Privacy Policy

Data Controller & Points of Contact (GDPR Art. 13(1)(a); DSA Arts. 11-12)

• perso.social is operated by ACGG Rent, S.L., a Spanish sociedad limitada and the sole data controller, with registered office (domicilio social) at Calle Francisco Ayala 27, 28522 Rivas-Vaciamadrid, Madrid, Spain; CIF B-56240385; registered with the Registro Mercantil de Madrid, Tomo 45565, Folio 30, Hoja M-801410; represented by Etienne Gillard. ACGG Rent, S.L. is established in Spain.
• perso is not directed to residents of the United Kingdom, the Channel Islands, the Isle of Man, or Gibraltar, and does not offer services to, or monitor the behaviour of, individuals located in those jurisdictions; account creation from a declared residence in any of them is refused. perso has therefore not designated a representative under Article 27 of the UK GDPR.
• For data-protection enquiries: dpo@perso.social
• DSA Single Point of Contact: dsa@perso.social
• General Legal Enquiries: legal@perso.social
• You have the right to lodge a complaint with the supervisory authority in your country of residence within the European Economic Area.

Identity Verification

When you choose to verify your identity, you complete the verification process directly with our verification provider. The provider checks your identity documents and performs liveness and fraud-prevention checks. We do not receive or store copies of your identity documents or biometric templates. From the verification outcome, we receive and store only a limited set of attributes linked to your account, such as: whether your verification was successful and which method was used; your verified legal name; a one-way identifier derived from your document number, which we use to prevent the same document from being used to open more than one account, to support account recovery, and to refuse recovery of an account that has been banned; whether your verification relied on certain trusted sources (for example, notified electronic identities) and an audit reference; confirmation that you are at least 18 years old; and your country of residence. Our verification provider sends us a technical payload that can include IP-based location and network metadata (for example, country and city derived from IP, and security signals). We do not read, use, or retain this information; it is not used for profiling, eligibility, or any other purpose, and no precise location data (such as GPS coordinates or IP-derived latitude/longitude) is stored. We use these attributes to confirm that each account is held by a real person, to prevent the same document from being used to open more than one account, to determine eligibility for certain features, and to comply with our legal, safety and platform-integrity obligations. They are stored separately from your public content at the application level and are accessible only to authorised personnel and services that need them for account integrity, safety, support or compliance purposes. We protect them using technical and organisational measures appropriate to their sensitivity, including encryption in transit, encryption at rest provided by our hosting provider, restricted access rights, key management for our de-duplication mechanism, and logging of administrative access. We keep your identity-verification attributes for as long as your account is active. If you delete your account, we delete or irreversibly anonymise these attributes, including the de-duplication identifier, as part of the account-deletion process. We do not retain identity-verification attributes after account deletion, except a limited accountability record of the verification decision and its reason, held for up to 12 months for security and audit purposes, with the email address redacted. In the future, we may retain a non-reversible technical identifier for a limited period solely to prevent abuse (for example, to prevent the same document from being used to open more than one account), and we will update this section before any such mechanism is enabled.

Press Verification

If you apply for a "verified journalist" badge, we ask you to provide your work email address, the name of your media organisation, and an optional link to a portfolio or recent work. At this stage, we do not collect or store images of press cards or other professional credentials as part of this process. We use this information only to assess your eligibility for a "verified journalist" badge and to prevent misuse of that status. Your work email address is stored in encrypted form and is accessible only to authorised personnel and services involved in verification and audit. These data are stored separately from your public content at the application level. In the future, we may offer you the option to upload a press card or similar professional credential as part of the verification process. If we introduce this feature, we will update this notice before we begin processing these images to explain what we collect, how long we keep it, and how we protect it, including the security measures that apply to any images you choose to upload.

Organisation verification information

• If you apply for organisation verification, we process the organisation's registration information, the authorised representative's details, and the business email address provided for that application. We use this information to assess and administer organisation verification and retain it only for the periods described in this Privacy Policy.

Account contact details

• We do not collect a personal email address or phone number when you create a perso account. You can create and use a free perso account without providing either contact detail.
• We collect an email address in limited circumstances. You may choose to provide one for a press-credential application, organisation-verification application, website contact form, or partner form. We use and retain that information only for the relevant process described in this Privacy Policy. If you purchase paid membership, we also require a billing contact email to administer your membership. See Billing contact email below for how we use, share, and retain that address.

Billing contact email

When you purchase paid membership, we collect your email address to administer your membership and communicate with you about verification outcomes, subscription status, cancellation, refunds or other remedies, and paid-member support. We process this information because it is necessary to perform our contract with you and meet related legal obligations. We do not use your billing contact email for marketing unless you separately choose to receive marketing communications.

