[ PRIVACY ]

Privacy Policy

Last updated: 29 October 2026. Peeko is in closed beta. This policy explains what personal data we process when you visit the website, join the waitlist or use the app, why we process it, how long we keep it and what rights you have.

1. Who we are

Peeko is operated by Mantas Kabelis, a sole trader (individuali veikla) based in Lithuania, who is the data controller for the personal data described here. Contact: hello@example.com.

2. What we collect about you

• Waitlist. Your email address and, if you choose to give them, your name, company, role and a note. We also process a keyed hash of your IP address to limit abuse. We never store the raw IP address for this purpose, and the hash is deleted after about one hour.
• Account. When you log in with Google or with an email link, we receive your email address, your name if Google provides it, an account identifier and login timestamps. We store your access status (pending, approved or blocked) and your role.
• Your workspace. We store the boards you create, saved post references and notes, and feature-interest votes and any optional feedback you submit.
• Usage and technical data. Our hosting and database providers keep standard server logs (for example IP address, browser type, time of request and errors) for security and troubleshooting. Our PostHog integration sends page visits, masked interactions, selected product-action events and Web Vitals performance measurements to PostHog's EU ingestion endpoint. Events can include browser and device type, viewport dimensions, timestamps and a general page route. We remove URL query strings and fragments, replace post and board identifiers in routes, and do not send search text, captions, form contents, board names, account identifiers, email addresses or user names as analytics properties.
• Cookieless analytics. PostHog is configured for cookieless measurement with person profiles disabled. We do not call identification or alias functions, record sessions or enable heatmaps. PostHog describes its cookieless audience measurement as using a server-side hash based on technical request information, including IP address, user agent and site hostname, with a daily salt. The SDK sends the browser user-agent string and site hostname for that hash; PostHog strips raw user-agent and IP properties during cookieless ingestion before storage. This does not mean that no personal data is processed. The EU project's cookieless setting was verified as enabled on 29 October 2026.
• Error monitoring. Where a Sentry DSN is configured, Peeko sends error events and samples 10% of performance traces to Sentry to diagnose failures. Our integration removes user fields, request bodies, headers, cookies, URL parameters, free-form error messages, breadcrumbs and trace attributes before sending. Compiled stack locations, timestamps and coarse operation timings remain. Session Replay, additional log forwarding and source-map uploads are disabled. Sentry still receives network information needed to accept a connection; these measures do not mean that no personal data is processed. Without a DSN the integration is disabled. Our Sentry organization uses the European Union (EU) data storage region. Project-side IP address removal is enabled, and city, subdivision, region, country_code and ip_address are included in its additional sensitive fields for new events. These settings do not retroactively remove data from older events.
• Cookies and browser storage. Authentication uses cookies to keep you logged in. The app also uses browser storage for preferences such as recent comparisons and boards. The PostHog integration does not persist analytics cookies or analytics entries in localStorage or sessionStorage. Embedded social-platform content can contact the relevant platform and is subject to that platform's privacy practices. We do not describe the entire website or third-party embeds as cookie-free.

We do not collect payment data during the beta.

3. Public brand content shown in the app

Peeko analyses public brand accounts and posts on TikTok, Instagram and Facebook. Stored data includes account handles and platform identifiers, names, profile pictures, biographies or intros, categories, verification flags, follower and following counts and their history where available. Post data includes links, captions, language, publishing time, format and duration, cover images, hashtags, music information, promotion and partnership labels, collaboration handles and engagement metrics with capture history. Videos are shown through platform embeds; we download covers and avatars, not the video files.

Featured accounts and source responses. The Featured accounts label uses public usernames from tags or mentions; a mention alone is not treated as a confirmed collaboration. We also retain the original collection response for a post. Those source responses can contain additional public profile details, names, avatars, tags and public comment text or author metadata supplied with the brand post. The stored data is therefore not limited to usernames. We do not use this feature to read private messages.

Some brand posts may show people, for example employees, creators or customers. If you appear in such content and want it removed from Peeko, contact hello@example.com and we will remove it from the app. Removal from the original platform is handled by the brand and the platform.

