Privacy Policy

1. Who we are

Pelican is a parental-control service. It is provided by YBIM GLOBAL LTDA (trade name YBIM OPCO), a Brazilian limited company, CNPJ 16.611.786/0001-13, Rua Elviro Nolasco, 24, Vila Marambaia, Bonito, Mato Grosso do Sul, 79290-000, Brazil. In this policy, "Pelican", "we" and "us" mean YBIM GLOBAL LTDA.

For the parent account data and the data collected from the devices a parent connects, we are the controller. That makes us the "operator" under the U.S. Children's Online Privacy Protection Act (COPPA).

Contact for anything about privacy, including requests from any data protection officer or encarregado: privacy@pelicanprotect.com.

2. What this policy covers

This policy covers:

• the Pelican parent dashboard (web and app);
• the Pelican apps installed on children's devices (Windows, macOS, Android and iOS);
• the Pelican browser extension (Chrome, Microsoft Edge and Safari);
• the website pelicanprotect.com.

3. Who uses Pelican

A parent or legal guardian aged 18 or older creates the Pelican account. That person installs Pelican on the devices of the children they are responsible for, and chooses which features are turned on. Children do not create accounts and cannot use Pelican on their own.

By creating an account and installing Pelican on a child's device, the parent:

• confirms that they have the legal authority to do so;
• gives consent, on the child's behalf, to the collection described in this policy.

We encourage parents to tell their children, in a way that suits their age, that the device is protected by Pelican.

4. Information we collect

4.1 From the parent

• Account:
  • name and e-mail address;
  • password, which is stored only in hashed form by our authentication provider;
  • country, state and city;
  • language and time zone.
• Children's profiles: the display name the parent chooses, and an avatar or photo.
• Settings and rules: for example blocked websites, apps and channels, time limits, schedules and alert preferences.
• Assistant requests: questions and commands typed to the Pelican AI assistant, and its answers.
• Dashboard usage:
  • which screens are opened and for how long;
  • which buttons and sections are used;
  • errors and performance;
  • the device type, browser and language.

  This does not include screen text, children's content, e-mail addresses, IP addresses or real page addresses. The parent can turn this off at any time in Settings → Security → "Usage analytics".

• Support: messages the parent sends to us.

4.2 From the child's device

Each feature collects data only when the parent turns it on. Some features exist only on some devices.

5. How we use information

We use this information to:

• provide the service the parent asked for, which means applying the rules and showing activity, reports and alerts to the parent;
• send notifications;
• generate summaries and AI-assisted reports for the parent;
• operate, secure, fix and improve Pelican;
• answer support requests;
• comply with the law.

We do not:

• sell personal information;
• show advertising, or use children's data for advertising or profiling unrelated to the service;
• use any data to decide creditworthiness or lending.

Legal bases (where the GDPR or the Brazilian LGPD apply):

• performance of the contract with the parent;
• the parent's specific consent for children's data (LGPD art. 14), which is always processed in the child's best interest;
• our legitimate interests in security and product improvement, balanced against the rights of the people involved;
• legal obligations.

6. Automated and AI processing

Some features send data to AI service providers, which process it on our behalf:

• AI assistant: the parent's requests, and the activity data needed to answer them. Providers: Anthropic and OpenAI.
• Keyword alert checks: the matched excerpt is checked automatically to decide whether it deserves an alert. Providers: typesafe.ai and OpenRouter.
• Images during video calls: checked for nudity. Provider: Google (Gemini).
• Quizzes and exams: questions are generated and the child's answers are graded. Providers: OpenAI and Anthropic.
• Setup support: while Pelican is being installed on a Windows computer, information from the security software's screen is analyzed to guide the setup. Provider: typesafe.ai. It contains no children's activity.

Every alert and result is shown to the parent, who decides what to do. Pelican does not take legal or similarly significant decisions about anyone automatically.

7. Who we share information with

Within Pelican, a child's information is shown only to the parent account that connected the device.

We share information only with the service providers that run Pelican for us, under contracts that limit them to that purpose:

Other disclosures:

• YouTube, Twitch and Kick: to show video details to the parent, we send their public APIs only the public identifiers, titles or channel names of the content watched. Nothing about the child or the device is sent. Pelican uses YouTube API Services; see the Google Privacy Policy. Thumbnails and players load directly from these platforms in the parent's browser. When the parent plays a video, the platform may store cookies or local data. The YouTube player uses its privacy-enhanced mode.
• Legal reasons: we may disclose information when the law requires it, or to protect a child or another person from serious harm.
• Business transfers: if the business is merged or sold, information may be transferred under this policy, and we will notify parents.

