Privacy Policy

This policy explains what information Perk (“Perk,” “we,” “us”) collects when you use tryperk.app and the Perk app for Square (together, the “Service”), how we use it, and the choices you have. Perk is built for Square sellers (“Merchants”) who run Square Loyalty programs.

Information we collect

Account information. When you sign up we collect your name, email address, and profile image, plus the name of the organization you create and the teammates you invite. Sign-in is handled by our authentication provider, Clerk; we never see your password.

Google account data. If you choose “Sign in with Google,” you authorize Perk to receive basic profile information from your Google account using the openid, email, and profile scopes. See Google user data below for exactly what we receive and how we use it.

Square account data. When you connect Square, you authorize Perk to access your account with these permissions: merchant profile (read), loyalty (read and write), and customers (read). Accounts connected before October 22, 2026 also granted orders (read), which Perk no longer uses. With that access we store:

• Your Square merchant ID, business name, and loyalty program ID.
• OAuth access and refresh tokens, encrypted at rest with AES-256 and only decrypted in memory when we call Square on your behalf.
• For each new loyalty member we welcome: their Square loyalty account ID, customer ID, the points awarded, and when. We may display the member’s name from Square in your activity feed.
• For return visits by welcomed members (purchases where they earn loyalty points): the Square loyalty account ID, loyalty event ID, order ID, location ID, and time, used to measure how well your welcome bonus brings people back.

We do not collect or store payment card details from Square, and we do not request access to your payments, payouts, or bank information.

Billing information. Paid plans are billed through Clerk and its payment processor. They handle your payment details; we receive only your plan and subscription status.

Messages you send us. If you use our contact form, we collect your name, email address, and message so we can reply.

Usage data. We use Vercel Web Analytics and Speed Insights to understand page views and site performance. These tools do not use cookies and do not track you across other websites. Our hosting provider also keeps standard server logs (such as IP address, browser type, and request time) for security and debugging.

How we use information

• To run the Service: award welcome points, show your dashboard, and report results.
• To send product emails, such as a welcome email and milestone notifications.
• To provide support and respond to your messages.
• To keep the Service secure, prevent abuse, and fix problems.
• To comply with legal obligations.

We do not sell personal information, use it for third-party advertising, or use Square data for any purpose other than providing the Service to the Merchant who connected it.

Google user data

Perk uses Google only to let you sign in. We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google service.

What we access. When you sign in with Google, we receive your Google account’s email address, whether that email is verified, your name, your profile picture URL, and your unique Google account ID.

How we use it. We use this information only to create and sign in to your Perk account, show your name and picture in the app and to your teammates, and send you account and product emails at that address. We do not use Google user data for advertising, to build user profiles for others, to train AI or machine learning models, or for any purpose unrelated to providing the Service.

How we store and protect it. Your Google profile information is stored by our authentication provider, Clerk. Our own database keeps only your name and profile picture URL, attached to actions you take in your organization’s activity log. Data is encrypted in transit and at rest. We never receive your Google password, and we do not store Google access tokens.

Who we share it with. We do not sell Google user data or share it with third parties, except with Clerk (which processes sign-in on our behalf), with the teammates in your organization (who can see your name, email, and picture), or where required by law. Humans at Perk do not read your Google user data except with your consent, for security purposes, or to comply with the law.

Retention and deletion. We keep your Google profile information for as long as you have a Perk account. When you delete your account, Clerk deletes your profile, and activity-log entries are deleted along with your organization. You can also revoke Perk’s access at any time from your Google Account permissions page, or contact us to request deletion.

Perk’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Information about loyalty members

When a Merchant connects Square, Perk processes limited information about that Merchant’s loyalty members on the Merchant’s behalf. For that data, the Merchant decides how it is used and we act as their service provider. Perk never contacts loyalty members directly. If you are a member and have questions about your data, please contact the business where you joined their loyalty program.

Who we share information with

We share information only with service providers that help us run Perk, including:

• Square, to read and update your loyalty program.
• Clerk, for authentication (including Google sign-in), organizations, and billing.
• Vercel, for hosting, analytics, and bot protection.
• Our database provider, for managed Postgres hosting.
• Resend, for sending email.

We may also disclose information if required by law, to protect the rights and safety of Perk or others, or as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply.

Retention and deletion

When you disconnect Square, we revoke Perk’s access with Square and delete your stored tokens immediately. We keep your welcome-offer settings and history so they are restored if you reconnect. When you delete your organization, we delete all of its data, including offer settings, member credit history, and the activity log. You can also contact us to request deletion at any time. We may keep limited records where the law requires it.

Security

We use industry-standard safeguards, including encryption in transit (HTTPS), encryption of Square credentials at rest, and access restricted to the people who need it. No system is perfectly secure, but we work hard to protect your information.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, or to object to certain processing. To make a request, contact us. We will not discriminate against you for exercising these rights.

Children

Perk is a business tool and is not directed to children under 16. We do not knowingly collect their personal information.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the date above and, where appropriate, notify you by email or in the app.

Contact

Questions about this policy? Get in touch.