Privacy Policy
Last updated and effective as of 19 June 2026 (version 2026-06-19-en). Deutsche Fassung
This Privacy Policy describes how Perdure, a service operated by Brox AI, Inc. (“Brox”, “Perdure”, “we”, “us” or “our”), processes personal information collected through our website at https://perdure.ai, our application at https://app.perdure.ai, and your participation in our paid research panel (together, the “Service”). Brox AI, Inc. is the controller of your personal data. For provider identification under German law, see our Imprint (Impressum).
The short version, in plain language:
- Your conversations build a digital twin, a model of how you think.
- Research clients only ever see anonymised, aggregated insights. Never your name, voice, face, or anything that identifies you.
- We never sell your identity, and we never share what you tell us for marketing, advertising, or targeting purposes.
- Data from your account, profile or conversations that identifies you never leaves Perdure and Brox AI; anyone outside only ever sees the anonymised version. (Website analytics and our optional ad-measurement pixel are separate, smaller things, explained in Section 11.)
- You can read everything we hold about you, correct it, and delete your twin (all of it) whenever you want.
The rest of this policy is the long version.
1. Information we collect
You provide: your name, email address, date of birth (to confirm you are 18 or over), country and location details (to confirm you are in a supported country), profile and demographic information used to match you to studies, your reward email address (where we send your payout redemption link; you choose your payout method at redemption with our payments provider), identity or location verification information where we ask for it (including a short "hello video" — see Section 5b), and the content of your research conversations: voice recordings, transcripts, and any text responses.
We generate: AI-derived profiles built from your conversations (your digital twin), including inferred attributes such as personality dimensions, values, decision style, and opinions.
We collect automatically: usage data (pages visited, features used), device information, your IP address, and approximate location (country/region) derived from it. We use your IP address and the location derived from it to prevent fraud, for example to confirm you are in a supported country and to detect VPN/proxy use or multiple accounts created by the same person. Our website analytics (Plausible) are cookieless and do not track you across sites.
2. How we use your information
- To run the Service: schedule conversations, build and maintain your digital twin, and pay you.
- To match you to paid studies based on who we believe you to be (for example, a study may be limited to a specific age group or location), and to verify that your profile is accurate. Inaccurate profiles are not eligible for payment.
- To produce research: anonymised, aggregated insights for clients, derived from many twins at once.
- To give insights back to you: your personal profile of how you think and the ability to query your own twin.
- To improve the Service, prevent fraud, and meet legal obligations (e.g. tax reporting on payouts).
3. Legal basis for processing (GDPR/UK GDPR)
Where these laws apply, we process your data on the legal basis set out per purpose below:
| Purpose | Legal basis | Notes |
|---|---|---|
| Running the panel, scheduling, building/maintaining your twin, and paying you | Contract (Art. 6(1)(b)) | Necessary to perform your participation agreement. |
| Recording your voice/video and building your twin from the conversation content | Consent (Art. 6(1)(a)) | Given explicitly at signup; withdrawable at any time for the future. Where you reveal special-category data in free conversation, that processing relies on your explicit consent (Art. 9(2)(a)). |
| Sharing anonymised, aggregated insights within the Perdure/Brox controller relationship | Consent (Art. 6(1)(a)) | The "Paid Chat" consent. Clients only ever receive the anonymised version (see Section 4). |
| Security, fraud prevention, IP/geo checks, and service improvement | Legitimate interests (Art. 6(1)(f)) | A balancing test (LIA) is on file; for EU members the external IP-reputation lookups are disabled. |
| Hello-video liveness check | Consent (Art. 6(1)(a)) | Human-reviewed liveness only; no automated biometric matching (see Section 5b). |
| Tax and accounting records on payouts | Legal obligation (Art. 6(1)(c)) | Statutory retention duties. |
4. What we share, and with whom
- Research clients receive anonymised, aggregated insights only. Results are reported across groups, never individuals. They never receive your name, contact details, raw recordings, or anything reasonably capable of identifying you.
- Brox AI, our parent company, provides infrastructure and research technology to Perdure and processes data under the same protections described in this policy.
- Service providers (sub-processors) process data on our behalf under contract (Art. 28 GDPR where applicable), across these categories: cloud hosting and database, AI voice and text processing, email delivery, payout processing, push notifications, fraud/IP checks, and content delivery (CDN). Our public sub-processor list names each provider, what it does, and the data it processes; a copy is also available on request at privacy@perdure.ai.
- Legal and safety: we may disclose information where required by law or to protect the rights, safety, or property of you, us, or others.
We do not sell your personal information, and we never share your account, profile or conversation data with anyone for marketing, advertising, or targeting purposes of any kind. Data from your account, profile or conversations that identifies you never leaves Perdure and Brox AI: research clients and every other third party only ever receive anonymised, aggregated insights, and our contracted service providers process data solely on our behalf and under our instructions, never for their own purposes. Separately, our website can run an optional Meta ad-measurement pixel that concerns website visits only; it is described in Section 11 and never involves your account, profile or conversation data.
5. Your digital twin and automated processing
Your twin is a behavioural model derived from your conversations. This constitutes profiling under Article 4(4) of the GDPR. Important points:
- Your twin's contents are visible to you in the app.
