PeersUp

    Privacy Policy

    Last updated: 24 September 2026 · Version 3.2

    1. Who we are (Controller)

    PeersUp OÜ ("we", "us", "our") is the data controller for personal data processed through peersup.com and the PeersUp app. Our registry code is 17604512 and our registered address is Tartu mnt 67/1-13b, 10115 Tallinn, Estonia. For all privacy-related inquiries, contact us at privacy@peersup.com.

    2. Data we collect

    • Account data: name, email, password (hashed), country, profile picture.
    • Profile content: bio, links, social handles, contact details you publish.
    • Payment data: processed by Stripe; we only store transaction IDs, last 4 digits, and invoice metadata.
    • Usage data: page views, click events, device/browser info, approximate location (city/country).
    • Communications: support tickets, emails sent through our CRM tools.
    • Cookies & device IDs: see our Cookie Policy.

    3. Why we process your data (purposes & legal basis)

    PurposeLegal basis (GDPR Art. 6)
    Provide the service (account, profile hosting, NFC linking)Contract (b)
    Process payments & invoicingContract (b) + Legal obligation (c)
    Service improvement & analyticsConsent (a) — opt-in via cookie banner
    Marketing emails & newslettersConsent (a) — separate opt-in
    Retargeting pixels on profilesConsent (a)
    Fraud prevention & securityLegitimate interests (f)
    Tax/accounting record retentionLegal obligation (c)

    Important: The purposes listed above for analytics, marketing, newsletters, advertising, retargeting and general service analytics do not apply to data obtained from Google Workspace APIs. Google Workspace API data is used only for the Gmail functionality described in Section 4a.

    4. Sharing & sub-processors

    We never sell your data. We share it only with vetted sub-processors necessary to run the service (Supabase, Stripe, Resend, Cloudflare). The full list is available at /sub-processors. International transfers rely on Standard Contractual Clauses where applicable.

    The general subprocessors and data uses described in this section do not authorize any secondary use of Google Workspace API data. Google Workspace API data is subject to the stricter limitations in Section 4a.

    4a. Google Workspace API Data

    PeersUp accesses Google Workspace data only when a user explicitly connects their Gmail account.

    PeersUp uses Google Workspace API data solely to provide the Gmail integration requested by the user:

    • gmail.send is used only to send emails that the user has explicitly written, approved, scheduled or requested through the PeersUp CRM.
    • gmail.readonly is used only to identify and display replies belonging to Gmail conversations initiated through PeersUp, so those replies can be shown in the corresponding CRM contact conversation.

    PeersUp does not use Google Workspace API data for:

    • advertising
    • retargeting
    • marketing profiling
    • analytics unrelated to the Gmail integration
    • lead enrichment
    • prospecting
    • selling or sharing data with data brokers
    • determining creditworthiness
    • training, developing or improving generalized AI or machine-learning models
    • Google Workspace API data is not transferred to third-party AI or ML services.
    • PeersUp AI features and connected AI assistants do not receive Gmail message bodies, Gmail subjects, Gmail threads or other Google Workspace API-derived content.
    • PeersUp does not import or provide access to the user's general Gmail inbox.
    • PeersUp does not modify or delete Gmail messages.
    • PeersUp does not use Google Workspace API data to build advertising profiles or for any secondary commercial purpose.
    • Google Workspace API data may be processed only by infrastructure providers strictly when necessary to operate the Gmail integration, provide security, or comply with applicable law. Those providers may not use the data for their own purposes.
    • PeersUp employees and contractors do not access Google Workspace API data except where necessary for security, legal compliance, or where the user has explicitly requested support involving specific data.

    The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

    4b. Connected Communication, Calendar and Platform APIs

    PeersUp can connect to third-party communication and calendar services only when a user enables the relevant integration. The provider's own authorization screen may also describe the permissions being requested. PeersUp uses connected-service data only to provide the feature the user requested, maintain the connection, secure the service, and comply with applicable law.

    Microsoft Outlook

    When Outlook is connected, PeersUp uses Microsoft OAuth and Microsoft Graph with delegated permissions including User.Read, Mail.Send, Mail.Read, email identity and offline_access. PeersUp uses these permissions to identify the connected mailbox, send messages requested by the user, and read replies in conversations PeersUp initiated so those replies can be shown in the corresponding CRM conversation.

    Instagram

    When an eligible Instagram account is connected, PeersUp uses Meta/Instagram APIs with permissions for basic business account information, messages and comments. Depending on the feature enabled, PeersUp may process the connected account identifier, username, message or comment content, sender identifiers, campaign context and access tokens in order to display conversations, receive webhook events, and send user-configured replies.

    WhatsApp Business

    PeersUp supports WhatsApp Business Platform connections through Meta-hosted onboarding where available. Permissions can include whatsapp_business_management, whatsapp_business_messaging and business_management. PeersUp may process the WhatsApp Business Account identifier, phone-number identifier, verified/display name, message data and connection tokens needed to send and receive communications requested through PeersUp.

