Privacy Policy

1. Who we are

Peervia (“we”, “us”) operates a competitive-intelligence platform for email marketing at peervia.io. This policy explains what we collect and why.

2. What we collect

• Account data: the email address and password you provide when you sign up. Passwords are stored only as a salted scrypt hash; we never store them in plain text.
• Your connected data: if you connect your own email service provider (e.g. Klaviyo) read-only, we process aggregate performance metrics for your account to build your benchmarks. We request the minimum read-only scopes needed.
• Competitor marketing email we receive as a subscriber: see section 3, which explains exactly how that works.

3. How competitor email is collected

We do not scrape inboxes and we never access anyone's mailbox. For each brand a customer asks us to track, we create a capture address that belongs to us and subscribe it to that brand's public newsletter, either automatically (using a browser automation that identifies itself as “PeerviaBot”) or manually. Where a brand uses double opt-in, the confirmation link is surfaced to an operator, who completes it. We are the intended recipient of every message we store.

We store the message's full HTML creative so we can measure it. When a creative is viewed, the images it references are fetched by our server rather than by your browser, so viewing does not disclose your address or IP to the sender. Marketing email sometimes contains personalisation aimed at the recipient (a sender's display name, a greeting). That address is ours, not a customer's, but we do not use captured content to build a profile of any person.

Retention. We keep the raw creative for 90 days, then delete the HTML while keeping the measurements derived from it (send date and time, cadence, offer type and depth, structural metrics). Those measurements are facts about a marketing campaign and are kept indefinitely. If a sender asks us to remove their creative we do so on receipt (see the Terms).

Not collected: we have no access to any competitor's opens, clicks, revenue, list size or deliverability outcomes, and our database has no field in which to put them.

4. Who processes data on our behalf

• Resend: receives inbound mail sent to our capture addresses.
• Stripe: payments. Card details go to Stripe directly; we never see or store them.
• Google (Gemini): the Ask Peervia assistant and optional AI analysis (Anthropic Claude may be used instead where configured). For competitor analysis we send only aggregate numbers (send counts, cadence, discount depth). When you use the assistant, it may also process your own connected account's aggregates (such as your flow revenue and setup) to answer your question. We never send captured creative, email addresses or any other personal data.
• Slack: only if you connect a workspace. We send change alerts and command responses there; we do not send captured creative or any personal data.
• Cloudflare and our hosting provider: network and infrastructure.

5. Cookies

We set one cookie, iv_sess, which holds a random session token, never your identity or any personal data. It is HttpOnly and, in production, Secure. We use no advertising or third-party analytics cookies.

6. More on what we collect

• Observed competitor signals: publicly observable marketing (broadcast emails we receive as a subscriber, public ad libraries). We derive tactic signals from this; we do not publish competitors’ private performance because we never have it.
• Usage data: standard server logs (IP, timestamp, page) for security and reliability.

3. What we do not do

We do not sell your personal data. We do not put personal data in URLs. We do not model or claim competitors’ open, click, or revenue figures: only observed, public tactics.

4. Your rights

You can export or delete your account at any time from Settings. Deletion is immediate and permanent, and it removes: your account and login, your tracked brands, any workspaces and clients you own, your share links, your connected-platform data, your API keys, webhooks and sessions. Capture addresses created for brands nobody else is tracking stop receiving mail.

What deletion does not remove: the observed marketing signals for brands other customers also track. Those are factual observations about third-party campaigns, are not personal data about you, and are shared across the platform, so removing them would delete other customers' data too. If you believe a specific record concerns you personally, email us and we will handle it individually.

EU/UK/California residents have the right to access, correct, and erase their data; email privacy@peervia.io.

5. Contact

Takedown & copyright

If you are a sender and want your creative removed from Peervia, email privacy@peervia.io with the sending domain and, if you can, a link or subject line. We remove the creative on receipt. We do not require a formal notice first, and we do not ask you to argue the point.

What removal does: we delete the stored HTML and cached images. We retain the derived measurements (that a send occurred on a date, its cadence, offer type and depth), because those are factual observations about a marketing campaign rather than a copy of your work. If you want those removed too, say so and we will discuss it.

For a formal notice under 17 U.S.C. §512, send it to the same address with the statutory elements (identification of the work, the material, your contact details, a good-faith statement, and a statement under penalty of perjury). You may submit a counter-notice to the same address. We state plainly that we do not claim §512(c) safe harbour for material we collected ourselves: that provision covers storage at the direction of a user, and we subscribe and store on our own initiative. We honour notices because it is right, not because a statute shields us. An account or sender generating repeated valid notices will be removed from the platform.

Peervia is not affiliated with, endorsed by, or sponsored by any brand it observes.