Pearl Pass Privacy Policy

The Pearl Pass app, the Pearl Pass browser extension and the Pearl Pass sync service

This policy explains what data Pearl Pass handles, why, where it goes and how long it is kept. It covers the Pearl Pass app for Android, the Pearl Pass browser extension, Pearl Pass built into the Pearl browser and the sync service at browser.perlicom.com. It is written against what the software actually does. Where a feature is optional, the policy says so and says what happens when it is off.

1. Who we are and what this policy covers

Perlicom Systems Ltd ("we" or "us") is the data controller for Pearl Pass. It is a company registered in Ireland, company number 546999, VAT number IE3281342GH. You can contact us at support@perlicom.com.

This policy covers:

the Pearl Pass app for Android phones (and for iOS when it is released);
the Pearl Pass browser extension for Chromium browsers such as Google Chrome and Microsoft Edge, and the same password manager built into the Pearl browser;
the Pearl Pass sync service (browser.perlicom.com), which holds your account and your end-to-end encrypted vault;
this website.

It applies however you installed Pearl Pass: from Google Play, from the Chrome Web Store, from Microsoft Edge Add-ons, or from this website.

2. The short version

Your master password never leaves your device and we cannot recover it.
Your vault is end-to-end encrypted. If you sign in with Google, our server stores your Google account identifier and email address, and encrypted data that it cannot decrypt.
On your phone, Pearl Pass keeps your vault on the phone, fills logins in other apps only when you choose one, and never presses Log in for you.
Phone verification codes are end-to-end encrypted before they leave your phone and are deleted from our server within minutes.
Fingerprint and face unlock stay on your phone. We never receive your fingerprint or a picture of your face.
Server logs are kept for 30 days. Like any website, our servers record the IP address, time and address of each request. We use these logs only for security and troubleshooting, and delete them after 30 days.
Usage counts, not content. The app counts which of its screens and features are used and sends those daily counts to us, linked to your account (section 11 says for how long). This is a condition of using the app, not an optional setting. The counts never include which sites, logins, passwords or anything you type, and never your advertising ID or precise location. We do not sell data, we do not build profiles of you, and we do not use your data for credit decisions. The only third-party tracking is Google's ad SDK in the Android app, described in section 4, and you can switch its personalisation off.
Suggest a feature. A suggestion you send from Settings is stored with your account's name and e-mail address so we can follow it up, and grouped with similar suggestions.
Advertising in the Android app only, and never from your vault. The Pearl Pass app for Android shows a banner at the foot of Settings and, occasionally, a full-screen advert when a manual sync you started has finished. Adverts are supplied by Google AdMob and are never shown on a lock screen, a master-password prompt, a code, a revealed password or an autofill surface. Google may use your device's advertising ID to personalise the adverts, and you can turn that off; nothing from your vault is shared with an advertiser. Where the law requires your consent for adverts, if you do not consent the app shows no adverts and you keep full use of the app. Section 4 explains this in full. The browser extension contains no advertising at all.

3. On your device

Your vault (logins, identities, payment cards, notes and one-time-password secrets you choose to save) is stored in the storage of the app or the extension, encrypted with AES-256-GCM under a key derived from your master password with Argon2id. The unlocked key is held only in memory and is cleared when you lock the vault, when auto-lock runs, or when the app or browser closes.

Your master password is never sent to us or to anyone else. We cannot read your vault and cannot recover a forgotten master password.

3.1 The browser extension

To do its job, the extension reads the web pages you visit, on your device only. On http and https pages it looks for sign-in, sign-up, address, payment card and verification-code fields; shows its icons in those fields; offers to save a login when you submit a form; and fills saved details. A saved login is only ever offered on the exact site it was saved for. Filling a single matching login, or your default identity's address into empty fields, as a page loads can be turned off in the extension's settings; payment cards are never filled without a click. Page content, form contents and the list of sites you visit are not collected, stored on our servers or sent anywhere.

Site icons shown beside saved logins come from your browser's own icon cache; no request is made to fetch them.

3.2 The app for Android

The app keeps your vault in its private storage on the phone. It blocks screenshots and screen recording of its screens, and it is excluded from Android's cloud backup, so your vault is never copied to Google Drive by the phone.

