Privacy

Last updated 4 August 2026

This describes what Perilunes stores, why, and who it goes to. Two different groups of people are involved and they are treated differently: users (you, who hold an account) and prospects (the people you research and email).

Data about you

• Account: email address and authentication data, handled by our auth provider.
• Settings: sender name and address, signature, send window, send limits, and your learned voice profile.
• Connected credentials: mailbox (SMTP/IMAP) details and any API keys you add. Encrypted at rest with AES-256-GCM and used only to operate the Service for you.
• Operational records: agent runs (which model ran, token counts, duration, success or failure) and job history, used for reliability and billing.

Data about prospects

Business-contact information you upload or the Service collects from public sources: name, role, employer, company website, and business email. Plus generated research briefs, drafted messages, delivery events, and replies received in the connected mailbox.

For this data you are the controller and we are the processor. We use it only to provide the Service to you — never to build a shared contact database, and never sold.

The shared company cache

To avoid re-researching the same company for every account, factual and publicly available information about companies — what they do, their sector, technologies detected on their website — is cached and reused across accounts, and expires after 30 days. This cache never contains individuals, your leads, your ICPs, your briefs, your hooks, your scores, or anything you wrote.

Who we share with

• AI model provider — prospect research context and your drafting instructions are sent to generate briefs and copy.
• Database and auth host — stores everything above.
• Your own mail provider — outbound mail goes through the mailbox you connect. If you have not connected one, a transactional email provider is used instead.

We do not sell personal data or share it for advertising.

Retention

Your data is kept while your account is open. Delete your account and we delete your leads, campaigns, messages, research, and credentials. Suppression records (addresses that unsubscribed, bounced, or complained) are retained after deletion — that is the point of them, and dropping them would risk re-contacting someone who opted out.

Rights of people in your lists

Anyone you contact can unsubscribe with one click from any message, which suppresses them immediately. They may also ask for access to or erasure of their data. If such a request reaches us for a prospect, we will route it to the account that holds the record, since you are the controller. If it reaches you, we will help you action it.

Security

Access is scoped per account at the database level. Connected credentials are encrypted at rest. Unsubscribe links are signed so they cannot be forged. No system is perfectly secure; if a breach affects your data we will notify you as required by law.

Contact

Privacy questions or requests: privacy@perilunes.com.