Privacy Policy

1. Privacy at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

2. Controller

The controller responsible for data processing on this website is:

Mentat Works OÜ
Registry code (registrikood): 17566639
represented by Roberto Siegel
Tööstuse tn 75-71
10416 Tallinn, Harju maakond
Estonia
Email: info@perimea.app

3. Hosting

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you access the website, Vercel automatically processes data (in particular IP address, date and time, requested URL, referrer, user agent) in server log files. This processing serves the provision and security of the service on the basis of Art. 6 (1)(f) GDPR (legitimate interest in technically flawless presentation). Depending on the plan, Vercel stores these server log files for no longer than one day and then deletes them automatically.

Vercel is certified under the EU-US Data Privacy Framework. More information: vercel.com/legal/privacy-policy.

4. Contact form and email contact

If you contact us via the contact form or by email, your details (name, email address, subject, message) will be stored to process the request and in case of follow-up questions.

Legal basis

Processing is based on Art. 6 (1)(b) GDPR (pre-contractual measures) or Art. 6 (1)(f) GDPR (legitimate interest in answering your inquiry).

Delivery via Resend

For technical delivery of form submissions as email, we use the service Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Delivery is performed via the EU region (Frankfurt). Data transmitted: your form input as well as delivery metadata. Legal basis: Art. 6 (1)(f) GDPR. We have concluded a Data Processing Agreement (DPA) with Resend.

Abuse protection (rate limit)

To protect the contact form against abuse (e.g. spam and automated mass submissions), we limit the number of messages per sender. For this purpose, your IP address is stored together with a counter for approx. 20 minutes in a key-value store operated by Upstash (Upstash, Inc., USA; integrated via Vercel KV as a sub-processor of Vercel; transfer based on the EU-US Data Privacy Framework or the Standard Contractual Clauses in the data processing agreement with Vercel) and deleted automatically afterwards. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in preventing abuse and in keeping the form operational).

Storage period

The submitted data remains with us until you request its deletion, revoke your consent to storage, or the purpose for data storage no longer applies (e.g. after your inquiry has been processed). Mandatory legal provisions — in particular retention periods — remain unaffected.

5. Encryption (SSL/TLS)

This site uses SSL/TLS encryption for security reasons. You can recognize an encrypted connection by the address bar starting with "https://".

6. Cookies, tracking, analytics

This website uses no cookies, no web tracking, no analytics tools (such as Google Analytics, Matomo, etc.) and no external advertising or social media scripts. Fonts are not loaded from third parties either: the typeface used (Inter, SIL Open Font License) is hosted on our own server; visiting the page makes no connection to Google or any other font service.

7. Perimea app — data processing

The Perimea app for iOS and Android and the desktop application Perimea Desk for Windows and macOS process all user and project data exclusively locally on your device. No content data is transmitted to our servers or to third parties. The apps do not communicate with any backend services of ours; we ourselves collect no data from the apps whatsoever. Licences are activated by importing a signed licence file — without any online check. The Android app requests no internet permission; on-device photo redaction (Google ML Kit) therefore transmits no data from within the app. Purchases via Google Play Billing are handled by the Google Play Store app, which may, for technical reasons, transmit diagnostic data — device information, performance metrics, installation identifiers — to Google over encrypted connections. This transmission is mandated by Google and takes place under Google's own responsibility as data controller; we have no influence over it and receive no access to this data (see Google's privacy policy). Content data such as assessments, photos, locations or audio never leaves your device.

8. Orders and payment processing (direct sales)

When you order a licence from us (in particular Consulting licences sold directly), we process the data you provide — name of the contact person, company or licensee, email address, billing details and VAT ID — for entering into and performing the contract (Art. 6 (1)(b) GDPR) and for complying with tax and commercial law obligations (Art. 6 (1)(c) GDPR).

Payments are processed by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Data may be transferred to Stripe, Inc., USA; this takes place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Payment data (e.g. card details) is collected and processed directly by Stripe; we do not receive complete payment data.

We retain invoices and other accounting records for seven years in accordance with the Estonian Accounting Act (Raamatupidamise seadus).

9. Licence management and licence delivery

For licence purchases, Mentat Works OÜ processes name, company, email address, billing and VAT data as well as device activation codes. To issue and manage your licence, we maintain a licence register (licensee, number of seats, term, order and payment reference, checksum of the licence file). The legal basis is Art. 6 (1)(b) GDPR, and Art. 6 (1)(c) GDPR for retention.

We use the following service providers as processors:

• Stripe (Stripe Payments Europe, Ltd., Ireland) — payment processing, see section 8; transfer to Stripe, Inc., USA, on the basis of the EU-US Data Privacy Framework or Standard Contractual Clauses.
• Vercel (Vercel Inc., USA) — hosting of the licence management in the EU region Frankfurt; Vercel is certified under the EU-US Data Privacy Framework.
• Neon (Neon LLC, a Databricks group company, USA) — database (Postgres), data stored in the EU region Frankfurt; transfer based on the EU-US Data Privacy Framework.
• HashiCorp Vault — cryptographic signing of licence files, operated in an EU region (self-hosted on a server of Hetzner Online GmbH, Nuremberg data centre).
• Resend (Resend, Inc., USA) — delivery of licence emails (sender license@perimea.app) via the EU region Frankfurt.

Data processing agreements (Art. 28 GDPR) are in place with all of the providers named. Where providers are located in third countries, the transfer takes place on the basis of an adequacy decision (EU-US Data Privacy Framework) or Standard Contractual Clauses (Art. 46 GDPR).

Storage period: We store licence data for the duration of the business relationship. Data forming part of accounting records is retained for seven years in accordance with the Estonian Accounting Act (Raamatupidamise seadus).

Licence request via perimea.app/lizenz

If you request a Consulting licence via our request form, we process the details you enter (company, VAT identification number, contact person, email address, number of seats) and the device activation codes of your devices. The data is transmitted via our web server (Vercel, EU region Frankfurt) to our licence management system and stored there as a licence draft, which we review and approve manually. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract).

To prevent abuse, we briefly process your IP address to limit the number of requests (Upstash, EU region) and record it in the audit log of the licence draft (Art. 6(1)(f) GDPR; legitimate interest in the security of our licence system). In addition, the form stores device activation codes only locally in your browser so that you can enter codes from several devices one after another; they are only transmitted when you submit the form and can be deleted via your browser settings.

Pick-up link: After approval, we send a personal pick-up link to the email address you provided (via Resend, sender license@perimea.app). The link is valid for 14 days and can be used as many times as the licence covers devices. We only store a checksum of the link and the number and time of pick-ups. Requests that are not accepted are deleted no later than six months after receipt.

10. Support

For support requests (by email or via the contact form), we process your email address, the content of your request and the correspondence history in order to handle the request (Art. 6 (1)(b) GDPR or Art. 6 (1)(f) GDPR — legitimate interest in efficient customer communication). We delete support cases 24 months after completion unless statutory retention obligations apply.

If you send us a licence file for troubleshooting, we process its contents solely to verify the licence (authenticity, assignment, validity).

11. Your rights as a data subject

You have the right at any time to:

• Information about your personal data stored by us (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data ("right to be forgotten", Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

These rights apply to all processing operations described in this policy, including orders, licence management and support.

An informal email to the address listed above is sufficient to assert these rights.

12. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia (www.aki.ee).

13. Validity of this policy

This privacy policy is dated October 2026. As our website and offerings evolve, it may become necessary to amend this policy. The most current version can always be found on this page.