Privacy Policy

This Privacy Policy explains how Perch (“Perch”, “we”, “us”, “our”) collects, uses, and protects your data when you visit our website, create an account, connect your marketing platforms, and use the Perch reporting app.

Perch is a product operated by Thriving Colibri Ltd. The app is hosted at perch.thrivingcolibri.ai and our marketing site at perch.marketing. We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

For the purposes of data protection law, the data controller for your Perch account and our website is:

Thriving Colibri Ltd
68 Filton Road, Bristol, BS7 0PB, United Kingdom
Company registration number: 16548767

Email: hello@thrivingcolibri.ai

Note that for the marketing data inside accounts you connect (see section 2), you are usually the controller and we act as your processor. Section 8 covers that in full.

2. The data we collect

We only collect what we need to run the service. Depending on how you use Perch, that includes:

Information you give us directly

• Waitlist details: if you ask to be told when Perch opens, we collect your email address, the date you joined, and which page you signed up from. We use it to confirm you are on the list and to email you when the beta opens, and for nothing else. You can leave the list at any time by replying to any email we send you.
• Account details: your name, email address, and password. Sign-in is handled by our authentication provider (Supabase), which stores your password in a hashed form. We never see or store your password in plain text. You can also sign in with Google, in which case we receive your name, email address and profile picture from Google. We use them to set up your account and sign you in, and we don’t keep the access token Google issues at sign-in.
• Team and invitation details: if you invite colleagues to your workspace, we process the email addresses you invite so we can send the invitation and add them to your team.
• Billing details: if you subscribe to a paid plan, payment is handled by Stripe. We receive your plan, billing status, and the limited details Stripe shares with us (such as the last four digits of your card and your billing country). We do not store full card numbers.
• Your trial, plan and getting-started emails: when you start a trial or a paid plan, we keep the dates Stripe gives us (when the trial ends, when the plan renews or ends) and a record of each email we send you about it. On the Free plan, we keep a record of each getting-started email we send you in your first two weeks. If you cancel and tell us why, in Perch or from a link in one of those emails, we keep your answer. We also keep the date your account first started a trial or a plan, because each account can have one free trial, and which clients you choose to keep live when your account has more clients than its plan includes.
• Report content you create: the dashboards, manual metrics, notes, annotations, budgets, per-client context (a goal, an overall target cost per lead or return on ad spend, and free-text notes that inform your read), and branding you add to your reports.
• Enquiries and feedback: anything you send us when you contact us or submit feedback through the app.

Marketing platform data you connect

The core of Perch is bringing your marketing data into one clear report. When you connect a platform, you authorise us to access that account’s reporting data so we can build your report. Most platforms connect through our connection provider, Composio. Google Ads and Meta can also connect by signing in to Google or Facebook directly in Perch, and Google Business Profile connects only by signing in to Google directly in Perch. This currently covers:

• Google Ads, Google Analytics 4, Google Search Console, Google Business Profile, and Meta (Facebook and Instagram) Ads.

For Google Business Profile we read your listing’s local visibility on a read-only basis: views on Search and Maps, calls, direction requests, website clicks, messages, bookings, and the search terms that surfaced your listing. We also read the listing’s reviews: each reviewer’s public name, the star rating, the text, the date, and whether you have replied. For the profile check we read the listing’s details as Google shows them: the name, address, categories, description, website link, phone number, opening and holiday hours, service area, services, attributes and links, how many photos and videos you and your customers have added, which details Google has changed, and which of your edits Google is still reviewing. Google offers a single permission for Business Profile, and that permission also allows changes to a listing. Perch uses it only to read, and never edits, publishes, or changes a listing, and never replies to a review.

We request this data on a read-only basis for reporting. Perch does not create, edit, pause, or delete campaigns, audiences, or any settings in your connected accounts. For Google Analytics and Search Console, Composio holds the authorisation tokens that keep these connections live. You can connect Google Ads either through Composio or by signing in to Google directly in Perch. When you sign in to Google directly (for Google Ads or Google Business Profile), and for Meta, we store the authorisation token in our own database, where only the Perch service can read it and your browser never sees it. You can disconnect any platform and delete its data at any time — see Deleting your data.