Separate caption-classification pilot. On 28 October 2026, we attempted a manually run pilot through Vercel AI Gateway using TypeSafe AI's Jev model. One deidentified public brand caption was sent to the Gateway with classification instructions; the request returned an access error and no classifications were produced. Delivery to the model provider was not confirmed. Contact details, links, mentions and obvious names were removed before transmission. Account data, metrics and source-post links were not included in the model request. The selected inputs and attempt record are kept separately for review. This pilot is not an ongoing product feature or an automatic ingestion step. We do not claim EU-only processing for AI Gateway or TypeSafe AI.

Optional Reports AI insights. When an approved user explicitly requests AI insights, the configured Preview feature sends public brand performance facts and a bounded selection of public post IDs, source links, dates, labels and caption excerpts to Vercel AI Gateway using Google Gemini. The report sends no Peeko login identity, private boards, cookies or raw collection responses. Public captions can contain names or other personal data. The model selects references to server-verified facts and permitted interpretations; it does not analyse video frames or audio. Invalid output leaves the deterministic report intact. Identical inputs may reuse a cached result. We do not claim EU-only processing or a verified fixed provider retention period for this feature.

4. Why we use your data and our legal basis

• To run the waitlist and give you access to the beta: steps taken at your request before entering into an agreement and our legitimate interest in managing a closed beta (GDPR Article 6(1)(b) and (f)).
• To provide the service to logged in users: performance of our agreement with you (Article 6(1)(b)).
• To keep the service secure, prevent abuse and fix errors: our legitimate interest (Article 6(1)(f)).
• To analyse public brand content for market and competitor insights: our legitimate interest and the legitimate interest of our users in understanding their market (Article 6(1)(f)).
• To contact you about your access and important changes to the service: our legitimate interest. We will not send marketing newsletters without your consent, and you can opt out at any time.

5. Who we share data with

We do not sell personal data. We use the following service providers, who process data on our behalf under data processing terms:

• Supabase: database, login and file storage.
• Vercel: website hosting, the optional Reports AI feature and the separate AI Gateway caption-pilot attempt described above. TypeSafe AI was the intended model provider; receipt by that provider was not confirmed.
• PostHog: cookieless usage and performance measurement through its EU endpoint, with the data minimisation described above.
• Sentry: error diagnostics and sampled performance monitoring where configured, subject to the minimisation described above. Our organization's data storage region is the European Union (EU), verified in its settings on 29 October 2026.
• Google: login with Google, only if you choose it, and Gemini model processing through AI Gateway when optional Reports AI insights are requested.
• Apify: collection of public brand content. It does not receive data about our users.
• GitHub: code hosting and scheduled data updates. It does not receive data about our users.

Some providers may process data outside the European Economic Area. Where this happens, transfers are protected by appropriate safeguards such as the European Commission Standard Contractual Clauses or an adequacy decision.

6. How long we keep data

• Waitlist entries: until the beta ends, or at most 12 months after our last contact with you, unless you become a user.
• Accounts: while your account is active. If you ask us to delete your account, we delete it within 30 days.
• Abuse protection hashes: about one hour.
• Server logs: according to our providers' standard retention periods.
• Sentry diagnostics: on 29 October 2026 our account was on a Business trial ending 10 November 2026. Sentry documents 90-day error retention for Business, and span retention of 30 days at full fidelity with a sampled subset retained for up to 13 months. These are the current plan rules, not a promise that every trace is retained. If the account returns to Developer after the trial, the documented error and span retention is 30 days, without the extended sampled tier. We will review this notice when the plan changes.
• Analytics and pilot records: retention depends on the applicable service settings and our review needs. We have not specified a verified fixed retention period for these records; contact us for the current settings or a deletion request.

7. Your rights

You have the right to access your personal data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. To use any of these rights, contact hello@example.com. We will reply within one month.

You can also lodge a complaint with the Lithuanian supervisory authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or with the authority in your country of residence.

8. Children

Peeko is a professional tool and is not intended for anyone under 16. We do not knowingly collect data from children.

9. Changes

We may update this policy as the product develops. We will change the date at the top and, for important changes, notify registered users by email.

10. Contact

Questions about privacy or this policy: hello@example.com.