First start and permissions. The first screen of the app lists, in plain words, everything Pearl Pass does that this policy describes: filling passwords in apps and browsers, reading verification codes from notifications, keeping authenticator (TOTP) codes, the end-to-end encrypted vault and its sync, Google sign-in, usage counts and, on Android, the advert in Settings. It links these terms and this policy, and has a separate, unticked box for marketing email. Tapping Continue with Google on that screen is your agreement; the app records on the phone which version you agreed to and when. Straight after you sign in, the app opens Android's own pages for the two system permissions it uses, and you can decline either:

Autofill service: lets Pearl Pass offer your logins in other apps and in browsers (section 3.3).
Notification access: lets Pearl Pass find verification codes in notifications (section 7).

If you decline, the app still opens and works, and shows a small reminder in the vault that takes you back to the same Android page. The camera and biometric prompts are requested only when you use a feature that needs them.

3.3 Autofill in other apps and browsers

Pearl Pass fills your saved logins, identities and payment cards in three places: in other apps and in browsers on Android, through Android's Autofill service; in web pages through the Pearl Pass browser extension (section 3.1); and in the Pearl browser, which has Pearl Pass built in. In every case it fills only what you choose.

When Pearl Pass is your Android autofill service, Android shows it the structure of the screen you are filling: which fields are user name, password, address or card fields, the app's package name, and the website domain if the screen is a web page in a browser. Pearl Pass uses this on the phone only, to offer matching logins and to offer to save a login you have just typed. It fills only: it never presses Log in or submits a form for you. A login is offered to an app only if it was saved for that app and signed with the same app signing certificate, and a website login only inside a real browser, so a lookalike app cannot receive it. Screen contents are not stored and are not sent to us or anyone else.

When you copy a password or code, the app marks it as sensitive, so Android does not show a preview, and clears the clipboard after 45 seconds if it still holds what was copied.

3.3a Authenticator (TOTP) codes

You can save an authenticator (TOTP) secret with a login, by scanning its QR code or typing it. The secret is stored in your encrypted vault and synced end-to-end encrypted like the rest of it. Pearl Pass computes the current six-digit code on your device from the secret and the time, shows it, and can fill or copy it; the secret and the codes are never sent to us in readable form.

3.4 Fingerprint, face unlock and the camera

Fingerprint (and other strong biometrics) is handled entirely by Android. Pearl Pass only receives "confirmed" or "not confirmed", and uses that to release a key stored in the phone's secure hardware (Android Keystore). We never receive or store your fingerprint.

Face unlock is optional and off until you set it up. It uses the front camera to build a face template that is stored only on your phone. It is never synced, never uploaded, and never unlocks the vault on its own; it only confirms it is still you, for example before showing a password in an already unlocked vault. You can delete it in Settings at any time.

The camera is used only while you are scanning a QR code (for example to add a one-time-password secret) or setting up or using face unlock. Camera frames are processed on the phone and are never stored or sent anywhere.

3.5 Log files and crashes

Pearl Pass has no crash reporter and sends no diagnostic data to us. If you send us a log or screenshot in a support request, we use it only to handle that request.

4. Advertising

The Pearl Pass app for Android is supported by advertising supplied by Google AdMob. The browser extension and Pearl Pass built into the Pearl browser contain no advertising SDK and show no adverts.

Where an advert can appear — and where it never can. This is a password manager, so the placement is deliberately narrow:

a banner at the foot of the Settings screen, and nowhere else: not on the vault list, not on an entry, not on the generator, not on an identity or a payment card;
occasionally a full-screen advert at a natural break — when a manual "Sync now" that you started has finished and you are still on Settings. It is never shown on an unlock, during autofill, on a sync the app started by itself, on a save, on an import or on a master-password change, and it is rate-limited so it cannot become a recurring interruption.

No advert is ever shown on a secret. The lock and unlock screens, the master-password and PIN prompts, a one-time-password code, a revealed password and the account master-password dialog carry no advert. Android's autofill surfaces cannot show one either: the autofill service is a separate native process with no ad code in it.

