Privacy Policy
Perennus is two things: a lifecycle revenue studio, and a product that connects to your marketing platform with read-only access and shows where customers drop between signup and renewal. This page explains what we collect for each, why, where it lives, and how to have it deleted. It is written to be read, not to be survived.
Contents
1. Who we are
Perennus is a lifecycle revenue studio and a lifecycle diagnostic product (the “product”, at monitor.perennus.com), operated by Isaac Olukoya, a sole operator based in Lagos, Nigeria. In this policy, “Perennus”, “we” and “us” mean that operator. “You” means the person or company using the product, working with the Studio, or visiting perennus.com.
For any privacy question, or to exercise any right described below, email isaac@isaacolukoya.com. We are the data controller for your account, contact and website data. For the workspace data we read from your marketing platform, whether through the product or in a Studio engagement, we act as a data processor on your instructions.
2. What we collect
Account data (product)
Your email address, company name, password (stored only as a hash by our authentication provider; we never see or store your plaintext password), and the timestamps of your logins and of each read of your workspace. If you sign in with Google we receive your email address and name from Google; we never receive your Google password.
Workspace data (product)
When you connect a messaging platform we read, and only read, data that already exists in your workspace:
- Segments — each segment's name, the rule that defines who belongs to it, and how many people are in it.
- Campaigns — each campaign's name and the sequence of steps it contains.
- Events — the activity stream, from which we keep three fields per event: the event's name, the platform's own internal identifier for the person, and the time it happened.
- A total contact count, taken from the member count of your all-contacts segment.
We do not read individual contact records, email addresses, names, phone numbers, message content, or the body of anything you have sent. The internal identifier we keep from the activity stream is the platform's own opaque id; we do not resolve it to a person.
Diagnostic output (product)
The measurements the product takes from your workspace data, the evidence grade attached to each one, the findings those measurements support, any estimate of what a finding is worth, and the record of each read over time. The product does not produce a score, a grade or a recommended fix.
What you tell us about your lifecycle (product)
The lifecycle model you confirm — which of your segments and events correspond to which stage — and the decision you record against each finding, including any reason you give for dismissing one.
Contact and engagement data (Studio)
When you contact us, book a call or work with the Studio, we keep your name, email address, company, and what you tell us about your business, together with our correspondence and engagement records.
Website and newsletter data
perennus.com does not use forms or embedded widgets. When you subscribe to The Perennus Letter you do so on Beehiiv’s site, and Beehiiv processes your email address. When you book a call you do so on Lemcal’s site, and Lemcal processes your booking details. Our host, Netlify, processes the technical request data needed to serve each page, such as your IP address and browser type.
We measure how the site is used with PostHog, in cookieless mode: which pages are visited, where visitors arrive from, which links and buttons are clicked, and the type of device and browser. PostHog sets no cookies and stores nothing on your device. It uses your IP address only in passing, to tell visits apart, and does not store it. If your browser sends a Do Not Track signal, nothing is recorded.
3. Your platform credentials
We ask for read-only access, and we never write to your workspace. The product does not send emails, edit campaigns, modify segments, add or remove contacts, or change any setting in your marketing platform. It reads, analyses and reports.
You control what we can see. We recommend issuing a key restricted to read-only permissions, and revoking it in your platform’s own settings as soon as you stop using Perennus. Revoking it ends our access immediately, whatever happens on our side.
Your API key or access token is stored in our database (hosted by Supabase) so that scans can run without you re-entering it. It is transmitted over TLS and is never displayed back to you in full, shared with any third party, or used for anything other than running your scans. If you disconnect the workspace or delete your account, the credential is deleted.
4. Studio engagements
In a Studio engagement (a Lifecycle Diagnostic, Lifecycle Build or Lifecycle Partnership), you may give us access to your marketing platform, product analytics or other tools so we can do the work. That access, and what we may do with it, is set out in the engagement agreement, which takes precedence over this policy for that work.
- We access only what the engagement needs, and only for as long as it needs it.
- We do not copy your customers’ personal data out of your systems except where the agreed work requires it, and we delete any copies when the engagement ends.
- We never publish your data. Case studies are anonymised unless you agree otherwise in writing, and any figure we publish is one you have approved.
5. How we use your data
- To read your workspace and produce the measurements and findings the evidence in it supports
- To show you your findings, what they rest on, and what changed between one reading and the next
- To send transactional email: account confirmation, password resets, and a notice when a reading you asked for does not finish
- To deliver Studio engagements you have agreed to
- To reply when you contact us, and to arrange calls you book
- To operate, debug, secure and improve the product
- To understand how perennus.com is used, through cookieless analytics
- To bill you, if we introduce paid plans and you choose one
We do not sell your data. We do not share it with advertisers. We do not use your workspace data to train machine learning models, and we do not use one customer’s data in another customer’s report, except in aggregate, fully anonymised form (for example, a benchmark computed across many workspaces, from which no individual workspace can be identified).
