Privacy Policy

The short version. We collect what we need to run Perchway: your name and email, what you put into Perchway, and basic technical information like IP addresses. We use it to run the service, keep it safe and talk to you about it. We don't sell personal information, we don't use advertising trackers, and we don't use your content to train AI. To spot fraud and abuse and to review sellers, we and services like Stripe use automated checks, including AI, but a person on our team makes the decisions that matter. Payments are handled by Stripe and PayPal, so we never see full card or bank numbers. When you buy through Perchway, we're the seller, so we keep a record of the purchase for tax. When a freelancer stores information about their clients in Perchway, the freelancer decides what happens to it, and we handle it for them. You can ask to see, fix, download or delete your information any time by emailing [email protected].

1. Who we are

Perchway runs perchway.com, prch.shop, Perchway shops and client portals (including ones on custom domains), our apps and APIs, and the emails we send. We call these the "Service". "Perchway", "we" and "us" mean Perchway LLC, a Wisconsin limited liability company. Words like "Freelancer", "Client" and "Content" mean what the Terms of Service say they mean.

For privacy questions or requests, email [email protected].

2. Our role: when we decide, and when a freelancer does

• We decide (we're the "controller") for information about our website visitors, people on our waitlist, Freelancers' accounts and subscriptions, Clients' sign-in and use of the Service, and how we keep the Service secure. We're also the controller of the records we keep of purchases made through Perchway, which we use to run checkout and delivery, collect our fee, prevent fraud and meet legal obligations. The Freelancer you buy from is the seller, and gets your purchase details to deliver your order.
• A Freelancer decides (we're their "processor" or "service provider") for information a Freelancer keeps in Perchway about their Clients and their work: client records, messages, files, proposals, contracts and invoices. We handle that information only to provide the Service to the Freelancer, as our Data Processing Addendum describes. If you're a Client and want to know what a Freelancer holds about you, or want it changed or deleted, ask the Freelancer first. We'll help them respond, and if you contact us, we'll pass your request on.

3. What we collect

Information you give us

• Waitlist: your name and email, the plan you were looking at, and which page you signed up on. If you choose to tell us, what you make, a link to your work, and whether you'd like to be a founding seller. We also note how your visit started: the website or link that brought you, and the first page you saw.
• Account: your name, email address, business name, profile photo, and your shop's details. If you sign in with Google, Google tells us your name, email address and profile picture. If you use a passkey, we store only its public key. Your fingerprint or face scan never leaves your device.
• Content: your products, files, messages, proposals, contracts, invoices, comments and anything else you add. For Freelancers, this includes the details you add about your Clients.
• Selling: before you can use your dashboard, your business details: your phone number, business address, whether you sell as yourself or as a company (and the company's name), what you sell and links to your work. And details of the person responsible for the account (you, or for a company the person acting for it): their legal name, date of birth, home address, and their role at the company. We also keep when you agreed to our Seller Terms. When you ask us to approve your shop, we also record the IP address, approximate location and browser you ask from. Only you and our team see these details. They never appear in your shop.
• ID check: before your shop opens, we may ask you to check your ID with Stripe Identity. On Stripe's own pages, you take a photo of a government ID and a selfie. Stripe checks the ID is genuine and compares your face in the selfie with the photo on it, using facial recognition, under the Stripe Privacy Policy and only once you've agreed to it on Stripe's page. Stripe tells us whether the check passed and why not, the name and date of birth on the ID, and its type, the country that issued it and when it expires, which we compare with your details. The pictures, your ID number and any facial data stay with Stripe: we never receive them. Our team can look at the pictures in Stripe when reviewing your shop.
• Signatures: when you sign a proposal or contract, we record your name, email address, the time, your IP address and your browser, as evidence of the signature.
• Talking to us: what you send us when you email us or ask for help, and notes our team keeps about your requests so whoever helps you next knows what's happened. The notes are included if you ask for a copy of your information.

Payment information

Stripe processes all payments: Clients paying Freelancers through Perchway, which go to the Freelancer's own Stripe account, and Freelancers paying Perchway for Flight, Soar or premium templates. We never receive or store full card numbers or bank account numbers. Stripe gives us limited details, such as the amount, the payment's status, the card brand and its last four digits, fees, refunds and disputes.

