Privacy Policy

What we collect, why we collect it, and how we look after it.

Effective · Oct 22, 2026

Peerlify, Inc. ("Peerlify," "we," "us"), with its head office in Montréal, Québec, operates a private networking service. We designed the control plane to see as little of your traffic and your organization as possible. This Privacy Policy describes what personal information we collect, how we use it, and your rights over it. It applies to visitors to peerlify.com, users of the Peerlify service, and individuals whose personal information we receive from a Peerlify customer.

Because we are headquartered in Québec, we are subject to the Act respecting the protection of personal information in the private sector (Québec, as modernized by Law 25) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Where we serve users in the European Economic Area, the United Kingdom, Switzerland, or regions of the United States with comprehensive privacy laws, we also apply the standards set by those laws.

1. Overview

We do not see the contents of network traffic flowing between your devices. That traffic is encrypted end-to-end with Noise IK and per-direction AES-GCM keys; the private keys live only on the peers. When traffic transits a Peerlify-operated relay because a direct path is unavailable, the relay only ever sees ciphertext.

2. Our role: controller and processor

Peerlify acts in two roles depending on the data:

Controller — for personal information about visitors to our website, prospects, billing contacts of our customers, and our own marketing and support records.
Processor — for personal information that a Peerlify customer ("Controller") submits to or generates through the Service: device metadata, identity-provider assertions, audit logs, and policy configuration. We process that data under the customer's written instructions, as described in our Data Processing Addendum.

If you are an end user of a Peerlify-powered network and you have questions about how your personal information is handled by your organization, please contact your organization first; they decide what data is collected and for how long.

3. Data we collect

We collect the following categories of personal information:

Account and identity data: name, email address, identity-provider subject identifier, organization name, role, and authentication factors returned by your identity provider.
Device metadata: device name, public node key, operating system, client version, assigned private IPv4/IPv6 address, last-seen timestamp, and optional tags assigned by an administrator.
Connection metadata: transient signalling and routing data needed to establish a tunnel — public IP addresses observed by STUN, relay session identifiers, byte counters. We do not persist a per-flow record of which device talked to which device.
Administrative event logs: membership changes, role changes, ACL edits, device approvals, integration changes, with the actor, target, and timestamp. Stored for the audit-log retention window of the customer's plan.
Billing and commercial data: billing contact name and email, billing address, tax identifier, payment-card token and last four digits from our payment processor. We do not store full payment-card numbers.
Support and communications: content of emails, support tickets, and other communications you send us.
Website and product telemetry: page views, referrer, IP address (truncated for analytics), browser type, and anonymized feature-usage metrics. Crash reports may include stack traces but not packet content.
Advertising click identifiers: the Google Ads click identifier (gclid, gbraid or wbraid) or the OpenAI Ads click identifier (oppref) from the ad that brought you to our website, and the time of the click — only with your consent to advertising measurement.

4. Where we get data

We receive personal information from the following sources:

Directly from you — when you sign up, configure the Service, or contact us.
From your employer or organization — when they invite you to a Peerlify network.
From your identity provider — name, email, and group membership returned via OIDC.
From the Service itself — telemetry generated by your use.
From service providers — payment processor, email delivery provider, fraud-prevention services.

5. How we use data

We use personal information to:

Provide and operate the Service, including coordinating peer connections and authenticating Members.
Authorize actions against the role assigned to a Member by the Owner or Admin.
Maintain audit trails that owners, admins, and auditors need to operate safely.
Detect, prevent, and investigate abuse, fraud, and security incidents.
Bill customers and handle taxation, accounting, and dispute management.
Communicate service announcements, security notices, billing events, and (where you have opted in) marketing.
Improve the Service through aggregate, de-identified analytics.
Measure the effectiveness of our advertising (with consent): whether a visit from one of our Google Ads or OpenAI Ads led to a download, an account, a first connected device, or a first paid subscription.
Comply with legal obligations and enforce our agreements.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising: with your consent we report conversions from our own ads to Google Ads or OpenAI Ads, keyed only on the ad click identifier, and we never use them for remarketing, audience building, or personalised ads. We do not use customer data or audit logs to train machine-learning models outside the scope of operating the Service.