6. Legal bases for processing
Where the UK GDPR or EU GDPR applies to you, we rely on these legal bases:
- Contract: to provide the product you signed up for and the Studio work you agreed to
- Legitimate interests: to secure, debug and improve the product, to prevent abuse, to reply to enquiries, and to measure how the website is used, balanced against your rights
- Consent: for the newsletter, which you can withdraw at any time using the unsubscribe link in any edition
- Legal obligation: where we must keep records to comply with applicable law
7. Who we share data with
We use a small number of subprocessors. Each receives only what it needs:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database and authentication | Account data, credentials, scan results |
| Netlify | Hosting and serverless functions | Request data needed to serve the site and product |
| Anthropic | AI analysis in the product | Aggregated workspace metrics (see section 8) |
| Resend | Transactional email | Email address, message content |
| Beehiiv | Newsletter | Subscriber email address |
| Lemcal | Call booking | Name, email, booking details |
| Slack | Alerts, only if you connect a webhook | Alert content you have enabled |
| PostHog | Website analytics, cookieless (see section 2) | Pages visited, referrer, clicks, device and browser type. No cookies; IP addresses are not stored. |
| Creem | Payments, only if you choose a paid plan | Name, email, billing details. Card details are handled by Creem; we never see or store them. |
We may also disclose data where the law requires it, or to protect our rights or the safety of others. If Perennus is ever acquired or merged, data may transfer as part of that transaction; you will be told before that happens and given the chance to delete your account first.
8. AI processing
The product uses Anthropic’s Claude API once per reading, to propose how your lifecycle is structured from what your workspace contains. You confirm that proposal before anything is measured against it; the measurements and findings themselves are computed by us, not by a model.
What we send is the structure of your workspace: segment names and the rules that define them, campaign names, event names, and counts. We do not send contact lists, email addresses, names or message content. One caveat worth stating plainly: a segment rule is sent as you wrote it, so if you have defined a segment by a specific person’s email address or by a customer’s domain, that value is part of the rule we send. Anthropic does not use data submitted through its API to train its models.
9. How long we keep it
- Account data: for as long as your account is open
- Reading history: for as long as your account is open, so you can see what changed between one reading and the next
- Platform credentials: until you disconnect the workspace or delete your account
- After account deletion: we delete your account data, credentials and scan history within 30 days, except limited records we must keep by law
- Studio engagement data: access ends and working copies are deleted when the engagement ends, unless the engagement agreement says otherwise; contracts and invoices are kept as the law requires
- Enquiries: for as long as the conversation is active, and then for up to two years unless you ask us to delete them sooner
- Newsletter subscribers: until you unsubscribe
10. Your rights
Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, export it in a portable format, restrict or object to how we process it, and withdraw consent where processing is based on consent. If you are in California, you also have the right to know what personal information is collected and to opt out of any sale of it. We do not sell personal information.
To exercise any of these, email isaac@isaacolukoya.com. We will respond within 30 days. You will not be charged, and we will not treat you differently for asking. If you are in the UK or EU and are unhappy with our response, you may complain to your local supervisory authority.
11. International transfers
Perennus is operated from Nigeria, and our subprocessors operate mainly in the United States and the European Union. If you are in the UK, the EU or another region with data transfer rules, your data will be transferred outside your home jurisdiction. Where required, we rely on Standard Contractual Clauses or equivalent safeguards offered by our subprocessors.
12. Cookies and analytics
perennus.com sets no cookies and stores nothing on your device, and it runs no advertising or cross-site tracking. Its fonts and images are served from our own domain. We measure visits with PostHog in cookieless mode (see section 2). That is why you do not see a cookie banner.
The product at monitor.perennus.com uses cookies and local storage strictly to keep you signed in. Beehiiv and Lemcal, where you subscribe or book a call, set their own cookies under their own privacy policies.
13. Security
All traffic is encrypted in transit with TLS. Data is encrypted at rest by our database provider. Access to production systems is limited to the operator. Passwords are hashed and never stored in plaintext. API credentials are never shown back in the browser in full.
Perennus is not SOC 2 certified. We would rather say that plainly than imply a certification we do not hold. If a data breach affects your personal data, we will notify you and any required regulator without undue delay.
14. Children
Perennus is a business service and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.
15. Changes to this policy
If we change this policy materially, we will update the date at the top and email account holders before the change takes effect. Continuing to use Perennus after that means you accept the updated policy.
16. Contact
Isaac Olukoya, Perennus, Lagos, Nigeria
isaac@isaacolukoya.com