The adverts can be personalised. The app includes Google's standard advertising permissions, so Google's ad SDK can read your device's advertising ID (com.google.android.gms.permission.AD_ID, and on newer Android versions the Privacy Sandbox ACCESS_ADSERVICES_AD_ID and ACCESS_ADSERVICES_TOPICS). Where you have agreed to it, and where you have not deleted that ID or switched off ad personalisation on your phone, Google may use it to choose adverts that match your interests. That profile is Google's and is built from Google's own sources, never from what you keep in Pearl Pass.

What Google receives. To choose, deliver and measure an advert and to prevent ad fraud, Google may process your device's advertising ID, coarse device and app information (model, Android version, app version, language), your IP address — from which an approximate, city-level location is derived — and whether an advert was shown, seen or tapped, plus diagnostics from the ads SDK itself. Google does this as an independent controller, under its own policies (policies.google.com/privacy).

We give Google nothing from your vault. Your logins, identities, payment cards, notes, one-time-password secrets, the sites and apps you fill in, your verification codes, your master password and your encrypted synced data are not shared with Google's ad SDK, with any advertiser, or with anyone else for advertising. They are end-to-end encrypted and we cannot read them ourselves. No advert is targeted using anything you keep in Pearl Pass.

Your choices.

In the EU, EEA and UK the app asks for your consent before any personalised advertising, through Google's certified consent flow (the User Messaging Platform). You can reopen it and change or withdraw your answer at any time in Settings > Privacy & ad choices.
If you do not consent, the app shows no adverts and you keep full use of the app. Nothing is locked and there is no screen to get past: no advert is requested at all. At most, after a manual sync you started on Settings, the app may ask once whether you would like to support it by changing your ad choice. You can dismiss it, and it is never shown over the unlock screen, your vault or autofill. You can change your choice at any time in Settings > Privacy & ad choices, where that option is offered in your region.
On Android, wherever you are, you can reset or delete your advertising ID and switch off ad personalisation in Settings > Privacy > Ads (on many phones: Settings > Security & privacy > Privacy > Ads, or Settings > Google > Ads). Deleting the ID stops Pearl Pass's adverts being personalised. You can also manage Google ad settings at myadcenter.google.com.
How Google uses data from apps that use its services is described at policies.google.com/technologies/partner-sites.

5. Your account and sync

5.1 Your account

The Pearl Pass app requires a Pearl Pass account, and you sign in with Google (on some stores, with Apple or an emailed one-time code instead). Signing in is what makes your vault available on all your devices, through end-to-end encrypted sync. The browser extension can also be used with an account. Google authenticates you (Google's own privacy policy applies to that step) and gives us a signed sign-in token. From it we store:

your Google account identifier, your email address, and the display name and profile picture address Google provides;
when the account was created and last signed in, and whether you signed in from the app or the extension, on which kind of platform, with a count of sign-ins.

For each signed-in device we store a session: a random device identifier created by the app or extension, a platform label, and when the session was created, last used and expires. Sessions expire 30 days after they were last refreshed, and in any case 90 days after you signed in, when you sign in with Google again. The session token itself is stored only as a one-way hash.

5.2 End-to-end encrypted sync

Your vault is end-to-end encrypted. Vault entries are encrypted on your device before upload. The key that encrypts them is stored on our server only in wrapped (encrypted) form, under a key derived from your master password, together with the salt, the key-derivation settings, an encrypted verifier and a hash of an authentication proof. None of this lets us decrypt your data.

Our server does see, and stores in readable form, the information it needs to organise and sync your encrypted items: a random item identifier, which collection it belongs to (for example "vault"), timestamps, whether it was deleted, its size, the device and app that wrote it, and your account email address.

We keep a security log of account events (sign-in, token refresh, sign-out, key changes, resets, account deletion, and refused or rate-limited attempts) with the time and IP address. Entries are kept for 90 days (section 11).

5.3 Update checks

The app checks for new versions by downloading a small update manifest from our server, however you installed it, including from Google Play. The request does not contain your account, a device identifier or anything about your vault. Security updates can be required: an out-of-date app asks you to install the update before continuing. Copies installed from Google Play are then updated through Google Play, copies installed from this website download the update from our server, and the extension is updated by your browser or its store. Like any web request, our server sees your IP address and the request, which may appear in our request logs.

