Perch Platform — Privacy Policy
Version 2.0 — effective 13/10/2026. Replaces the version published 21/11/2025.
1. Introduction
Perch Platform is a cloud hosting service operating within the European Union. This policy explains what personal data we collect, why, and what rights you have over it.
We have written it to be accurate rather than flattering. Where something leaves the EU — and one thing does — we say so.
2. Who we are
Perch Platform Limited, a private company limited by shares registered in Ireland, company registration number 801020, registered office Middlequarter, Newcastle, Clonmel, Co. Tipperary, E91 CD71, Ireland.
Contact us about anything in this policy at support@perchplatform.com.
We are not required to appoint a Data Protection Officer and have not done so. Enquiries go to the address above.
3. Two roles: controller and processor
We are the controller of the data we hold to run our business: your account details, your billing records, our correspondence with you, and the technical logs our servers generate. This policy covers that data.
We are a processor for the data you put into your hosted instance — for example your Nextcloud files and contacts, your WordPress site's visitors, or your Forgejo repositories and databases. That data is yours. You decide what goes in and why; we hold it and act on your instructions. Our handling of it is governed by our Data Processing Agreement. If it includes other people's personal data, you are their controller and you need your own privacy notice.
4. What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Full name | Account identification | Art. 6(1)(b) — contract |
| Email address | Login, billing, transactional email and support | Art. 6(1)(b) — contract |
| Password, stored hashed | Authentication | Art. 6(1)(b) — contract |
| Billing records — subscription and invoice history, payment status, billing address where given | Taking payment and keeping proper accounting records | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation under Irish tax and company law |
| Support correspondence | Answering you and keeping a record of what was agreed | Art. 6(1)(b) — contract; Art. 6(1)(f) — our legitimate interest in records of customer dealings |
| Server and application logs — including IP addresses, timestamps, requests and error and security events | Keeping the service running, diagnosing faults, and detecting and investigating abuse and security incidents | Art. 6(1)(f) — our legitimate interest in the security and reliability of our systems |
We collect no more than this. We do not build marketing profiles, we do not sell, rent or trade personal data, and we do not use it for automated decision-making or profiling producing legal or similarly significant effects.
We do not receive or store your full card number. Card details go directly to Stripe.
Giving us your name and email is a contractual requirement — without them we cannot create or run your account.
5. Cookies and local storage
We do not use analytics, advertising or any third-party tracking. No Google Analytics, no Sentry, no PostHog, no tracking pixels, no third-party cookies. Our marketing site loads only the application bundle and its configuration.
Our dashboard at app.perchplatform.com stores exactly two things in your browser, and our website at perchplatform.com stores one more. All three are necessary for something you have asked for:
| What | Type | Purpose | Lifetime |
|---|---|---|---|
perch_refresh_token |
Cookie, set by our backend | Keeps you signed in. HttpOnly so page scripts cannot read it, Secure, SameSite=Lax, scoped to /api/v1/auth so it is only sent on login, token refresh and logout |
7 days |
onboarding-checklist-dismissed |
Local storage | Remembers that you hid the dashboard onboarding checklist. Contains no personal data | Until you clear it |
theme |
Local storage, on perchplatform.com only | Remembers whether you chose the light or dark theme on our website. Contains no personal data | Until you clear it |
Your access token is held in memory only and is never written to storage. We use no session storage, no IndexedDB and no other browser storage.
All three items above are necessary to provide a service you have asked for, so we do not ask for cookie consent. If you clear them, you will be signed out, the onboarding checklist will reappear and our website will follow your device's light or dark setting.
Your own Nextcloud instance and any WordPress site you run set their own cookies. Those are governed by that software and, for a WordPress site you operate, are your responsibility.
6. Who we share it with
| Recipient | Location | What they do |
|---|---|---|
| Hetzner Online GmbH | Germany and Finland | Hosts our servers: customer instances and their backups, our email relay, and the perchplatform.com website and mailboxes |
| Stripe Payments Europe, Limited | Ireland, with Stripe group companies elsewhere | Processes payments and holds billing records. PCI-DSS Level 1 certified |
| Our accountants and professional advisers | Ireland | Preparing accounts and tax returns |
| Public authorities | Ireland / EU | Where the law requires disclosure, or on a valid court order |
We will also disclose personal data where it is necessary to establish, exercise or defend a legal claim.
7. Where your data is held, and the one thing that leaves the EU
Your hosted content stays in the EU. Customer instances, the data in them and their backups are hosted in Germany and Finland and do not leave the European Union.
Your billing data does not. Stripe is a global payment processor. It does not offer EU-only data residency, and personal data given to it for payment processing — your name, email and payment details — may be transferred to Stripe group companies outside the EEA, including in the United States. Stripe relies on the European Commission's Standard Contractual Clauses and on its certification under the EU-US Data Privacy Framework for those transfers. Stripe's privacy policy is at https://stripe.com/ie/privacy.
We make no transfers outside the EEA other than through Stripe.
8. How we protect it
- All data in transit is encrypted using TLS.
- Backups are encrypted.
- Each customer's instance runs on its own virtual server, separate from every other customer's, with its own application, database and credentials.
- Administrative access is limited to authorised personnel on a need-to-know basis, using strong, unique credentials.
- Backups are taken daily and kept for 7 days.
No system is perfectly secure. If you believe you have found a vulnerability, please tell us at support@perchplatform.com — we will acknowledge your report and deal with it seriously.
If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will notify the Data Protection Commission within 72 hours of becoming aware of it, and will tell affected individuals where the law requires.
9. How long we keep it
| Data | Retention |
|---|---|
| Account data — name, email, hashed password | While your account is open, then 30 days after it closes |
| Content in your hosted instance | Kept as one final backup for 30 days after your subscription ends, so you can come back or export it, then deleted — see clause 10 of the Terms of Service |
| Invoices, payment records and accounting data | Six years from the end of the accounting period, as Irish tax and company law require |
| Support correspondence | Two years from your last contact, unless it relates to an unresolved dispute |
| Server and security logs | 30 days, unless retained longer for an active security investigation |
We do not keep account data indefinitely. Once the 30 days are up, your name, email and hosted content are permanently deleted, and what remains is the invoice and payment record we are legally obliged to keep.
10. Your rights
Under the GDPR you have the right to:
- access your data and get a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have data erased in certain circumstances (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interests (Art. 21); and
- withdraw consent where we rely on it, without affecting processing already carried out.
Email support@perchplatform.com to exercise any of these. We will respond within one month, as Article 12(3) requires. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify your identity first.
If your request concerns data held inside another customer's instance, we will pass it to that customer, who is the controller of it.
11. Children
Our services are not directed at children. Accounts may only be opened by people aged 18 or over, and we do not knowingly collect personal data from anyone under 16. If you believe we have, contact us at support@perchplatform.com and we will delete it.
12. Complaints
Please tell us first at support@perchplatform.com so we can try to put it right.
You also have the right to complain to the Irish supervisory authority:
Data Protection Commission 6 Pembroke Row, Dublin 2, D02 X963, Ireland www.dataprotection.ie
If you live in another EU member state, you may complain to your own national supervisory authority instead.
13. Changes to this policy
We will notify registered users by email of material changes. The version number and date at the top of this page show the most recent revision, and the current version is always at https://perchplatform.com/privacy.
Perch Platform Limited, registered in Ireland, company number 801020. Registered office: Middlequarter, Newcastle, Clonmel, Co. Tipperary, E91 CD71.