We use an email-delivery provider to send these communications. The provider processes the billing contact email and the message information needed to deliver and secure the message on our behalf.

If you do not become eligible for paid participation and your refund or remedy case is completed, we delete your billing contact email 90 days after the case reaches a terminal state, unless we need to keep it longer for an open dispute, legal claim, fraud/security investigation, or a legal accounting or tax obligation.

App updates

• We may make software updates available to improve security, reliability, and functionality. Where an update service processes personal data on our behalf, we will identify the relevant provider and applicable safeguards in this Privacy Policy before that service is used for the production app.

Security and Technical Logs

For security, abuse-prevention and operational purposes, we create and retain logs about how our services are used. These logs can include information such as your IP address, your browser or device type and settings, the date and time of your requests, and how you interact with certain features (for example, account recovery and administrative tools). We use these logs to detect and prevent malicious or abusive activity, to investigate incidents, and to maintain the stability and security of the service. We keep this information for as long as necessary for these purposes and then delete it or irreversibly anonymise it.

Infrastructure and Hosting

perso's own application and database infrastructure is hosted on servers located in the European Union. In particular: application servers are located in France and operated by an EU infrastructure provider (OVHcloud); the primary database is a managed PostgreSQL database from Scaleway (an EU provider) in the Paris region (fr-par), where all connections between the application and the database use Transport Layer Security (TLS) with certificate verification and the database is encrypted at rest by the cloud provider at the storage-volume level (this provider-level encryption is distinct from application-level field encryption, which perso does not apply to identity attributes); the search index is Meilisearch, self-hosted by perso on its EU-based application infrastructure; email delivery uses an EU-based email service provider (IONOS); and key management uses a managed key service provided by Scaleway, used to generate and protect the key for the humanity-deduplication mechanism. perso does not currently use a separate caching layer (such as Redis) or a content delivery network. If perso later introduces such services, this section will be updated before they are used to process users' personal data. Third-party processors, including any processing outside the EU or EEA (such as identity verification, media-scanning, and any future analytics services), are addressed in the sub-processors section below and in perso's subprocessors and international-transfers documentation.

Media You Upload

Media you upload. When you post images or other media, we store them on European object storage operated by Scaleway in the Paris region, with encryption at rest. We use Microsoft PhotoDNA to screen submitted images and sampled video frames for matches to databases of known child sexual abuse material. This check is designed to help prevent the sharing of known material and protect the safety of our community. When an image is submitted for screening, or when video frames are screened, perso creates and sends only the non-reversible PhotoDNA hash needed for that safety check. Microsoft PhotoDNA returns a screening result, which we use to apply our safety rules and comply with applicable legal obligations. Your media is also automatically screened by a nudity-detection classifier. Media is not displayed until these checks complete. Every video you upload is then withheld from display until an authorized reviewer has reviewed it and approved it, whether or not an automated check flags it, because automated screening of video frames is limited to matches with known material and cannot by itself identify all harmful or unlawful material. For images, the automated checks gate display, and an image is withheld for human review only if the classifier flags it. We do not notify you when a video is approved, and we do not promise a fixed review completion time. If media held for review has not been reviewed within 36 hours of upload, we delete it instead of holding it any longer, and we tell you so that you can upload it again. This is not a decision about you or your content.

Direct messages

If you use direct messages, we process the message text, conversation information, delivery and request status, read status, and the account relationships needed to provide the feature.

Messages from people you do not follow may appear as message requests. You can choose who may send you messages: everyone, people you follow, or nobody. You can block another member, which prevents further direct messages between you and that member.

We retain message content for up to 24 months after the last relevant activity in the conversation. Reading a message, receiving a notification, or background syncing does not extend that period. You may remove a conversation from your own view earlier.

If you erase your account, we remove your message content from ordinary conversation views. Other participants may retain their own messages and limited thread information, but not a readable copy of your removed message content.

You may report an individual direct message. A trained authorised reviewer may review the reported message and limited surrounding context needed to assess it.

