UK Privacy Notice
Last updated 23 July 2026.
This notice explains how Perdure, a service operated by Brox AI, Inc. ("Brox", "Perdure", "we", "us"), handles the personal data of members in the United Kingdom under the UK GDPR and the Data Protection Act 2018. It supplements our global Privacy Policy; where the two differ for UK members, this notice prevails.
The short version, in plain language:
- Your conversations build a digital twin, a model of how you think.
- Research clients only ever see anonymised, aggregated insights. Never your name, voice, face, or anything that identifies you.
- We never sell your identity, and we never share what you tell us for marketing, advertising, or targeting purposes.
- Data from your account, profile or conversations that identifies you never leaves Perdure and Brox AI; anyone outside only ever sees the anonymised version. (Website analytics and our optional ad-measurement pixel are separate, smaller things, explained in Section 11.)
- You can read everything we hold about you, correct it, and delete your twin (all of it) whenever you want.
1. Who we are (controller)
Brox AI, Inc., 1734 Granville Avenue, Unit 2, Los Angeles, California 90025, USA (a Delaware corporation) is the controller of your personal data. Data-protection contact: privacy@perdure.ai. We are in the process of appointing a UK representative under Article 27 UK GDPR; until that appointment is in place, please contact us directly at privacy@perdure.ai.
Perdure is open to people aged 18 or over in the United States, United Kingdom, Germany, Turkey, and Japan.
2. Personal data we collect
You provide: your name, email address, date of birth (to confirm you are 18 or over), country and location details (to confirm you are in a supported country), profile and demographic information used to match you to studies, your reward email address for payouts, identity or location verification information where we ask for it (including a short "hello video", see Section 5), and the content of your research conversations: voice recordings, transcripts, and text responses.
We generate: AI-derived profiles built from your conversations (your digital twin), including inferred attributes such as personality dimensions, values, decision style, and opinions.
We collect automatically: usage data, device information, your IP address, and the approximate location (country/region) derived from it, which we use to prevent fraud (for example to confirm you are in a supported country and to detect VPN/proxy use or duplicate accounts). Our website analytics (Plausible) are cookieless and do not track you across sites.
3. What we use it for, and our lawful basis
| Purpose | Lawful basis (Art. 6 UK GDPR) |
|---|---|
| Running the panel, scheduling conversations, building and maintaining your twin, and paying you | Contract (Art. 6(1)(b)) |
| Recording your voice/video and building your twin from conversation content | Consent (Art. 6(1)(a)); where you reveal special-category data in free conversation, explicit consent (Art. 9(2)(a)) |
| Sharing anonymised, aggregated insights within the Perdure/Brox relationship (the "Paid Chat" consent) | Consent (Art. 6(1)(a)) |
| Security, fraud prevention, IP/geo checks, and service improvement | Legitimate interests (Art. 6(1)(f)); a balancing test is on file |
| Hello-video liveness check (human-reviewed only, no biometric matching) | Consent (Art. 6(1)(a)) |
| Tax and accounting records on payouts | Legal obligation (Art. 6(1)(c)) |
Invitations to paid studies are matched to the profile you give us (age group, location, interests and so on), and we verify that your profile is accurate; inaccurate profiles are not eligible for payment.
4. Who we share it with
- Research clients receive anonymised, aggregated insights only, reported across groups, never individuals. They never receive your name, contact details, raw recordings, or anything reasonably capable of identifying you.
- Brox AI, which operates Perdure, provides infrastructure and research technology and processes data under the protections in this notice.
- Service providers (sub-processors) process data on our behalf under contract, across these categories: cloud hosting and database, AI voice and text processing, email delivery, payout processing, push notifications, fraud/IP checks, and content delivery. Our public sub-processor list names each provider; a copy is also available from privacy@perdure.ai.
- Legal and safety: we may disclose information where required by law or to protect the rights, safety, or property of you, us, or others.
We do not sell your personal data, and we never share your account, profile or conversation data with anyone for marketing, advertising, or targeting purposes of any kind. Data from your account, profile or conversations that identifies you never leaves Perdure and Brox AI: research clients and every other third party only ever receive anonymised, aggregated insights, and our contracted service providers process data solely on our behalf and under our instructions, never for their own purposes. Separately, our website can run an optional, consent-based Meta ad-measurement pixel that concerns website visits only; it is described in Section 11 and never involves your account, profile or conversation data.
