or you work at a company that is hiring publicly, this section is for you. It is our notice under Article 14 GDPR and the matching provision of the ZZPL.
What we process
- Company information: name, website, industry, public job postings and other public signals.
- Professional information about people at those companies: name, job title, employer, seniority, a public professional profile link and a work email address.
- Outreach history: which messages were sent to your work address, and your replies, bounces or opt-out requests.
We do not collect personal email addresses, phone numbers or any special categories of data.
Where it comes from
Public job boards and applicant tracking system pages, company websites, business contact data providers that supply professional profiles and work email addresses, and an independent service that verifies those addresses (see section 5).
Why and on what basis
To let our customers contact relevant businesses about relevant offers, one person per company. A message is sent only from the customer’s own mailbox, either after a person at the customer approves it or within automatic-sending rules the customer’s account owner has set and switched on (for example a daily limit, a minimum match quality and a verified work address). The legal basis is legitimate interest (GDPR Art. 6(1)(f)): ours in running the service and our customers’ in business development. We limit the data to professional information and honour every opt-out across all our customers.
We are the controller for the company and contact data in our shared research database. The customer who chooses to contact you decides what to send and is the controller for that outreach; for it, we act as their processor.
How to object
Every email sent through Perpetual contains an opt-out link. Using it, or writing to [email protected], stops all further messages to that address from every Perpetual customer, not only the one who wrote to you. You can also ask us to delete your data (see section 8). To make an opt-out stick, we keep a one-way hash of the address on a suppression list instead of the address itself.
04Google user data
If you sign in with Google, we receive your name, email address and profile picture from Google to create your account.
If you connect a Gmail mailbox, we use Google’s Gmail API to send from your mailbox the emails you approve, or that the automatic-sending rules you switched on allow, and to read new messages only to recognise replies, bounces and opt-out requests that relate to emails sent through Perpetual. Those signals stop or pause your follow-ups automatically. A reply may be analysed by our AI provider for personal data to understand what it asks for and, only for the reply types you allow, to answer it automatically; interested and unclear replies always go to a person. Messages that do not relate to your outreach are not used. Access tokens are stored encrypted, and you can disconnect the mailbox at any time in the app or in your Google account settings.
Perpetual’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train or improve generalised AI or machine learning models, we do not sell it, and people do not read it unless you ask us to for support, it is needed for security or the law requires it.
05Service providers
We use the providers below to run Perpetual. Each processes personal data only on our instructions and under a data processing agreement.
| Provider | What they do for us |
|---|---|
| Vercel | Website and application hosting, file storage for waitlist signups |
| Supabase | Database and user authentication |
| Inngest | Running background jobs (the job data may include identifiers) |
| Google sign-in, Gmail API for connected mailboxes, a spreadsheet copy of waitlist signups, and Google Analytics for site usage statistics, only if you accept analytics cookies (see the Cookie Policy) | |
| Icypeas, Prospeo, People Data Labs | Professional contact data: finding the right person at a company and their work email address |
| Hunter, Bouncer (EU) | Independent verification that a work email address can receive mail |
| Unipile | Connecting your own LinkedIn account: you sign in on Unipile’s hosted page and Unipile keeps the session; we keep only a reference to the connected account and its status |
| Firecrawl | Reading public company websites and job pages |
| DeepSeek | AI analysis of public company information only; personal data is never sent to it |
| AI provider for personal data | AI tasks that involve personal data (for example understanding a reply) run only on a provider processing in the EU or another approved region |
If you connect your own CRM (such as HubSpot) or Slack, we send data there on your instruction; that provider works for you under your own agreement with it, not for us.
We keep this list current. Ask us for the up-to-date list or for a copy of the relevant safeguards.
06International transfers
Some providers process data outside Serbia and the European Economic Area, for example in the United States. We transfer personal data only where the destination offers an adequate level of protection or where appropriate safeguards are in place, such as the European Commission’s standard contractual clauses (or the standard contractual clauses adopted by the Serbian Commissioner), together with supplementary measures where needed.
07How long we keep data
| Data | Kept for |
|---|---|
| Waitlist signups | Until you ask to be removed, or until you create an account |
| Anonymous onboarding workspaces | Until you claim them by creating an account, or until our periodic clean-up of unclaimed workspaces |
| Account and workspace data | While your account is open; deleted within 30 days of closing it |
| Conversation data (sanitised replies, classifications) | 90 days by default |
| Research data about companies and professional contacts | While it is useful for the service; removed when outdated or on request |
| Opt-out suppression list (hashed) | Indefinitely, so an opt-out keeps working |
| Server logs | A short period set by our hosting provider |
| Accounting records | As long as accounting law requires |
08Your rights
Under the ZZPL and the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- rectify inaccurate data;
- erase your data (“right to be forgotten”);
- restrict how we process it;
- data portability, for data you gave us under consent or a contract;
- object to processing based on legitimate interest, including direct marketing, at any time;
- withdraw consent at any time, without affecting processing done before (for cookies, use the cookie settings link in the footer).
To exercise a right, email [email protected]. We may ask you to confirm your identity. We answer within 30 days; for complex requests we may extend this and will tell you why.
You can also complain to a supervisory authority. In Serbia that is the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik, poverenik.rs). In the EEA, you can complain to the authority in the country where you live or work. We would appreciate the chance to resolve your concern first.
09Security
Data is encrypted in transit. Mailbox access tokens are encrypted at rest. Each customer workspace is isolated at the database level, and access is limited to people who need it. Every send passes our sending limits, suppression and opt-out checks, and goes out only after a person approves it or within automatic-sending rules the account owner switched on. No system is perfectly secure; if a breach affects your data and puts your rights at risk, we will notify you and the competent authority as the law requires.
10Other information
Children
Perpetual is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.
Cookies
How we use cookies and similar storage is explained in our Cookie Policy.
Changes
We update this policy when our processing changes. The date at the top shows the latest version. For material changes we will tell account holders by email or in the product before they take effect.