Freelancers can also connect their own PayPal business account, so their Clients can pay them with PayPal, into that account. PayPal collects the payment details. PayPal gives us the payment's amount, status and fees, the payer's name and email address, and for physical items, the shipping address chosen in PayPal. For Freelancers, PayPal tells us whether the account can receive payments, has a confirmed email address and has given Perchway permission to take payments for it. PayPal's use of your information is covered by the PayPal Privacy Statement.

We keep a record of each purchase made through Perchway: the buyer's name, email address, billing country, what they bought, the price, any shipping and tax the Freelancer charged, and Perchway's fee. For physical items, it also includes the shipping address the buyer gives at checkout, which Stripe collects for us, and any tracking details the Freelancer adds. Freelancers give their ID, tax ID and bank details to Stripe, not to us, when they set up their Stripe account. Stripe tells us whether the account can take payments. Stripe's use of your information is covered by the Stripe Privacy Policy.

Information collected automatically

• Device and log information: your IP address, browser and device type, the pages and features you use, times and dates, the page that sent you to us, and error reports. Our hosting and network providers record this in server logs.
• Approximate location, worked out from your IP address. We don't collect precise location.
• Website analytics: we count visits to our website ourselves, in a way that doesn't use cookies and doesn't identify you. For each page view we keep the page, the website or link that brought you, your country, your type of device and your browser's name. To count each visitor once a day, we combine your IP address and browser details with a random value that we replace every day, and keep only the result, which can't be traced back to you. We never keep your IP address for this. We also keep where on our pages people click (which button, link or part of the page, and where on it) and how far down each page people scroll, so we can see which parts of our pages help people and which they miss. These aren't linked to you or to your visit, and we never record what you type (see section 6).

Information from others

• From Freelancers: if you're a Client, the Freelancer you work with may add your name, email address, business details and the work you do together.
• From Stripe, PayPal and Google, as described above.
• From security and fraud services, like Cloudflare, Stripe and PayPal, that help us spot bots, fraud and abuse: what their automated checks find, such as whether a visit looks like it comes from a bot, or that a payment was declined as likely fraud.

4. How we use it

• To run the Service: create and manage accounts, sign you in, host shops and portals, deliver messages and files, unlock paid files, process plans and fees, and do what you ask Perchway to do.
• To send you messages about the Service: sign-in codes, receipts, invoice reminders, message notifications, and notices about your account, security and these policies. These are part of the Service, so you can't unsubscribe from them while you have an account.
• To tell you about Perchway: if you joined the waitlist, we'll only email you about Perchway opening. If you have an account, we may send occasional product news. Every one of these emails has an unsubscribe link.
• To keep Perchway safe: prevent fraud, spam, abuse and security incidents, and enforce our Terms and Acceptable Use Policy.
• To review sellers: check the details a Freelancer gives us, including that the person responsible is 18 or older and, with an ID check, that they are who they say they are, and decide whether to open their shops. We compare the details they give us, and the IP addresses they sign in and apply from, with other Perchway accounts, including ones we've closed, so the same person can't open a new account after we've closed one.
• To improve Perchway: understand how the Service is used, fix problems and plan features, mostly using combined or de-identified information.
• To meet legal obligations: calculate, collect and report sales tax and VAT on Perchway's own charges, keep financial records, answer lawful requests, and protect our rights and the rights of others.

Automated checks, including AI. To keep Perchway safe and to review sellers, we use automated checks, some of which use artificial intelligence (AI) and machine learning. Some are our own, and some are run by the services we use:

• Our own checks look for signs of fraud, spam and abuse, such as bots, repeated sign-in attempts, throwaway email addresses, and details shared with accounts we've closed. When you ask us to approve your shop, they work out a risk score from your details, where you've signed in from, what you sell and how your details compare with other accounts, and check that your details, your ID check, your Stripe or PayPal account and your shop are complete and match each other. We may use AI models in these checks, for example to spot patterns of fraud, or Content that breaks our rules. Any AI provider we use for them is listed on our Subprocessors page, and we don't let it train its models on your information.
• Stripe uses machine learning to spot fraudulent payments, and, in an ID check, to check that the ID is genuine and that the selfie matches its photo.
• PayPal checks PayPal payments for fraud.
• Cloudflare tells people from bots on our sign-in and sign-up forms (Turnstile), and protects our sites from attacks.