Local ranking in Google Maps

If you set up local ranking for a client, Perch searches Google Maps for the search terms you choose, from a grid of points around the client’s business, and records where the business appears at each point. Our search data provider, DataForSEO, runs these searches on Google Maps’ public results. Perch sends DataForSEO the search terms you choose (Perch suggests them from the client’s own Business Profile search terms), the map position of each point and, when you look up a listing, the business name you type.

For each scan, Perch stores the search terms, the points searched, the business’s position at each point, and the name, Google place ID, rating, review count, category and address of the businesses in the results. These are public business listings. They hold no personal data about the people who search Google Maps.

AI answers

If you add questions for a client, Perch asks Google and ChatGPT those questions and records whether the answers name the business. DataForSEO runs these searches too. Perch sends DataForSEO the questions you save (Perch drafts them from the client’s own Business Profile search terms) and the map position of the client’s listing, which Google answers from. The business’s name, website and phone number stay in Perch, which uses them to recognise the business in the answers.

For each check, Perch stores the questions, whether each answer named the business, its place in the answer’s list of businesses, the other businesses the answer named, the websites it drew on, and the first 600 characters of each answer. These come from Google’s and ChatGPT’s answers about businesses, and hold no personal data about the people who ask Google or ChatGPT.

Google user data and Limited Use

Perch’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use the Google Ads, Google Analytics, Search Console, and Google Business Profile data you connect only to build and show your reports to you. We do not use it to serve advertising, we do not sell it, and we do not transfer it to anyone except as needed to provide Perch to you.

Connecting Perch to your AI tools

You can connect your Perch reports to an AI assistant such as Claude, so you can ask it for breakdowns of your data and have it arrange your reports. Where you use local ranking, it can also start a new scan of the search terms you chose, or a new check of the AI answers questions you saved, which runs exactly as one started in Perch. You start this either by pasting a connection token we generate for you, or by approving a one-click connection (an OAuth authorisation) on a consent screen. There you choose the scope: your whole account (the AI tool can read and arrange reports for every client in your account) or a single client (the connection is locked to that one client, useful if you hand it to that client’s own team). Either way a connection only ever reaches clients in your own account, it is read-only toward your ad platforms, and it never lets the AI tool change your accounts.

For each connection we store only what is needed to run it: a hashed connection token (never the token itself) and, for a one-click connection, the registration details of the AI app (such as its name and return address) and a short-lived, single-use authorisation code. You can see and revoke any connection at any time on the Connect to Claude page. When your report figures are read this way they are returned to the AI tool you connected, which handles them under its own terms.

Information we collect automatically

• Usage and device data on our marketing site: where you allow analytics and advertising cookies, we collect information such as your IP address, browser, device, pages visited, referring source, and how you interact with the site. See our Cookie Policy for the full detail.
• Essential app data: inside the app we use a small number of strictly necessary cookies and similar technologies to keep you signed in and to keep the service secure.

We do not intentionally collect special category data (such as health, ethnicity, or religious belief). Please don’t put sensitive information into free-text fields such as notes.

3. How we use your data and our lawful bases

Under UK GDPR we must have a lawful basis for processing your data. Here is what we do and why:

Where we rely on legitimate interests, we have weighed our interest in running and improving Perch against your rights, and we only proceed where your rights don’t override that interest.

4. Cookies, analytics, and advertising

On our marketing site we use cookies and similar technologies for essential function, analytics, and advertising. The analytics and advertising tags, including Google Analytics 4, Google Ads (conversion and remarketing tags), and the Meta (Facebook) Pixel, are non-essential and load only after you give consent through our cookie banner.

We use Google Consent Mode v2, so until you consent these tags are set to a denied state and don’t store or share identifying cookies. You can accept, reject, or change your choices at any time. Every cookie and tag we use is listed in our Cookie Policy.

The Perch app itself (behind sign-in) does not run advertising tags. It uses only the strictly necessary cookies needed to sign you in and keep the service secure.

5. The AI summary feature

Perch can generate a written summary (a “read”) of a report. When you request one, the relevant report figures are sent to our AI provider, Anthropic (the Claude API), to produce the summary, which is then shown back to you.

Anthropic processes this data only to return the result and, under its API terms, does not use it to train its models. The summary is generated automatically and is for general guidance only. There is no solely automated decision that produces a legal or similarly significant effect on you. Always check the figures and use your own judgement before acting on a summary.