6. Legal bases (EEA / UK)

If the GDPR or UK GDPR applies, we rely on the following legal bases for processing personal information as a controller:

Contract — to provide the Service to you or to an organization with which you are affiliated, and to handle billing.
Legitimate interests — to operate, secure, and improve the Service; to communicate with customers about service matters; to prevent fraud and abuse; to develop our business. We balance these interests against your rights and freedoms.
Consent — for optional analytics cookies, advertising measurement (the Google Ads tag or the OpenAI Ads pixel on our website and, if you then create an account, the server-side reporting of that account's conversions to the platform whose ad brought you here), marketing emails to prospects, and any other processing where we ask for consent. You can withdraw consent at any time: change your cookie settings to stop collection in this browser, or email privacy@peerlify.com to stop reporting for an existing account.
Legal obligation — to comply with tax, accounting, anti-fraud, and other applicable laws.

Where we process personal information on behalf of a customer (processor role), our customer is the controller and determines the legal basis for processing.

We share personal information only:

With subprocessors that help us operate the Service (hosting, email delivery, payments, error monitoring). See subprocessors.
With Google LLC (Google Ads), only if you consented to advertising measurement: the ad click identifier, the event type and time, and for a first paid invoice its amount (before tax) and currency. Never your name, email address, or device data.
With OpenAI (OpenAI Ads), only if you consented to advertising measurement and arrived from an OpenAI ad: the ad click identifier, the event type and time, and for a first paid invoice its amount (before tax) and currency. Never your name, email address, or device data.
With other members of your own network, as needed for the Service to function — for example, a member may see which other devices belong to the network.
With your administrators — Owners, Admins, and Auditors of your network can see audit events and device information related to your account.
With professional advisors (lawyers, accountants, auditors) bound by confidentiality.
With acquirers in connection with a merger, acquisition, or asset sale, in which case the acquirer is bound by equivalent privacy commitments and we will notify affected customers.
When required by a legally valid request, where we will push back on overbroad demands, narrow the scope where possible, and notify affected customers unless prohibited by law.
In aggregated or de-identified form that cannot reasonably be linked back to you.

8. Subprocessors

A current list of our subprocessors — names, purposes, and locations — is published at peerlify.com/legal/subprocessors. We engage subprocessors under written contracts that impose data-protection obligations no less protective than our own. Customers can subscribe to a feed of subprocessor changes from that page.

9. Data retention

We retain personal information only for as long as needed for the purposes described in this policy and to meet legal, accounting, and reporting obligations. Indicative retention windows:

Account data — for the life of the account, plus 90 days after deletion.
Audit logs — according to your plan's retention window (see pricing); customers can export at any time.
Connection metadata — discarded shortly after a session ends; no per-flow record is persisted.
Billing records — 7 years for tax and accounting compliance.
Support communications — 2 years from the close of the ticket.
Website analytics — up to 14 months from collection.
Ad click identifiers — deleted within 97 days of the click.
Backups — age out of our infrastructure within 90 days.

When data has reached the end of its retention window, we delete it from active systems or anonymize it.

10. Security measures

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data we process. Highlights:

OIDC-based authentication; we do not store user passwords.
Server-side authorization enforced on every mutation; UI gates only hide controls.
Encryption in transit (TLS 1.2+); encryption at rest for production data stores.
Network traffic between peers end-to-end encrypted with Noise IK and AES-GCM; relays see ciphertext only.
Audit logging of administrative actions in our own production environment.
Production isolated from corporate; access is role-based and reviewed quarterly.
Vulnerability management, dependency scanning, and reproducible signed builds for client releases.

Full security context is on our Security page; additional detail is in Annex II of the DPA.

11. International transfers

Peerlify operates infrastructure in multiple regions, including Canada, the United States, and the European Union. When personal information originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country that has not received an adequacy decision, we rely on the Standard Contractual Clauses adopted by the European Commission (with the UK Addendum and the Swiss adaptations where relevant). Copies are available on request. Where you are a customer in Canada, your data may also be processed in the United States and the European Union; we apply equivalent safeguards.

12. Your rights

Depending on your jurisdiction, you may have the right to access, correct, port, delete, or restrict processing of your personal information; to object to processing based on our legitimate interests; to withdraw consent; and to lodge a complaint with a supervisory authority. Most of these actions are available directly in the product or through your administrator. For anything else, email privacy@peerlify.com and we will respond within 30 days (extendable by a further 60 days where the request is complex, with notice). We do not charge a fee unless the request is manifestly unfounded or excessive.