    LinkedIn through Unipile

    Where this integration is enabled, PeersUp uses Unipile SAS as an API processor to connect a user's LinkedIn account and provide messaging or conversation synchronization. Data may include connected-account identifiers, participant/profile identifiers, conversation metadata and message content. The integration is not an endorsement of PeersUp by LinkedIn and may be affected by LinkedIn or Unipile availability and platform rules.

    LinkupAPI WhatsApp connection

    Where the optional QR/realtime WhatsApp connection is enabled, PeersUp may use LinkupAPI SAS to establish and maintain the connection. PeersUp stores the provider account reference and connection state required to operate the feature; the provider may process connection and message data as necessary to execute API requests.

    Google Calendar

    When Google Calendar is connected, PeersUp requests the calendar-events permission needed to create or synchronize booking-related calendar events, together with basic account identity. Calendar data is used for scheduling features requested by the user and is not treated as permission for unrelated advertising or enrichment.

    Custom email

    If a user connects a custom SMTP/IMAP mailbox, PeersUp processes the credentials, addresses and message data needed to send email and synchronize replies. The mailbox provider selected by the user independently processes data under its own terms and privacy policy.

    A current list of service providers, including their role, purpose, data categories and privacy-policy links, is available on our Sub-processors & Connected Service Providers page.

    4c. AI and Professional Research Providers

    Certain optional research and AI features may send feature prompts, search queries, public professional information or company context to external API providers such as Perplexity, Exa, Apollo.io and Google Gemini. These services are used only for the feature being requested and may be unavailable if the relevant provider is not configured.

    Google Workspace API-derived Gmail data is excluded from these AI and enrichment workflows.

    Users should not submit unnecessary sensitive personal data to AI or research features. PeersUp may change the underlying model or research provider as features evolve; material provider changes are reflected on our provider-disclosure page.

    5. Retention

    • Account & profile: until you delete your account (+30 days backup).
    • Analytics events: 14 months, then aggregated.
    • Invoices & payment records: 10 years (legal/tax).
    • Support tickets: 3 years after closure.
    • Consent records: 5 years (to prove valid consent).
    • Google Workspace API data: Gmail OAuth credentials are deleted and the Google grant is revoked as soon as you disconnect Gmail or delete your account. Replies imported into a CRM conversation remain in that conversation so your contact history stays intact, and are deleted when you delete the message, the contact, or your account (+30 days backup).

    6. Your rights (GDPR Art. 15-22)

    You can access, rectify, delete, restrict, object, or port your data. Most actions are self-serve in your account. For more details, visit our GDPR Center. We respond to requests within 30 days.

    7. Security

    Data in transit is encrypted with TLS 1.2+. Data at rest is encrypted by our infrastructure provider. We use Row-Level Security on the database, role-based access internally, and CAPTCHA + rate limiting to deter abuse.

    8. Children

    PeersUp is not intended for users under 16. We do not knowingly collect data from children.

    9. Changes

    We will notify you of material changes by email and prompt re-consent where required.

    10. Complaints

    Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia. You can contact the authority at info@aki.ee or visit aki.ee. You may also lodge a complaint with the supervisory authority in your country of residence where applicable. A list of EU authorities is available at edpb.europa.eu.

    11. Connected AI assistants (ChatGPT and similar)

    You can connect an AI assistant such as ChatGPT to your PeersUp account. Nothing is shared with an assistant unless you start that connection yourself.

    Google Workspace API-derived data is excluded from connected AI assistant access. Gmail message bodies, subjects, threads and other Gmail API-derived content are not provided to ChatGPT or other connected AI assistants.

    • How access is granted: the assistant sends you to a PeersUp authorization screen. You sign in to your own account and approve or decline. We never share your password with the assistant, and the assistant never receives database credentials.
    • What it can read: only data belonging to your own account — your contacts and their details, notes, follow-up reminders, bookings and your profiles including the blocks on them. It can never reach another PeersUp user's data.
    • What it can change: with your approval it can create and update contacts, add notes, create follow-ups, and create, edit or delete your own profiles and profile blocks.
    • Publishing: an assistant can never publish a profile. It can only create a publication request, which you approve or decline inside PeersUp under My Profiles.
    • Third-party processing: anything the assistant reads is processed by the provider of that assistant (for example OpenAI) under their own terms and privacy policy. PeersUp is not the controller of that processing.
    • What we log: for each assistant request we record the tool used, the time, whether it succeeded, how long it took, an error code where relevant and a non-reversible reference to your account. We do not log access tokens or the contents of your notes and contacts. These logs are kept for up to 30 days for security and troubleshooting.
    • Revoking access: remove the PeersUp connector inside the assistant (in ChatGPT: Settings → Connectors → PeersUp → remove), or email privacy@peersup.com to have the authorization revoked. Once revoked, the assistant's access stops working.
    • Your rights: data created through an assistant is ordinary PeersUp account data. The access, correction, export and deletion rights described above apply to it in the same way, and deleting your account removes it.

    12. Contact

    PeersUp OÜ, registry code 17604512
    Tartu mnt 67/1-13b, 10115 Tallinn, Estonia
    privacy@peersup.com