6. Optional lookups

6.1 Breach check: optional, off by default

If you turn on Check passwords against known breaches, Pearl Pass computes a SHA-1 hash of a password on your device and sends only the first five characters of that hash to the Have I Been Pwned "Pwned Passwords" range service (api.pwnedpasswords.com). The comparison against the list that comes back happens on your device. Your password and its full hash are never sent. We receive nothing from this check. Like any web request, the service can see your IP address.

6.2 Eircode address lookup

When you are signed in and look up an Irish Eircode while editing an identity, the Eircode is sent to our server, which asks the public Eircode finder service for the matching address through our lookup proxy and returns it to you. Only the Eircode is sent, never your name or other details. Like any request, it may appear in our server's request logs.

7. Verification codes from your phone

The Pearl Pass app can pass one-time verification codes that arrive on your phone (for example by text message or in a banking app notification) to Pearl Pass in your browser, so you do not have to type them. This is on by default: the app's first screen explains exactly what it reads (section 3.2), and straight after you sign in the app opens Android's notification-access page. It works only once you have granted that access. You can turn it off at any time in the app's Settings, or by removing notification access in Android's settings.

When it is on, the app reads the text of incoming notifications on the phone itself to find a verification code. Notification text is not uploaded, stored or sent anywhere. Notifications without a code are ignored and nothing about them is kept. When a code is found, the phone sends one record to the sync service, end-to-end encrypted with your account key, so we cannot read it. The record contains:

the code;
the name and Android package name of the app that showed the notification;
the notification's title, which is usually the sender's name or number (at most 40 characters);
the website domain, if the message names one;
whether the message mentions a payment, and whether it came from a recognised messaging app;
when it was received, and an expiry five minutes later.

There is only ever one such record per account: each new code replaces the previous one, and when you use a code, Pearl Pass replaces the record with an empty encrypted marker. Our server deletes the record automatically once it is 10 minutes old (the clean-up runs every five minutes, so a record never stays longer than 15 minutes), or with your account. Pearl Pass in your browser asks for a code only while a verification-code field is showing on an https page. If the message names a domain, it offers the code only on that site. It fills the code only when you click Use this code.

8. Why we use data, and our legal bases

To provide the app, account and sync you asked for: update checks, autofill, storing your account, sessions and encrypted data, Eircode lookups and relaying phone codes (performance of a contract, GDPR Article 6(1)(b)).
Face unlock, which uses biometric data on your phone only, relies on your explicit consent (Articles 6(1)(a) and 9(2)(a)), given when you set it up and withdrawn by deleting it. We never receive this data.
To keep the service secure and working: the security log, rate limiting, abuse prevention and troubleshooting (our legitimate interests, Article 6(1)(f)).
Usage counts, a condition of using the app: our legitimate interests (Article 6(1)(f)) in keeping the app working and improving it. What is sent: the account it belongs to, the app, its version and build, the platform, a random install identifier, and for each day how many times each screen or feature was used, with the first and last time that day. The counts are minimal, contain no content and are not used for advertising. You can object at any time by writing to us; because the app cannot work without them, the way to stop them entirely is to stop using the app and delete your account.
Feature suggestions you send from Settings (what you wrote, the category, the app, its version and platform, the time, and your account's name and e-mail address): our legitimate interests in answering and acting on them (Article 6(1)(f)).
Legal obligations, where the law requires us to keep or disclose information (Article 6(1)(c)).

Personalised advertising in the Android app (section 4), which uses your device's advertising ID: your consent (Article 6(1)(a)) in the EU, EEA and UK, given through Google's consent flow and withdrawn at any time in Settings > Privacy & ad choices.
Non-personalised advertising, ad measurement and fraud prevention in the Android app: our legitimate interests (Article 6(1)(f)) in funding a free password manager and keeping it working and secure. Where local law requires consent before anything is stored on or read from your device, adverts are shown only once you have given it; if you do not consent the app shows no adverts and you keep full use of the app.

We do not sell your data, we do not build profiles of you, and we do not let people read your data except where you ask us to (for example in a support request), where it is needed for security, or where the law requires it. Your vault is encrypted, so it cannot be read in any of these cases, and nothing in it is used for advertising.

