Privacy Policy

1. Introduction and Objective

PearlPost ("we", "our", "Platform") is committed to protecting your privacy and personal data. This Privacy Policy outlines how we collect, use, store, share, and protect user ("You", "User") information, in compliance with applicable data protection laws (such as GDPR and LGPD).

2. PearlPost's Role (Controller vs. Processor)

• We act as Data Controllers regarding your account data (registration, profiles, subscription, security and use of the Platform) and the technical data of visitors of Link in Bio pages.
• We act as Data Processors regarding the content you upload, publish and distribute through the Platform, including your Link in Bio page. You warrant that you hold all rights and consents for any personal data contained in that content.

3. Data We Collect

• Registration: name, email, password (stored only as a hash) and account photo.
• Profiles: username, name and avatar of each profile.
• Content: videos, images, captions, hashtags and schedules of your posts, and the content of your Link in Bio page, which is public.
• Integrations (OAuth/APIs): the account identifier on the network, username and profile address, the names of Facebook Pages, the granted scopes, and access tokens, stored encrypted.
• Network statistics: followers, views, likes and other metrics of the connected accounts, stored per day to show their evolution.
• Subscription: plan, price, status, dates and history of the subscription, and the identifier of the purchase order. Card and payment details stay with the payment processor: we never receive them.
• Pearl Tokens: balance and history of credits and debits.
• Notifications sent to you on the Platform.
• Security: the IP address and browser of each session, the networks (IPs) you confirmed, the authenticator app secret and backup codes of two-factor authentication, and confirmation codes (stored only as a hash and for a few minutes).
• Acceptance of the legal documents: the accepted version of the Terms of Use and of this Policy, and the date of acceptance.
• Access records: date, time, IP address and, when available, source port of each sign-in and of the use of your account (at most one record per hour for each address), with the email of the account, as the Brazilian Internet Civil Framework requires (Marco Civil da Internet, Law 12,965/2014, art. 15).
• Technical data: server logs of errors and security events.

4. Third-Party Integrations and Scopes

4.1. Google and YouTube API Services

• Scopes Used: email, profile, youtube.
• Limited Use Disclosure: PearlPost's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Your Google API data is not used to train generalized AI models.
• Transparency Links:
  • Google Privacy Policy: https://policies.google.com/privacy
  • YouTube Privacy: https://www.youtube.com/howyoutubeworks/privacy/
  • Revoke Access: https://security.google.com/settings/security/permissions

4.2. Meta (Facebook)

When connecting your Facebook account, PearlPost exclusively accesses the authorized scopes to enable the management of pages, business accounts, and content.

• Scopes Used: public_profile, business_management, pages_manage_posts, publish_video, pages_read_engagement, pages_show_list.
• Purpose: To enable post scheduling, cross-posting management, engagement metrics reading, and displaying lists of pages managed by you directly in the PearlPost dashboard.

4.3. Meta (Instagram)

When integrating your Instagram profile, we use the necessary permissions for commercial-scale operation.

• Scopes Used: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_insights.
• Purpose: Content management directly in business/creator profiles, automated publishing, and consolidation of performance insights (reach, likes, saves).

4.4. TikTok

To enable the distribution of short-form content, the connection with TikTok uses the following platform-approved scopes:

• Scopes Used: user.info.basic, user.info.profile, user.info.stats, video.publish, video.upload.
• Purpose: Identification of the connected account, direct publishing to your profile (uploading the video file), and collection of view and engagement statistics.

5. Artificial Intelligence and Assistant

• AutoCut: once available, AutoCut will process media exclusively to deliver the service. We do not use users' private videos to train third-party foundation AI models without explicit consent.
• Assistant: the text you type in the Assistant (up to 200 characters) is sent to a natural language processing service only to understand the request and take you to the right screen. It is sent by our servers, without your name, email or any identifier, and PearlPost does not store the text.

6. Data Sharing

We do not sell your data. We share only what is needed with:

• Hosting and database providers, where the Platform runs.
• File storage providers, which hold post media, avatars and backups.
• An email delivery provider, for verification and security emails.
• A natural language processing service, for the Assistant (see section 5).
• A payment processor, for purchases, renewals and refunds.
• The platforms you connect (Google/YouTube, Meta and TikTok), solely to publish and read metrics on your behalf.
• Authorities, upon a court order or a legal obligation.

