This notice explains what Percolate collects, why, who receives it and how long we keep it. We do not sell your data, and we do not use your content to train AI models.
1. Who we are
Percolate, at www.percolationlabs.ai, and its connector for AI assistants are run by Percolation Labs Ltd, a company registered in England and Wales (company number 16700012) ("we", "us"). We are the controller of the personal data described here.
Contact: saoirse [at] percolationlabs.ai.
2. What we collect
- Account: your name and email address. If you sign in with Google, also your Google account identifier and the address of your Google profile photo.
- Your content: research packages and drafts, with their claims, sources and links; copies of the public pages your sources cite, captured as evidence; reading lists, board items and comparisons; contributions and proposals; publications and endorsements; comments, their earlier versions, and likes; private estimates of what a package was worth to you; and feedback you send us, with the page or tool it came from.
- Roles and permissions: writer and publisher grants, delegations that let an assistant publish for you, and the reasons recorded with them.
- Connections to AI assistants: which assistants you connect, what you allowed them to do, and when they were connected and last used. The tokens they use are stored only as hashes.
- Percolate for Chrome: when you press Save in our Chrome extension, it opens Percolate with the address and title of the tab you are on, and confirming adds them to your private brew queue. The extension reads that tab only when you open it, and it does not send page text, cookies or other tabs.
- Invitations: the email address of anyone you invite to write, and your note.
- Technical data: our web server's request logs, which include your IP address, the time, the address requested, the page you came from and your browser's user agent. IP addresses are also used, in memory only, to limit repeated requests.
We do not collect payment details, location, contacts or government identifiers, and we do not use analytics or advertising.
3. Using Percolate from an AI assistant
When you connect an AI assistant, such as Claude, you sign in to Percolate and approve what it may do. The assistant then sends Percolate the requests it makes for you, for example to save or read a package, including the content in those requests. We do not receive the rest of your conversation with it.
What Percolate returns goes to that assistant, and its provider handles it under its own privacy policy. The Percolate application does not send your content to AI model providers. Disconnecting an assistant in your account revokes its access.
4. Why we use it, and our lawful bases
- To provide Percolate: sign-in, your Library, publishing, comments, connections, and the emails the service sends (sign-in codes and invitations). Basis: our contract with you.
- To keep it secure and working: request logs, limits on repeated requests, and backups. Basis: our legitimate interest in security.
- To capture evidence and handle invitations: copies of cited public pages, and invitations to write. Basis: legitimate interests.
- To meet legal obligations.
We do not send marketing emails.
5. Who receives it
We do not sell personal data. It reaches only:
- Hetzner Online, which runs our servers and database in Helsinki, Finland.
- Microsoft, which sends our emails through Microsoft 365.
- Google, if you sign in with Google. Your browser also loads your Google profile photo from Google, and our blog pages load fonts from Google Fonts, so Google receives your IP address when that happens.
- The AI assistants you connect, which receive what Percolate returns to them.
- Readers: your name appears with work you publish and comments you make.
- Authorities, when the law requires it.
6. How long we keep it
We have not yet set deletion periods for most data. Expired sign-in codes, sessions and assistant tokens are deleted automatically, and so are backups older than 8 days. Nothing else is deleted automatically yet. Today:
- Account, content and permissions: kept while your account exists.
- Sign-in codes expire after 10 minutes, browser sessions after 7 days, assistant access tokens after 1 hour and their refresh tokens after 30 days, and personal access tokens after 7 days.
- Backups: a daily copy of the database is kept for 8 days. A copy of an earlier database, retired on 15 September 2026, is kept with no end date set.
- Request logs stay on the server and are not copied elsewhere; we have not set a period for them.
You can ask us to delete your account or other data at any time (section 7). Deletion is currently carried out by hand.
7. Your controls and rights
Packages stay private unless you publish them. In your account you can disconnect AI assistants and revoke personal access tokens. To withdraw a publication or a comment, email us.
Under UK data protection law, and EU law if you are in the EU, you can ask for a copy of your data, and ask us to correct it, delete it, restrict or object to its use, or give it to you in a portable format. Email saoirse [at] percolationlabs.ai. We will respond within one month. You can also complain to the Information Commissioner's Office, or to the data protection authority where you live.
8. Security
Connections to Percolate use HTTPS. We do not use passwords: you sign in with Google or an emailed code. Sign-in codes, sessions and tokens are stored only as hashes, and each person can read only what they are allowed to. If a breach puts your data at risk, we will tell the regulator and you as the law requires.
9. Cookies
Percolate sets two cookies, both needed for sign-in: one keeps you signed in for up to 7 days, and one lasts 10 minutes while you sign in with Google. There are no analytics or advertising cookies.
10. International transfers
Our servers and backups are in Finland, in the EU. Google and Microsoft may process data in other countries under their own safeguards.
11. Children
Percolate is not for children under 13, and we do not knowingly collect their data. If you think a child has given us data, contact us.
12. Changes
When this notice changes, we update the date at the top. We will email account holders about significant changes.