9. Chrome Web Store user data and Google API Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements, and to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: the only data we receive through Google sign-in is your account identifier, email address, name and profile picture. We use it only to create and identify your Pearl Pass account for the features described above. We do not transfer it to others except as necessary to provide or secure those features, to comply with the law, or as part of a merger or acquisition with notice to you. We do not use it for advertising, and we do not use it to determine creditworthiness or for lending.

10. Who else handles data

Google: signs you in if you choose Sign in with Google.
Our hosting provider, Hetzner Online GmbH: runs the servers for browser.perlicom.com in data centres in the European Union, under contract, as our processor.
Google Play: if you install the app from Google Play, Google handles the download, updates and any crash reports you choose to share with developers through Android, under Google's privacy policy.
Google AdMob: serves the adverts in the Android app (section 4). It receives your device's advertising ID and the device and IP information Google needs to deliver, personalise and measure an advert — never anything from your vault.
Have I Been Pwned: only if you turn on the breach check, and only receives five characters of a password hash.
The Eircode finder service: only receives an Eircode you look up.

We share nothing else, except where the law requires it. Where a provider such as Google processes data outside the European Economic Area, it does so under its own legal safeguards, such as the European Commission's Standard Contractual Clauses.

11. How long we keep data

Data on your device (the vault and settings) stays until you delete it or uninstall. Removing the extension deletes its storage.
Your account, encrypted data and wrapped key are kept while your account exists.
Sessions expire 30 days after they were last refreshed, and at most 90 days after sign-in.
A relayed phone code becomes unusable five minutes after it was received. The encrypted record is replaced by the next code, cleared when used, and deleted from our server once it is 10 minutes old (at most 15 minutes, as the clean-up runs every five minutes), or with your account.
Usage counts are kept for 13 months (395 days), then deleted automatically.
Feature suggestions, with the name and e-mail address they came from, are kept for 24 months, then deleted automatically.
Security log entries are kept for 90 days and then deleted automatically, including entries not linked to an account, such as refused or rate-limited sign-in attempts. Entries linked to your account are deleted earlier if you delete your account. The record that an account was deleted contains no account identifier and no IP address.
Server request logs (IP address, time, the address requested, the response and the app or browser's user agent) are kept for up to 30 days for security and troubleshooting, then deleted automatically. They are not used to track you, are not combined with your vault, and are not shared except with our hosting provider as our processor or where the law requires it.
Backups: our server makes a nightly backup of the sync database and keeps it for 14 days. Your synced content is in it only in end-to-end encrypted form. When you delete your account, its data disappears from backups as they are replaced, within 14 days, and is never restored into the live service.

12. Your choices and your rights

You can use Pearl Pass without an account; your vault then stays on that device.
You can sign out of one device, or of every device at once.
If you forget your master password, Reset erases your key and every item you have synced. It asks you to sign in with Google again first.
To delete your account, you can request deletion in the app (Settings > Request account deletion) or at browser.perlicom.com/delete-account; we process requests within 30 days and e-mail you when done. Processing removes your account record, key document, sessions, every synced item, any waiting phone code, your app sign-in history, your usage counts, your feature suggestions and the security log entries linked to you. Your request is checked against the Google account you are signed in with; a request from anyone else is refused. You can also email support@perlicom.com from the address you signed in with.
Uninstalling the app, or removing the extension, deletes the data it kept on that device.

Under the GDPR you have the right to access, correct, delete, restrict or port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. For synced content we can only provide the encrypted form; your own devices hold the readable copy, and Pearl Pass can export your vault. To exercise a right, email support@perlicom.com. You also have the right to complain to the supervisory authority where you live or work, or the Data Protection Commission in Ireland (www.dataprotection.ie) as our lead authority.

13. Security

Synced data is encrypted end-to-end before it leaves your device. Connections to our servers use TLS. Session tokens are stored hashed, sessions end after at most 90 days, sign-in is rate-limited, and destructive actions (resetting your sync key, deleting your account) need a fresh Google sign-in from the last ten minutes. No system is perfectly secure: choose a strong master password and keep your devices protected.

13a. Your US state privacy rights

This section applies if you live in a US state with a general consumer privacy law: California (the CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and any state with a similar law. It adds to the rest of this policy.