Authorized members of the PearlPost team may access account data for support and security, with restricted access and additional verification.

7. International Transfers

Some providers and the connected platforms process data on servers outside Brazil. These transfers follow art. 33 of the LGPD and happen only to perform the service you signed up for or with the safeguards the law requires.

8. Legal Bases

• Performance of a contract: creating and keeping the account, publishing and scheduling posts, connecting networks, showing statistics, charging and refunding the subscription.
• Legitimate interest: protecting the accounts and the Platform (network verification, two-factor authentication, request limits, fraud prevention) and improving the service.
• Compliance with a legal or regulatory obligation: keeping the access records for 6 months (Marco Civil da Internet, art. 15), keeping the other records the law requires and answering court orders.
• Consent: cookies that are not strictly necessary, should any ever exist (see section 11).

9. Data Retention and Deletion

• Session: lasts up to 7 days and is renewed while you use the Platform.
• Access records: kept for 6 months from each access, in secrecy and with restricted access, and deleted after that. They are handed to third parties only by court order, and kept longer only when an authority asks, as the law allows.
• Confirmation codes: expire within minutes.
• Confirmed networks of a session: last as long as the session.
• Statistics cache: expires in 30 minutes.
• Disconnecting a network: immediately deletes the tokens and the stored statistics of that connection and revokes PearlPost's access on the network, when it offers that option. Posts already published stay on the network.
• Content and notifications: are kept until you delete them or delete the account. Deleting a post removes the post and its media from PearlPost, but not from the social network where it was published.
• Account deletion: erases the account, profiles, connections, posts and media, the Link in Bio page, notifications, and the subscription and Pearl Tokens history. It also revokes PearlPost's access to the connected networks and cancels the paid subscription at the payment processor. Posts already published stay on the networks.
• What remains after deletion: database backups, for up to 30 days; the payment records the payment processor keeps on its own; technical records of billing events, without name or email; the access records, until each one completes its 6 months, because the law requires keeping them even after the deletion; and the address of the Link in Bio page, which stays reserved for 90 days without any personal data.

10. Your Rights

Under the LGPD (art. 18), you may ask for confirmation of and access to your data, correction, portability, deletion, information about whom it is shared with, and withdrawal of consent. Several of these rights are available directly on the Platform:

• Correction: edit your name, photo, email and profiles in the account settings.
• Access and portability: download a file with all your data, including your access records of the last 6 months, through "Get Account Data".
• Deletion: delete the account through "Delete Account".

For other requests, write to the contact in section 14.

11. Security and Cookies

We implement industry-standard encryption (in transit and at rest). PearlPost only uses the cookies below:

• Strictly necessary: the sign-in session, the two-factor sign-in step and the state of connecting a social network. They keep you signed in and protect your account, so they do not depend on consent.
• Preferences: your language (user_locale) and whether the sidebar is open. Your theme is kept in your browser's local storage. They only remember choices you made.
• Cookie consent: cookie_consent stores your cookie choices for one year.
• Analytics and marketing: we do not use analytics or marketing cookies today. If that changes, they will only run with your consent, which you can give, refuse or change at any time through "Cookie preferences" in the footer or in your account settings. Your choice is shared across pearlpost.io, app.pearlpost.io and links.pearlpost.io.

Some images (such as stock photos, avatars and thumbnails of connected networks) are loaded from external services. Those services receive your IP address and browser information, as in any request, but PearlPost does not set cookies through them.

12. Visitors of Link in Bio Pages

Visiting a page at links.pearlpost.io does not require an account. The visitor's IP address is used only to limit abuse (too many requests) and is kept in memory for about 1 minute. We do not use analytics or tracking on these pages. The language and consent cookies of section 11 apply.

13. Minors

PearlPost is meant for people aged 16 or older. Between 16 and 18, use depends on the legal guardian's permission. We do not knowingly process data of people under 16: if we learn of such an account, it will be deleted.

14. Contact (DPO)

Email: support@pearlpost.io