If you are an end user of a Peerlify-powered network and your request concerns data your organization controls, we will forward your request to that organization.

13. Québec and Canadian rights

If your personal information is governed by Québec's Law 25 or by PIPEDA, you have rights to:

Be informed of the collection, sources, purposes, categories of recipients, and retention period for your personal information.
Access the personal information we hold about you, and request its correction.
Withdraw consent at any time, subject to legal or contractual restrictions.
Request that we cease using or disseminating your personal information, or de-index a hyperlink that meets the conditions of Law 25.
Receive a copy of the personal information you provided to us in a structured, commonly used, technological format (data portability).
File a complaint with the Commission d'accès à l'information du Québec (CAI) or with the Office of the Privacy Commissioner of Canada.

Privacy Officer. Peerlify has designated a Privacy Officer who is responsible for our compliance with Law 25 and PIPEDA. Contact: privacy@peerlify.com (subject line: "Attn: Privacy Officer").

Transfers outside Québec. Before transferring personal information outside Québec, we conduct a Privacy Impact Assessment to confirm that the information receives equivalent protection. Where required, we put written agreements in place with the recipient that include obligations to use the information only for the agreed purposes, to maintain its confidentiality, and to apply appropriate security safeguards.

Confidentiality by default. The Service's privacy parameters provide the highest level of confidentiality by default and we collect personal information only to the extent necessary for the purposes described in this policy.

14. U.S. state privacy rights

If you are a resident of California, Colorado, Connecticut, Utah, Virginia, or another U.S. state with a comprehensive privacy law, you may have rights to know, access, correct, delete, opt out of sale or sharing for cross-context behavioral advertising, and limit the use of sensitive personal information. We do not sell personal information or share it for cross-context behavioral advertising; the consent-based conversion reporting to Google Ads and OpenAI Ads described in Section 7 is limited to measuring our own ads and is never used for remarketing or personalised ads. We do not use or disclose sensitive personal information for any purpose that triggers a right to limit under the California Consumer Privacy Act. To exercise other rights, email privacy@peerlify.com. We honor authorized-agent requests where accompanied by signed authorization. We will not discriminate against you for exercising your rights.

15. Automated decisions and profiling

We do not subject you to decisions based solely on automated processing that produce legal or similarly significant effects. We use automated systems to detect abuse and fraud; significant adverse actions (such as suspending an account) include human review.

16. Cookies and tracking

We use a small number of strictly necessary cookies to keep you signed in, plus optional analytics cookies and optional advertising measurement (Google Ads, OpenAI Ads) that you can decline without losing functionality. Details are in our Cookie Policy. The Peerlify client application itself does not use cookies to communicate with the control plane; it uses OIDC-issued tokens.

17. Marketing communications

We send service announcements, security notices, and billing-related emails to customers regardless of marketing preferences, because those communications are part of the Service. Marketing emails are only sent where you have opted in or where allowed by law on a soft-opt-in basis; every marketing email contains an unsubscribe link.

18. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

19. Do Not Track and Global Privacy Control

We honor the Global Privacy Control (GPC) signal as an opt-out of cross-context behavioral advertising and sale, where required by law. GPC also opts you out of advertising measurement: no ad click identifier is stored or sent. Because internet standards for Do Not Track signals are inconsistent, we do not separately respond to DNT headers.

20. Changes to this policy

We may update this Privacy Policy. Material changes will be announced in the Service or by email at least 15 days before they take effect. The "Updated" date at the top of this page tracks the current version. Prior versions are available on request.

21. Contact and complaints

Privacy questions or rights requests: privacy@peerlify.com. For urgent security concerns, use security@peerlify.com.

Controller of record: Peerlify, Inc., Montréal, Québec, Canada. Privacy Officer contact: privacy@peerlify.com (subject line: "Attn: Privacy Officer"). If you are not satisfied with our response, you may file a complaint with:

Québec — Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
Canada (federal) — Office of the Privacy Commissioner of Canada (priv.gc.ca).
EEA — your local data protection authority.
United Kingdom — the Information Commissioner's Office (ico.org.uk).

EU/UK representative information is available on request once required (we are not currently established in the EU/UK; an Article 27 representative is appointed when the threshold is met).