What is collected

In the last 12 months these categories of personal information were collected through Pearl Pass. Each is used only for the purposes, and kept only for the periods, described earlier in this policy.

By us: identifiers: if you sign in, your Google account identifier, e-mail address, display name and profile picture address; a random device identifier for each signed-in device; and IP addresses in our security log (90 days) and request logs (30 days).
By us: internet or other network activity: when you signed in, from which app and kind of platform, your sessions, and the organising details of your synced items (identifier, collection, timestamps, size, which device wrote it).
By us: your synced content, which reaches us only end-to-end encrypted: we store it but cannot read it.
By us: usage counts: daily counts of which screens and features are used, with the app, version, platform and a random install identifier, linked to your account (never which pages, sites, searches or logins); and any feature suggestion you send, with your name and e-mail address.
By Google's ads SDK in the app: identifiers (advertising ID, app set ID, IP address); internet or other network activity (adverts shown and tapped, SDK diagnostics); and approximate location worked out from the IP address.

Sensitive personal information: none that we can read. Your vault (including passwords and payment cards) and relayed verification codes reach our server only end-to-end encrypted, under a key we never have, and nothing from them is ever passed to Google's ads SDK.

Selling and sharing

We do not sell personal information for money, and we do not give it to data brokers. But the Pearl Pass app for Android shows Google AdMob adverts, and where those adverts may be personalised Google receives your advertising ID, IP address and which adverts you saw or tapped. Under California law that counts as "sharing" for cross-context behavioural advertising. Under the other state laws it is "targeted advertising", and some of them may also call it a "sale". Google is the only recipient. We do not knowingly sell or share the personal information of anyone under 16.

How to opt out ("Do Not Sell or Share My Personal Information")

On your phone (this is what actually stops it). Android: Settings > Security & privacy > Privacy > Ads > Delete advertising ID (on some phones Settings > Google > Ads). Without an advertising ID, Google shows that device only non-personalised adverts. More in section 4.
By e-mail: write to support@perlicom.com with the subject "Do Not Sell or Share". Adverts are requested by the app on your phone and we do not hold your advertising ID, so we cannot switch this off from our side; we will confirm your request and send you the steps above.

Global Privacy Control (GPC). GPC is a browser setting, so the app itself cannot receive it. Our web pages carry no advertising or cross-site tracking, so there is nothing there for GPC to switch off. If a browser sends GPC to any of our web services, we treat it as a valid opt-out of sale and sharing.

Your rights

Know and access: what we hold about you, where it came from, why we use it and who receives it, and a copy you can take elsewhere.
Delete it — request deletion in the app (Settings > Request account deletion) or at browser.perlicom.com/delete-account; we process requests within 30 days and e-mail you when done.
Correct anything that is wrong.
Opt out of sale, sharing and targeted advertising (above), and of profiling that has legal or similarly significant effects (we do none).
Limit the use of sensitive personal information: we already use it only to provide the feature you asked for, and never to infer things about you; you can still ask.
No discrimination: using any of these rights will not change the price, quality or features you get.

How to make a request

E-mail support@perlicom.com with the subject "US privacy request", saying which right you want to use and which state you live in. Please write from the e-mail address your account uses, so we can match it to you. We answer within 45 days. If we need longer, we tell you why within those 45 days and may extend once by up to another 45 days. An authorised agent can make a request for you with your signed permission; we may ask you to confirm your identity with us directly.

Appeals. If we turn a request down, reply with the subject "Appeal" and we will answer within 45 days. If you are still not satisfied, you can contact your state Attorney General.

14. Children

Pearl Pass is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

15. Summary of our lawful bases

The sections above describe in detail what Pearl Pass collects and why. In summary, and where the detailed sections above are more specific they apply:

Contract (GDPR Article 6(1)(b)): to provide Pearl Pass and your account, and to do what you ask the app to do.
Legitimate interests (Article 6(1)(f)): to keep Pearl Pass and our servers secure, prevent fraud and abuse, fix faults, measure how the app is used through the usage counts described above (a condition of using the app, not an optional setting), improve our apps, create anonymised or aggregated statistics, and send marketing e-mails about our own apps under the soft opt-in described in "Marketing emails" below (you can opt out at any time). You can object to processing based on legitimate interests at any time (see your rights above).
Consent (Article 6(1)(a)): for personalised advertising, for any other marketing (for example by text message or about other companies' products, which we do not send today), and for anything else where we ask you to agree. You can withdraw consent at any time, without affecting what was done before.
Legal obligation (Article 6(1)(c)): to keep records the law requires, and to answer lawful requests from authorities.