- Your twin is never shared in identifiable form with any research client.
- Insights your twin gives you about yourself are private to you.
- You can correct information your twin has wrong, and delete your twin entirely at any time from your account settings or by emailing privacy@perdure.ai.
- No decision producing legal or similarly significant effects about you is made solely by automated means within the meaning of Article 22 of the GDPR. Study-eligibility matching is human-reviewed, and you can object to it and have your information corrected.
5b. Hello video and liveness
Before you start your first paid activity, we ask you once for a short "hello video" (around 30 seconds). This video is used solely for a human-reviewed liveness check (confirming a real, live person is taking part) and to sense-check what you've told us about your age and location.
- We do not perform any automated voice- or face-matching and no biometric recognition. The video is therefore not processed for the purpose of uniquely identifying a person within the meaning of Article 9 of the GDPR.
- The legal basis is your consent (Art. 6(1)(a)), which you give before recording. We give you a separate notice of the purpose and processing at the point of collection (Art. 13).
- You can decline to record; if you do, we cannot release paid activities or payouts.
6. Data retention
| Data | Retained |
|---|---|
| Application data (if you never join) | 12 months |
| Account data | While your account is active, plus 12 months |
| Conversation recordings and transcripts | While your account is active, plus 6 months, or deleted on withdrawal |
| Digital twin | While your account is active, plus 6 months, or deleted on withdrawal |
| Anonymised, aggregated research insights | Indefinitely (these cannot be linked back to you) |
| Payment and tax records | 7 years (legal requirement) |
7. International data transfers
We are US-based. If you are in the EEA or UK, transfers of your data to the US are protected by recognised safeguards (EU-US Data Privacy Framework, Standard Contractual Clauses, or the UK IDTA, as applicable).
8. Security
We use industry-standard encryption in transit and at rest, role-based access controls, and regular security reviews. No system is perfectly secure, but we treat your conversations with the care you'd expect for something this personal.
9. Your rights
Depending on where you live, you may have the right to: access your data, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent, and complain to your data protection authority. To exercise any of these, email privacy@perdure.ai and we respond within 30 days. You can also exercise many of these directly in your account settings (download your data, delete your twin, withdraw consent).
EEA/UK members. Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21). Where processing relies on your consent, you can withdraw it at any time with effect for the future (Art. 7(3)); this does not affect the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with a supervisory authority (Art. 77), in particular in your country of residence or work.
EU representative (Art. 27 GDPR): the appointment of an EU representative is in progress; this section will be updated once the appointment is made. Until then, please contact privacy@perdure.ai directly.
10. California residents
We do not sell your personal information. The Meta ad-measurement pixel on our website (Section 11) may constitute "sharing" for cross-context behavioural advertising as defined by the CCPA/CPRA; you can opt out at any time via the Privacy choices link in the website footer, and for US visitors we enable Meta's Limited Data Use mode. We do not sell or share any other personal information, and your account, profile and conversation data are never sold or shared for any advertising purpose. Compensation for research participation constitutes a financial incentive under California law; its value corresponds to the per-conversation rates shown in the app, and you may withdraw from the programme at any time by closing your account.
11. Cookies and tracking
Our website uses Plausible analytics: it sets no cookies and does no cross-site tracking, providing only privacy-preserving, aggregate analytics (Plausible is EU-hosted). It runs on every visit because it stores nothing on your device and identifies nobody. The app uses strictly necessary cookies for login sessions.
Meta pixel (ad measurement, your choice): our website can load a Meta (Facebook) pixel whose only job is to measure whether the ads we run to recruit new members actually work, and to help Meta show those ads to people more likely to be interested. When it runs, it sets Meta cookies (_fbp, and _fbc after an ad click) and shares your visit with Meta Platforms: the pages you view on perdure.ai, your IP address and browser information, which Meta may be able to link to your Facebook or Instagram account if you have one. Outside the United States the pixel is off until you allow it in the banner shown on your first visit (legal basis: consent, Art. 6(1)(a) GDPR where the GDPR applies); if you decline, nothing from Meta loads. In the United States it runs by default with Meta's Limited Data Use mode enabled, and you can switch it off at any time. Change your mind whenever you like via Privacy choices in the footer: we stop the pixel and expire its cookies. Your consent choice itself is stored locally in your browser. The pixel concerns website visits only; it never touches your account, profile or conversations. Meta's own processing is described in Meta's Privacy Policy.
Ad-click conversion confirmation: if you reach us from an ad and go on to sign up, we also confirm to the advertising platform (for example Meta), server-to-server, that one signup happened, using only the click identifier the platform itself attached to the ad link. We never send your name, email address, profile, conversations or anything else that identifies you, and nothing is stored on your device for this. It works whether or not you allow the pixel.
12. Children
The Service is for adults 18 and over. We do not knowingly collect information from anyone under 18; if we discover we have, we delete it.
13. Changes to this policy
When we change this policy we will update the date at the top, and for material changes we will notify members by email at least 30 days before the change takes effect.
14. Contact
Privacy questions and data requests: privacy@perdure.ai Everything else: hello@perdure.ai Postal: Brox AI, Inc., 1734 Granville Avenue, Unit 2, Los Angeles, California 90025