8. The Pelican browser extension

The extension works only together with the Pelican app on the same computer and a parent's account. It does what the parent turns on:

• it blocks restricted websites and checkout attempts;
• it reports the websites visited while the page is in focus;
• it reports YouTube, Twitch and Kick watching;
• it reports the text submitted to supported search engines and AI assistants.

What it sends and does not send:

• It sends this activity to the Pelican app on the computer, which delivers it to the parent's account.
• Apart from submitted search and AI text, it does not send what is typed into pages.
• It does not send cookies, full pages, screenshots or card numbers.

How long the extension's data is kept:

• websites visited and submitted search and AI text: 90 days;
• blocked website and checkout attempts: 180 days;
• YouTube, Twitch and Kick watch time: 365 days, because it is part of the parent's yearly app and screen-time history.

Limited Use: the use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. In particular, data from the extension is used only to provide its single purpose to the parent. It is never sold, never used for advertising and never used for creditworthiness. No person at Pelican reads it, except in the three cases listed in section 12.

9. How long we keep information

Activity is deleted automatically after the periods below, or earlier if the parent deletes it (section 10).

Backup copies of the database are deleted automatically within 7 days, which also removes deleted data from them.

10. Your choices and rights

Parents can:

• turn any feature on or off at any time;
• turn off dashboard usage analytics;
• remove a device in the dashboard. This uninstalls Pelican from it and immediately deletes that device and all of its activity history;
• delete the whole account at any time in the dashboard Settings. Deletion is immediate and also removes all children's profiles, devices and history;
• ask for access to, correction, deletion or a copy of their data and their children's data, or object to or restrict a use, by writing to privacy@pelicanprotect.com. We may need to confirm that the request comes from the account holder. We answer within 15 days.

Depending on where you live, you may also have the right to complain to a data protection authority. In Brazil, that is the ANPD. In the European Union, it is the authority of your country. In the United States, privacy rights under state laws are honored through the same e-mail. We do not discriminate against anyone who exercises them.

A child, or someone acting for a child, may also write to us. We will work with the parent account holder to address the request.

11. Children's privacy

Pelican is designed for parents to protect children of any age under 18. We collect children's information only through a device that their parent connected, and only for the features the parent turned on.

Under COPPA, the parent's creation of the account and installation of Pelican on the child's device is how we obtain verifiable parental consent.

Children's data is:

• shown only to their parent;
• used only to provide the service;
• never used for advertising.

The parent can review it or delete it at any time, as described in section 10.

12. Who can see your data, and security

Inside Pelican, a child's activity is visible only to the parent account that connected the device. The database itself enforces this: each parent account can read only its own family's data.

No Pelican employee or contractor views children's activity:

• Pelican's internal tools show only account information (the parent's e-mail address, the devices and their technical status) and statistics without content. None of them shows children's activity.
• Direct access to the database is limited to a single administrator account of the company, protected by two-factor authentication. That account is used to look at a family's data only in the three cases below, and only as far as each case requires:
  1. the parent who owns the account asks us in writing, and only for that request;
  2. we are investigating a security incident that affects that account;
  3. the law requires it, for example a court order.
• Data sent to the AI providers in section 6 is processed automatically. No one at Pelican reads it.

We also protect information with:

• encryption in transit;
• a separate secret for each device;
• limits on request rates.

No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.

13. International transfers

Pelican is used worldwide. Our main servers are in the United States, and some providers process data in other countries. When data leaves your country, we rely on the safeguards the applicable law allows, such as standard contractual clauses.

14. Cookies and local storage

The dashboard and the website use only the cookies and local storage they need. These keep the parent signed in and remember settings. We do not use advertising cookies or third-party trackers. Embedded YouTube, Twitch and Kick players load only when the parent chooses to play a video (see section 7).

15. Changes

We may update this policy. For a significant change, we notify parents by e-mail or in the dashboard before it takes effect. The date at the top shows the latest version.

16. Contact

YBIM GLOBAL LTDA — privacy@pelicanprotect.com — Rua Elviro Nolasco, 24, Vila Marambaia, Bonito, MS, 79290-000, Brazil