6. Who we share your data with

We don’t sell your personal data. We share it only with trusted service providers (“processors”) who help us run Perch, and only as far as needed. These currently include:

• Vercel: hosts and serves the app and website.
• Supabase: provides authentication and securely stores your account, workspace, and report data.
• Composio: manages the secure connections to your marketing platforms and the authorisation tokens behind them.
• Stripe: processes subscription payments.
• Resend: sends service emails, the emails about your trial and plan, the getting-started emails on the Free plan, and team invitations.
• Anthropic: generates the optional AI summary (see section 5).
• DataForSEO: runs the Google Maps searches behind local ranking, and the Google and ChatGPT searches behind AI answers (see section 2).
• Google: Google sign-in; the Google Ads, Google Analytics, Search Console, and Business Profile APIs for the accounts you connect; and Google Analytics and Google Ads on our marketing site where you have consented.
• Meta Platforms: the Meta Ads API for the accounts you connect, and the Meta (Facebook) Pixel on our marketing site where you have consented.

Each processor handles your data under a contract that requires them to keep it secure and use it only on our instructions. We may also disclose data where we are legally required to (for example, to comply with a court order), or to protect our rights, property, or safety.

7. International transfers

Some of our providers (such as Vercel, Supabase, Stripe, Composio, Resend, Anthropic, DataForSEO, Google, and Meta) may process data on servers outside the UK, including in the United States. Where data leaves the UK, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK extension to the EU-US Data Privacy Framework, so your data stays protected to UK standards.

8. Your clients’ data and your responsibilities

Perch is built for marketers and agencies. If you connect accounts that contain the personal data of your own clients or customers (for example, a client’s ad or analytics account), then for that data you are the controller and Perch acts as your processor. We process it only to provide the reporting service to you, on your instructions.

You are responsible for:

• having the right and a lawful basis to connect those accounts and bring their data into Perch;
• making sure your own privacy notices cover the use of a reporting tool like Perch;
• only inviting people who are entitled to see that data into your workspace.

If you need a data processing agreement for this arrangement, email hello@thrivingcolibri.ai.

9. How long we keep your data

We keep personal data only as long as we need it:

• Waitlist email: kept until the beta opens and we have invited you, or until you ask us to remove you, whichever comes first.
• Account and report data: kept while your account is active. If you delete your account or ask us to, we delete or anonymise it within a reasonable period.
• Connected platform data: fetched to build your reports and cached only as long as needed to run the service. Disconnecting a platform stops further access; see Deleting your data.
• Local ranking scans: kept while the client stays in your account, and deleted with the client.
• AI answers checks: kept while the client stays in your account, and deleted with the client.
• Billing records: kept for as long as the law requires (for example, for tax and accounting).
• Trial, plan and getting-started emails, and cancellation answers: kept while your account exists, and deleted with it. If you turn off tips and check-ins, we keep your email address on a do-not-send list so that choice stays in place.
• Enquiries and feedback: kept while we are in contact and for a reasonable period afterwards.

10. Your rights

Under UK GDPR you have the right to:

• Be informed about how we use your data (this policy).
• Access the personal data we hold about you.
• Rectification of inaccurate data.
• Erasure of your data (the “right to be forgotten”).
• Restrict processing in certain circumstances.
• Data portability, to receive your data in a portable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time where we rely on consent (this won’t affect processing already carried out).

To exercise any of these, email hello@thrivingcolibri.ai. We will respond within one month. There is no charge unless a request is clearly unfounded or excessive.

11. How to complain

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

12. Security

We take reasonable technical and organisational measures to protect your data against loss, misuse, and unauthorised access, including encrypted connections, hosted infrastructure with access controls, and keeping platform authorisation tokens either with our connection provider or in a part of our database that only the Perch service can read. No method of transmission over the internet is completely secure, but we work to protect your information and keep our practices under review.

13. Children

Perch is aimed at businesses and is not directed at children under 16. We don’t knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top, and we will make significant changes clear. Please check back occasionally.

15. Contact us

Thriving Colibri Ltd
68 Filton Road, Bristol, BS7 0PB, United Kingdom
Email: hello@thrivingcolibri.ai