Data Retention

perso keeps personal data only for as long as necessary. Account data is retained while your account is active and deleted within 30 days of account deletion via a cascading purge. Identity-verification attributes are retained while your account is active and are deleted or irreversibly anonymised, including the de-duplication identifier, as part of the account-deletion process; perso does not retain identity-verification attributes after account deletion, except a limited accountability record of the verification decision and its reason, held for up to 12 months for security and audit purposes, with the email address redacted. In the future, we may retain a non-reversible technical identifier for a limited period solely to prevent abuse (for example, to prevent the same document from being used to open more than one account), and we will update this section before any such mechanism is enabled. A verification-decision audit record is retained for 12 months from the decision, including past account deletion, for security and accountability purposes, with account-identifying fields redacted. Content data is retained while posted and deleted within 30 days of removal or of account deletion. Moderation audit logs are retained for as long as necessary for accountability under the Digital Services Act. Records of moderation decisions and appeals are retained without a deletion timeline, for the life of that accountability obligation, as the durable record supporting platform-safety and appeal decisions; other moderation audit logs are deleted or irreversibly anonymised once no longer necessary. Security and technical logs are retained for as long as necessary for security, abuse-prevention and operational purposes, then deleted or irreversibly anonymised. Contact-form and partnership-inquiry data is retained for up to 12 months: network identifiers are removed after 90 days and the records are deleted after 12 months. Where an organisation verification application is declined, the personal data of the authorised representative from that application is retained for 365 days from the decline and then deleted. Network identifiers (IP address and browser information) captured with an account-recovery attempt are removed after 30 days; the recovery-attempt record is retained without them as a security-audit record. CSAM evidence: where we detect or are notified of suspected child sexual abuse material (CSAM), we immediately remove or disable access to that content on our service but may retain associated hashes, metadata and a minimal evidentiary copy in a segregated evidence store for as long as necessary to comply with our legal obligations, cooperate with competent authorities and protect victims, and then delete it securely. Analytics data is pseudonymised and aggregated and retained no longer than necessary for the purposes described in this policy.

Lawful Basis for Processing

• Performance of a contract (GDPR Art. 6(1)(b)), together with the substantial-public-interest condition (GDPR Art. 9(2)(g)) for the special-category biometric data, for identity verification.
• Consent (GDPR Art. 6(1)(a)) for analytics and marketing cookies.
• Contract performance (GDPR Art. 6(1)(b)) for account operation and feature delivery.
• Legal obligation (GDPR Art. 6(1)(c)) for fraud prevention and law-enforcement requests.
• Legitimate interest (GDPR Art. 6(1)(f)) for service security and abuse prevention.

Your Rights

Under GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. Erasure ("Right to be Forgotten", Art. 17) and portability (Art. 20) are exposed in-app under Settings → Your Data Rights.

Automated Decision-Making (GDPR Art. 22)

Most processing at perso does not involve solely automated decisions with legal or similarly significant effects. There is one exception, disclosed here with the safeguards that apply to it. To prevent the same document from being used to open more than one account, the outcome of your identity verification is automatically checked against a non-reversible de-duplication identifier derived from your identity document number. If it matches an already-verified account, your verification is automatically declined and a second account is not created. Because this is a solely automated decision that can significantly affect you (it can prevent you from opening an account), the GDPR Article 22(3) safeguards apply: you have the right to contest the decision, to obtain human review by a member of our team, and to express your point of view. To exercise these rights, email dpo@perso.social from the email address linked to your attempt, stating that you believe the duplicate decision is wrong and why (for example, that you are a different person who was matched in error). A human reviewer will re-examine your case, and if the decline was incorrect we will let you re-verify. Account matching decision. When you verify your identity, whether to recover an account or as part of opening a new one, the one-way identifier derived from your document number is automatically compared against existing accounts. If it does not match an account we can return to you, verification does not proceed. That is the case when no account exists for that identity, when the account was deleted, and when the account is one we have permanently closed. We do not tell you which of these applies, because the reason could reveal the status of an account that is not yours. Because this comparison is automated and can significantly affect you, the Article 22(3) safeguards apply: you can contest the outcome, obtain human review, and express your point of view. Write to dpo@perso.social. A person will review whether the match is correct. If your document was matched to an account that is not yours, we will clear the match so that you can verify and open your own account. We will not give you access to the matched account, and this review does not reconsider any decision we made about that account. Age determination. perso is only for adults. Before an approved verification is accepted, an automated check confirms that its age evidence positively establishes that you are 18 or older. If it does not, whether because the evidence shows you are under 18 or because it could not be read, your verification is automatically declined and no account is created. This check is deliberately strict: absent or unreadable age evidence is treated as not passing rather than guessed. We do not retain your date of birth. The one exception is narrow and temporary: if you contest an age decline and then verify again while that contest is open, we keep the date of birth read from that retry, together with the birthdate you tell us, solely so a person can compare them and judge whether the automated check misread your document. We keep those two dates only while your contest is open, and we delete them the moment it is resolved, whichever way it is resolved; what remains afterward is only the record that a decision was made and its reason. If your verification succeeds, we keep only the fact that the over-18 check passed; if it is declined and not contested, we keep only the decline and its reason category. Because this is a solely automated decision that can significantly affect you, the Article 22(3) safeguards apply: you can contest the outcome, obtain human review, and express your point of view. Write to dpo@perso.social and a person will review your case. If a person reviews your case and confirms from the evidence that you are over 18, we apply that confirmation so your next verification is accepted on the strength of it, and a correct outcome takes effect on your account rather than the same automated misreading repeating. If you are under 18, you are welcome to join once you meet the age requirement. Today, content moderation on perso is primarily human: we may review posts and accounts and restrict or remove them in accordance with our rules and the Digital Services Act (DSA). Where a moderation decision is based on an automated check (for example, to detect duplicate accounts), you have the safeguards required by Article 22(3) GDPR: you will be informed when an automated decision is made, you can contest it and express your point of view, and you can ask for a human to review the decision. Automated media-safety screening. We use automated media-safety screening to help detect and prevent the sharing of known child sexual abuse material. When an image is submitted for screening, or when video frames are screened, perso generates a non-reversible PhotoDNA hash from the image or video frame and compares it against reference hashes of known illegal material. We use a match result to take safety action under our rules, including restricting, removing, or escalating the relevant content for review where appropriate. If an automated decision has a legal or similarly significant effect on you, you may contact us to request human review, express your point of view, and challenge the decision. Automated screening of uploaded media. Media you upload is automatically evaluated by a nudity-detection classifier before it can be shown to others. If the classifier flags your content, the content is withheld from display until a member of our team has reviewed it. Separately, and regardless of what any automated check returns, every video is withheld until an authorized reviewer has reviewed it and approved it. This automated step does not by itself suspend your account or impose penalties; it gates visibility pending human review. You can contest a resulting moderation decision through our complaint and appeal process.