16. Advertising only with your consent

Accepting the Pearl Pass terms of use is not consent to personalised advertising. In the EU, the EEA, the UK and Switzerland, adverts in Pearl Pass are personalised only if you agree in the EU consent message (Google's consent tool), and you can change your choice at any time from the app's privacy options, as described above.

17. Marketing emails

We send e-mails with news and offers about Perlicom Systems Ltd's own apps and services. We never send offers from, or on behalf of, other companies, and we never share your e-mail address with anyone for their marketing.

Default and choice. When you create an account, the "Emails from Perlicom Systems Ltd" box is ticked, and you can untick it right there before you continue. If you close the question without continuing, nothing is recorded and we send no marketing e-mails.
Legal basis. A "soft opt-in" for our own similar products under S.I. No. 336 of 2011, Regulation 13(11), with our legitimate interest in telling customers about our apps (GDPR Article 6(1)(f)). You have an absolute right to object to direct marketing at any time (GDPR Article 21(2) and (3)); once you object we stop, and a refusal is never switched back on unless you turn it on yourself.
How to opt out. Turn off "Emails from Perlicom Systems Ltd" in the app's About or Settings screen, use the one-click unsubscribe link in any marketing e-mail, or e-mail support@perlicom.com. One choice covers every app of ours that uses your account.
What we record. Your choice, the exact wording you saw and its version, the app, the source (sign-up, settings or unsubscribe link) and the date and time, kept as a history of changes so we can show what you agreed to. We keep it while you have an account and for up to 6 years after, as evidence of your choice.
Service messages about your account, security, purchases or changes to our terms are part of the service and are not marketing.

18. Content you publish or share

Under the Pearl Pass terms of use you keep ownership of your content and give us a licence to use content that you publish (for example publicly or with a public link), including in marketing and promotion of our apps. Content that you keep private, including anything protected by end-to-end encryption, and content you send privately to particular people (such as messages, calls, meetings, recordings or files sent to named recipients) is used only to provide Pearl Pass. That licence does not change how we handle personal data: any personal data in your content is used only as this policy describes. We will not feature content that identifies you or anyone else in marketing unless that person has agreed, and you can ask us not to feature your content at all by e-mailing support@perlicom.com with the subject "Do not feature my content".

19. Anonymised and aggregated information

We may turn information into anonymised or aggregated statistics that do not identify you or anyone else and cannot reasonably be linked back to a person (for example, how many people use a feature in a month). Such information is not personal data. We own it and may use, publish, share, license or sell it. We will not try to re-identify anyone from it, and anyone we give it to must agree not to try either. We do not sell your personal data for money. Some US state laws treat sharing data with advertising partners for personalised adverts as a "sale" or "sharing" of personal data; we do that only with your consent, and you can withdraw it at any time as described above.

20. If we withdraw Pearl Pass

If we withdraw Pearl Pass or shut down the servers behind it (see the Terms of Use), we will tell you in advance where practicable, and where Pearl Pass lets you download or export your content you can do so during the notice period. After the shutdown we delete the personal data and content kept on our servers for Pearl Pass, including from our backups as they expire, except anything the law requires us to keep (for example purchase and tax records) and anonymised or aggregated information. Data kept only on your own device stays there until you delete it.

21. Changes to this policy

We will update this policy when Pearl Pass or the law changes, and change the effective date (and version, where shown) at the top. If a change materially affects how your personal data is used, we will tell you in the app, by e-mail or on the store listing before it takes effect, and where the law requires it we will ask for your consent again.

22. Contact and complaints

Perlicom Systems Ltd (company number 546999, Ireland) is the data controller. E-mail: support@perlicom.com. We reply within one month.

You have the right to complain to the supervisory authority where you live or work, or the Data Protection Commission in Ireland (www.dataprotection.ie) as our lead authority. See also the Pearl Pass Terms of Use.