Stripe, PayPal and Cloudflare run these checks under their own privacy policies, and may use what they learn, across all the businesses they work with, to improve their fraud and security tools.

An automated check can flag something for our team to look at, or hold it until we have: a shop can't be approved until its checks pass, for example. It can also stop something straight away, as when Turnstile turns away a bot, or Stripe declines a payment that looks fraudulent. Stripe and PayPal make their own decisions about payments, and about the accounts you hold with them, under their own terms. Decisions we make about you that have legal or similarly significant effects, such as declining your shop or suspending or closing your account, are made by a person on our team, who looks at the reasons behind the checks first. Automated checks can be wrong. If you think one has been wrong about you, email [email protected] and a person will look at it again.

AI features. When you use an AI feature, the information needed for it is sent to our AI provider to produce the result. We don't let our AI providers train their models on your information, and we don't use your Content to train AI models.

What we don't do. We don't sell personal information. We don't share it for cross-context behavioral advertising (targeted ads), and we don't put advertising trackers on our sites. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects: a person makes them, as described above.

5. Legal bases (EEA, UK and Switzerland)

If you're in the European Economic Area, the UK or Switzerland, we rely on these legal bases:

• Contract: to provide the Service you've asked for.
• Legitimate interests: to keep the Service secure, prevent fraud, understand and improve the Service, and tell account holders about Perchway. We balance these against your rights, and you can object.
• Consent: for waitlist emails and anything else we ask your permission for. You can withdraw it any time.
• Legal obligation: to keep records and respond to lawful requests.

6. Cookies and local storage

We use only what Perchway needs to work:

• Sign-in cookies keep you signed in and protect your session.
• Security checks. Cloudflare Turnstile may check your browser to tell people from bots on sign-in and sign-up forms.
• Preferences like light or dark mode are saved in your browser's local storage. Nothing is sent to us.

We don't use advertising or cross-site tracking cookies. Our website analytics are cookieless and count visits without identifying you. While you browse our website, your browser's session storage remembers how your visit started, until you close the tab, so that if you join the waitlist we know what brought you. Because we don't track you across sites or sell your information, we honor Global Privacy Control signals as opt-outs where the law requires it, though there's nothing further for them to switch off. You can block or delete cookies in your browser settings, but if you block sign-in cookies, you won't be able to sign in.

Freelancers' own code. On Flight and Soar, Freelancers can add their own code and content from other services to their shop pages, like a video, a booking calendar or a newsletter sign-up form. It runs in a separate, sandboxed frame, never on checkout or in client portals. Those services may set cookies or collect information from you under their own privacy policies. The Freelancer chose them and is responsible for them, not Perchway.

7. Who we share it with

• Between Freelancers and Clients. Perchway is built for working together, so the people in a conversation, project or purchase see what's shared there. A Client sees the Freelancer's shop, messages, proposals, invoices and files. A Freelancer sees what their Clients send, sign and pay, and gets each buyer's name, email address and what they bought, and for physical items their shipping address, so they can deliver or ship it.
• Team members a Freelancer adds can see that Freelancer's account.
• Public pages. Shop pages, products and profiles that Freelancers publish can be seen by anyone, and search engines may index them.
• Service providers who host, secure and run parts of Perchway for us, under contracts that limit what they can do with the information. They're listed on our Subprocessors page.
• Stripe, to process payments, calculate tax on Perchway's own charges, connect Freelancers' Stripe accounts, check sellers' IDs and prevent fraud.
• PayPal, to process PayPal payments to Freelancers who connect a PayPal account, and prevent fraud.
• Tax authorities, with details of Perchway's own sales, as tax law requires.
• For legal reasons: if the law requires it, or if we believe in good faith that it's needed to protect someone's safety, investigate fraud or abuse, or enforce our Terms. Where we can, we'll tell you before we hand over your information.
• If Perchway changes hands: for example, in a merger, acquisition, reorganization or sale of assets. This Privacy Policy will keep applying to your information.
• With your permission, in other cases.