Sub-Processors

• Didit: identity verification. Acts as our data processor, on our documented instructions, for identity verification and de-duplication. We never receive your identity-document images, biometric templates, or document nationality; Didit processes biometric data only transiently during the verification session, and we configure the session for immediate deletion at the vendor once the verification outcome is returned. The verification payload may also contain technical and security signals, including IP-based location metadata. perso does not read, use, or retain these signals.
• OVHcloud (France): application server hosting.
• Scaleway (France, Paris region): managed PostgreSQL database, key management, and future object storage.
• IONOS (EU): email delivery.
• Microsoft (PhotoDNA Cloud Service): detection of known child sexual abuse material via perceptual-hash matching. Data: a non-reversible perceptual hash of uploaded media plus operational request metadata; no image content or account identifiers in the routine path. Location: Microsoft EU instance (processed within the EEA). Safeguard: processed within the EEA; for any incidental access from outside the EEA, perso relies on Microsoft's EU-U.S. Data Privacy Framework certification and, as a fallback, the 2021 Standard Contractual Clauses in Microsoft's DPA.

App stores and platform providers

Apple and Google provide app-distribution services. Where you use an app-store feature, the relevant platform provider processes information under its own privacy terms. If perso later enables paid membership or in-app purchases, we will update this Privacy Policy and the relevant payment information before those features become available.

International transfers

Some of our service providers may process personal data outside the United Kingdom, European Economic Area, or another jurisdiction in which you live. Where this occurs, we use the safeguards required by applicable data-protection law. These may include an adequacy decision, approved contractual protections, or another lawful transfer mechanism.

For child-safety screening, perso sends non-reversible PhotoDNA hashes generated from submitted images and sampled frames from submitted video to Microsoft's European PhotoDNA endpoint. We do not send the original image or video, a link to the media, or the uploader's account identifier for this check.

You can contact us to request further information about the safeguards that apply to a particular international transfer. Where we receive a request for personal data from a public authority outside the United Kingdom or European Economic Area, we assess the request and applicable legal requirements before responding and, where permitted, challenge or narrow requests that appear unlawful, disproportionate, or overbroad.

Data Protection Contact

For data-protection enquiries: dpo@perso.social.

Supervisory Authority

Users in the European Economic Area have the right to lodge a complaint with their local supervisory authority.

United Kingdom, Crown Dependencies & Gibraltar: No Article 27 Representative

perso is not directed to residents of the United Kingdom, the Channel Islands, the Isle of Man, or Gibraltar, and does not offer services to, or monitor the behaviour of, individuals located in those jurisdictions; account creation from a declared residence in any of them is refused. perso has therefore not designated a representative under Article 27 of the UK GDPR.

Contact

• Privacy questions: dpo@perso.social.
• Data Controller: perso.social is operated by ACGG Rent, S.L., a Spanish sociedad limitada, with registered office (domicilio social) at Calle Francisco Ayala 27, 28522 Rivas-Vaciamadrid, Madrid, Spain; CIF B-56240385; registered with the Registro Mercantil de Madrid, Tomo 45565, Folio 30, Hoja M-801410. Represented by Etienne Gillard. ACGG Rent, S.L. is the sole data controller, established in Spain.