5. Your digital twin, hello video, and automated processing
Your digital twin is a model of how you think, decide and behave, grounded in behavioural science and decision science (Big Five and similar frameworks). This constitutes profiling under the UK GDPR. Its contents are visible to you in the app, it is never shared in identifiable form with any research client, and the insights it gives you are private to you. You can correct anything it has wrong and delete it entirely at any time, in your account settings or via privacy@perdure.ai. No decision producing legal or similarly significant effects about you is made solely by automated means (Article 22 UK GDPR): study-eligibility matching is human-reviewed, and you can object to it.
Before your first paid activity we ask once for a short "hello video" (around 30 seconds), used solely for a human-reviewed liveness check and to sense-check your stated age and location. We do not perform automated voice- or face-matching and no biometric recognition. The lawful basis is your consent; you can decline, in which case we cannot release paid activities or payouts.
6. International transfers
We are US-based. Transfers of your data from the UK to the US are protected by recognised safeguards: the UK Extension to the EU-US Data Privacy Framework (where the recipient is certified), the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as applicable. A copy of the relevant safeguards is available from privacy@perdure.ai.
7. How long we keep it
| Data | Retained |
|---|---|
| Application data (if you never join) | 12 months |
| Account data | While your account is active, plus 12 months |
| Conversation recordings and transcripts | While your account is active, plus 6 months, or deleted on withdrawal |
| Digital twin | While your account is active, plus 6 months, or deleted on withdrawal |
| Anonymised, aggregated research insights | Indefinitely (these cannot be linked back to you) |
| Payment and tax records | 7 years (legal requirement) |
8. Security
We use industry-standard encryption in transit and at rest, role-based access controls, and regular security reviews. No system is perfectly secure, but we treat your conversations with the care you'd expect for something this personal.
9. Disclaimers
Insights your digital twin provides about you are for personal reflection only. They are not medical, psychological, financial, or legal advice, and are not a diagnosis of anything. If you are struggling, please talk to a qualified professional.
10. Your rights
Under the UK GDPR you have the rights of access, rectification, erasure, restriction, data portability, and objection (including to processing based on legitimate interests), and where processing relies on your consent you can withdraw it at any time with effect for the future. To exercise any of these, email privacy@perdure.ai; we respond within one month. You can also exercise many of them directly in your account settings (download your data, delete your twin, withdraw consent).
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to resolve your concern first, but you can go to the ICO at any time.
11. Cookies and tracking
Our website analytics run on Plausible, which sets no cookies and does no cross-site tracking; it runs on every visit because it stores nothing on your device and identifies nobody. Your language choice is stored in your browser's local storage (no identifier, nothing sent anywhere). The app uses strictly necessary cookies for login sessions.
Meta pixel (ad measurement, your choice): our website can load a Meta (Facebook) pixel whose only job is to measure whether the ads we run to recruit new members actually work, and to help Meta show those ads to people more likely to be interested. When it runs, it sets Meta cookies (_fbp, and _fbc after an ad click) and shares your visit with Meta: the pages you view on perdure.ai, your IP address and browser information, which Meta may be able to link to your Facebook or Instagram account if you have one. For UK visitors the pixel is off until you allow it in the banner shown on your first visit (consent, regulation 6 PECR and Article 6(1)(a) UK GDPR); if you decline, nothing from Meta loads. Change your mind whenever you like via Privacy choices in the footer: we stop the pixel and expire its cookies. Your consent choice itself is stored locally in your browser. The pixel concerns website visits only; it never touches your account, profile or conversations. Meta's own processing is described in Meta's Privacy Policy.
Ad-click conversion confirmation: if you reach us from an ad and go on to sign up, we also confirm to the advertising platform (for example Meta), server-to-server, that one signup happened, using only the click identifier the platform itself attached to the ad link. We never send your name, email address, profile, conversations or anything else that identifies you, and nothing is stored on your device for this. It works whether or not you allow the pixel.
12. Children
Perdure is for adults 18 and over. We do not knowingly collect data from anyone under 18; if we discover we have, we delete it.
13. Changes to this notice
When we change this notice we will update the date at the top, and for material changes we will notify members by email at least 30 days before the change takes effect.
14. Contact
Privacy questions and data requests: privacy@perdure.ai Everything else: hello@perdure.ai Postal: Brox AI, Inc., 1734 Granville Avenue, Unit 2, Los Angeles, California 90025, USA