8. How long we keep it

• Waitlist: until Perchway opens and we've emailed you. If you don't create an account, we delete your entry within 12 months after that. You can ask us to delete it sooner.
• Accounts and Content: while your account is open. After you close it, we delete it within 30 days. Copies in backups are deleted within 90 days after that.
• Seller details: like the rest of your account, including what Stripe tells us about your ID check. When we delete your account, we also ask Stripe to delete what it collected for the check. If we close an account for fraud or for breaking our rules, we keep the details that identify it for as long as we need them to stop it being opened again.
• Financial and tax records (purchases, including shipping addresses, which decide the sales tax on physical items, payments, fees, invoices, subscriptions and template purchases): up to 7 years, or 10 years where tax law requires it, as it does for EU VAT records.
• Server logs: usually no more than 90 days.
• Website analytics: up to 25 months, and clicks and scrolling up to 13 months. The random value that counts visitors is deleted after a day.
• When we need it for longer: for example, to resolve a dispute, prevent fraud, or meet a legal obligation, we keep only what's needed, and only for as long as it's needed.

A Freelancer decides how long to keep information about their Clients while their account is open, and can delete it at any time.

9. How we protect it

• Everything moves over encrypted connections (HTTPS, TLS 1.2 or newer).
• Stripe and PayPal, both certified to PCI DSS Level 1, handle payment details.
• Files are kept in private storage that's encrypted at rest, and downloaded through short-lived links.
• Our team's access is limited to what each person needs and protected with two-step verification. Staff actions on accounts are logged.
• If someone abuses our sign-in forms, our team can block the email address, email domain or network involved, so no sign-in codes go to it. We keep the block and the reason for it until it's lifted.

No system is perfectly secure. If a breach affects your personal information, we'll tell you, and the authorities, as the law requires.

10. Where it's processed

Perchway is based in the United States, and our main servers are there. Our network provider handles traffic at locations around the world. If you're outside the US, your information is transferred to and processed in the US, where privacy laws may differ from yours. When we transfer personal information from the EEA, the UK or Switzerland, we use safeguards the law recognizes, such as the European Commission's Standard Contractual Clauses (and the UK and Swiss versions), or a provider's certification under the Data Privacy Framework.

11. Your rights and choices

Wherever you live, you can ask us to:

• tell you what personal information we have about you, and give you a copy
• correct it
• delete it
• give it to you in a portable format
• stop or limit some uses of it, or object to them
• withdraw consent you've given
• have a person look again at a decision that an automated check played a part in, and hear your side

Depending on where you live, the law may give you more rights. For example, people in California and several other US states, and in the EEA, the UK and Switzerland, have specific privacy rights.

How to ask. Email [email protected]. We'll confirm it's you, usually by emailing a code to the address on your account, and reply within 30 days, or sooner if the law requires. You can also use an authorized agent. We'll ask for proof that you authorized them. We won't treat you differently for using your privacy rights. If we turn down your request, you can appeal by replying to our answer, and we'll explain the outcome of the appeal. If you're in the EEA, the UK or Switzerland, you can also complain to your data protection authority.

Information a Freelancer holds about you. If your request is about information a Freelancer keeps about you in Perchway, we'll send it to that Freelancer, because they decide what happens to it. We'll help them respond.

Emails. Unsubscribe from product news with the link in any such email. Messages about your account, like sign-in codes and receipts, keep coming while you have an account.

12. Notice for US state residents

This section adds details that some US state laws, including California's, ask for. In the last 12 months, we have collected these categories of personal information, from the sources and for the purposes in sections 3 and 4:

We don't sell personal information or share it for targeted advertising, and we haven't in the last 12 months. We don't knowingly sell or share the personal information of anyone under 16. We don't collect sensitive personal information except what's needed to sign you in and keep your account secure, and what a seller's ID check tells us, and we don't use it to infer anything about you.

13. Children

Perchway isn't for anyone under 18, and we don't knowingly collect personal information from children under 13 (or under 16 in the EEA and UK). If you think a child has given us personal information, email [email protected] and we'll delete it.

14. Changes to this policy

When we make significant changes, we'll tell account holders by email or in Perchway before they take effect, and we'll update the date at the top. If we want to use personal information in a significantly different way, we'll ask for your consent where the law requires it.

15. Contact

• Privacy questions and requests: [email protected]
• Postal address: Perchway LLC, 2800 E. Enterprise Ave, STE 333, Appleton, WI 54913, USA