Who is responsible
NEIGHBORHOODCONNECT LTD, trading as Perim, is responsible for the personal information it uses to operate Perim. Company number 17051993; registered office 128 City Road, London EC1V 2NX. Contact jibril@perim.money with privacy questions or requests.
This notice covers our website, waitlist and iPhone private test. Your bank, Plaid, Apple and Google also provide their own services and privacy information.
Information we use
- Sign-in information: account identifier, verified email, and name or profile information supplied by your chosen Google or Apple sign-in provider. Firebase manages Google and Apple authentication and any existing authenticator-code (TOTP) enrolment.
- Passkey and verification information: Perim stores your passkey’s public key, credential identifier, account link and security metadata, including creation and last-use times and backup status. Your passkey’s private key remains with your device or password manager; Perim does not receive it. For financial access, our servers store a hash of a verification-session token, linked to your account, sign-in session and passkey. The app keeps the token in secure, device-only storage.
- Connected accounts: the institution and account identifiers, account name and type, currency, connection status and available account information returned through Plaid. Transaction records can include amounts, dates, descriptions, merchants, categories, currencies and pending or posted status.
- Your budgets: limits, categories or merchants, calendar-month commitments, reset dates, currency and protection status.
- Device information: app version, operating system, device registration and notification token, refresh status and technical events needed to operate and secure the service. Apple Screen Time selections are stored on your device as opaque tokens so it can apply your chosen app and website blocks.
- Messages and waitlist details: your email address, any optional name you provide, and information you choose to include when contacting us.
- Optional product updates: if you register interest in Perim Ultra, we save that preference, the time and consent wording version against your account. We use your account email for the Ultra updates you request; we do not copy your bank information into the interest list.
Perim does not receive your bank password or Screen Time passcode. Bank-access credentials issued by Plaid are held on the backend; they are not bundled in the app. We do not use transaction descriptions to infer health, political beliefs or other sensitive characteristics for advertising.
Purposes and lawful bases
We use your sign-in details, connected account information, budgets and necessary device information to provide the Perim service you request, under our contract with you. This includes measuring spending, maintaining monthly commitments and applying selected blocks. You authorise the bank connection in the Plaid and bank flow; you can withdraw that access by disconnecting.
We use limited technical and support information to protect the service, investigate faults, prevent misuse and answer requests. Our basis is our legitimate interest in running a secure and reliable service. You may object to this processing. Where a specific law requires us to retain or disclose information, our basis is that legal obligation.
Joining the waitlist gives consent to receive Perim access updates. You can withdraw it by emailing us. We do not sell your personal information or use your bank data for advertising.
Plaid and other providers
Plaid connects Perim to the accounts you select and supplies account and transaction information. Plaid also processes information as a separate controller under its End User Privacy Policy. Review the notices shown when connecting. Perim does not control all records kept by Plaid or your bank.
Google Cloud and Firebase provide backend hosting, database, authentication and operational logging. Apple and Google provide sign-in; Apple and Expo support app delivery and device notifications. The website uses Vercel hosting and a Neon database for the waitlist. Google Fonts receives normal network information when your browser requests our website fonts. These providers receive only the information needed for the functions we use. We may disclose information where required by law or to establish, exercise or defend a legal claim.
Storage and international processing
Perim’s application database and server functions are configured in London. Some provider services, authentication, delivery infrastructure and support operations can process information outside the UK or EEA. Provider terms describe applicable transfer mechanisms, which may include adequacy decisions and contractual safeguards. Contact us for information about a particular provider or transfer; a London database does not mean all processing stays in the UK.
Retention
- Finalised transaction history and historical budget snapshots are retained for the current calendar month plus the previous 12 months. Current commitments, pending records and data needed to finish an active reconciliation are retained until that work can be completed safely.
- Active account and connection details remain while needed to provide the service. Disconnecting revokes future bank access; full account deletion also removes previously collected account data.
- Ultra interest is optional and based on your consent. You can withdraw in the app’s Ultra screen or contact us; withdrawal removes the interest record. Full account deletion also removes it. Until then, we keep the preference only while it is needed for the updates you requested.
- Passkey public keys and enrolment records remain until account deletion. Verification challenges expire after 5 minutes and are removed after a further 24 hours. Passkey sessions have a fixed maximum lifetime of 24 hours; using the app does not extend it. Server-side session-token hashes and associated metadata are removed 7 days after expiry or revocation. These cleanup periods do not extend access.
- Completed webhook and sync processing records are removed after 7 days; completed notification delivery records after 30 days; inactive device registrations and token-free operation metadata after 90 days.
- After account erasure, a minimal hashed completion marker and hashed status-recovery credential remain for 90 days. They prevent delayed work from restoring data and let the device confirm completion; they contain no bank or transaction records.
- Operational cloud logs normally expire after 30 days. Google’s required administrative audit logs have a 400-day retention period. We exclude bank-access tokens and transaction payloads from application log messages.
- Waitlist details remain while needed to send the access updates you requested, until you withdraw or the list is no longer needed. Support correspondence remains only as needed to resolve the matter and any related dispute or legal obligation. We review these records for deletion.
Deletion jobs retry temporary failures. Retention does not authorise retaining unneeded data indefinitely. If an exception requires information to be kept longer, access is restricted to that purpose.
Your choices and deletion
You can disconnect a bank in the app, revoke access with your bank where supported, or request full deletion from Perim Settings. Deletion first revokes the bank connection, then removes account data and the sign-in account. A narrow status-recovery credential on your device lets it verify completion even after sign-in is removed. Once completion is confirmed, the app clears that account’s local Perim data and protections. See the account-deletion page for instructions and an email alternative.
Deleting Perim does not close your bank account or erase records that other providers hold independently. You can contact Plaid through its privacy policy about its own records.
Your rights
Depending on the circumstances, you can request access, correction, deletion, restriction or a portable copy of your data; object to processing based on legitimate interests; and withdraw consent. Withdrawal does not change the lawfulness of earlier processing. Contact us using the address above. We verify requests proportionately and normally respond within one month, explaining any lawful extension or limitation.
You can complain to the UK Information Commissioner’s Office or your applicable local data-protection authority. We would also welcome the chance to resolve your concern directly.
Automated blocking
Perim automatically compares recorded spending with budgets you set and applies the app or website protection you chose. It does not make lending, creditworthiness or payment-authorisation decisions. Data can be delayed or miscategorised; you can contact us to correct records or investigate a block.
Security, age and changes
We restrict backend access, encrypt connections, use provider encryption at rest and require additional authentication for financial access. No system eliminates every risk. Perim’s private test is for adults aged 18 or over; it is not a parental-monitoring service. We update this notice when the product or processing changes and highlight material changes in the app or by an appropriate service message. See our cookie notice for website storage details.