LootCRM Privacy Policy
Effective 24 September 2026
1. Summary
- LootCRM needs an account. It is a business tool: your quotes, invoices, expenses and customer records are stored on our servers so the phone and the web app show the same books.
- The records you enter are yours. We hold them to run the service for you. We do not sell them, we do not mine them, and we do not use them to train anything.
- Receipt photographs are read on your device. The supplier, date, total and VAT are extracted on the phone; the photograph is then stored with the expense as your evidence.
- The free plan shows ads, supplied by Google AdMob. Paid accounts see none. Section 4 explains what that means for your data and how to change your choices.
- No in-app purchases. Subscriptions are arranged with us directly, not inside the app.
2. Who is responsible
Perlicom Systems Limited (company number 546999, Ireland) is the data controller for your account data — the e-mail address you sign in with, your business name and your subscription record.
For the business records you put into LootCRM — your customers' names, addresses, phone numbers and job history — you are the controller and we are your processor: we hold and process them on your instructions, to provide the service. You remain responsible for having a lawful basis to hold your own customers' details and for answering their requests. Contact either way: support@perlicom.com.
3. What the app collects, and why
3.1 Account
Your e-mail address, a password (stored only as a salted hash, never in readable form), your business name and VAT details if you enter them, and your subscription status. Purpose: to let you sign in, to keep your books separate from every other customer's, and to bill you. Lawful basis: performance of our contract with you.
3.2 Your business records
Quotes, invoices, receipts, payments, expenses, VAT periods, work orders, job notes, on-site signatures and the customer details you enter. These sync between your devices and the web app, so they are stored on our servers. Purpose: to provide the service. Lawful basis: performance of our contract with you.
3.3 Photographs and files
The camera and photo-library permissions are used only when you choose to attach something: photographing a receipt or a job, or picking an existing image. The reading of a receipt (supplier, date, total, VAT) happens on your device. The image itself is uploaded and stored with the expense or job it belongs to, because that is the evidence a VAT return rests on. LootCRM does not scan your photo library and does not upload anything you did not attach.
3.4 Phone
The phone permission exists so that tapping a customer's number dials it. LootCRM does not read your call log, does not place calls on its own and does not record calls.
3.5 Notifications
Used for reminders you asked for — an appointment, an overdue invoice, a VAT period ending. You can turn them off in Android settings at any time.
3.6 Diagnostics
If the app cannot reach the server, or an error occurs, the failure may be recorded in our server logs with the date, the request and an IP address. Purpose: keeping the service working and secure. Lawful basis: our legitimate interest in a service that runs. Logs are kept for up to 90 days.
4. Advertising
The free plan of LootCRM is supported by advertising supplied by Google AdMob. Ads appear in two places only: a small banner at the foot of a list screen, and occasionally a full-screen ad at a natural break — after something has been finished and saved. LootCRM never places an ad over a form you are filling in, over a payment, or over a document you are reading, and a full-screen ad is rate-limited so it cannot become a recurring interruption.
Paid accounts see no ads at all, and no ad SDK is initialised for them.
To serve those ads, Google may process your device's advertising ID, coarse device and app information and your IP address, as an independent controller under its own policies. We do not pass Google your business records, your customers' details, your receipts or your VAT figures — the ad SDK has no access to them.
- In the EU, EEA and UK the app asks for your consent before any personalised advertising, through Google's certified consent flow. You can reopen it and change your answer at any time from the app's privacy options.
- On Android you can reset or delete your advertising ID, and switch off ad personalisation, in Settings → Privacy → Ads. Deleting the ID stops LootCRM's ads being personalised.
- How Google uses data from apps that use its services is described at policies.google.com/technologies/partner-sites.
5. What the app does NOT do
- No advertising on a paid account, and no ad that covers a form, a payment or a document.
- Your business records, customer details, receipts and VAT figures are never shared with an advertiser or used to target ads.
- No analytics SDK that follows you across other apps or websites.
- No location tracking. LootCRM asks for no location permission.
- No access to your contacts, your messages or your call history.
- No sale of personal data, under any definition, to anyone.
6. Who else sees your data
Only the suppliers we need to run the service, and only for that purpose:
- Hosting. Our servers, which store your account and your records.
- Payment processing. If you subscribe, our payment provider handles the payment. We never see or store your full card number.
- E-mail delivery. When you send a quote or an invoice from LootCRM, it is delivered by e-mail to the address you chose.
- Google AdMob, on the free plan only, for the advertising described in section 4. It receives the advertising ID and device/IP information Google needs to serve an ad — never your records.
We may also disclose data where the law requires it. We do not transfer your data outside the European Economic Area except where a supplier above does so under an approved safeguard.
7. How long we keep it
Your records are kept for as long as your account is open, because accounting records are the point of the product. If you close your account we delete your account and your records within 30 days of your confirmed request, including every team member's login. You can ask at any time from Profile → Delete account in the web app (you enter your current password, then confirm from a link we e-mail you), or by e-mailing support@perlicom.com from the address you signed up with. How it works, step by step: Delete your LootCRM account.
When a team member's login is deleted, the records they entered stay with the business; if that person asks us to erase their data, we also remove their name from those records.
We keep, even after a deletion: our billing records with you (the invoices and credit notes we issued you, your payments, refunds, cancellations, chargebacks and subscription confirmations), which Irish tax law requires us to retain for six years after the end of the year they relate to; and a short record that the deletion was asked for and done (not your reason), for six years, as evidence that we did it. Our nightly backups are kept for 14 days on a rolling basis, so deleted data can remain in a backup for up to 14 days.
You can export your data at any time — invoices, expenses and the VAT working paper — so that leaving does not cost you your books.
8. Security
Every connection the app makes uses encryption (HTTPS/TLS). Passwords are stored as salted hashes. Sign-in tokens are held in Android's encrypted storage on your device. Access to your records is scoped to your account; our staff do not browse customer data, and access for support happens only with your request.
9. Your rights (GDPR)
If you are in the EU, EEA or UK you have the right to access, correct, delete, restrict or port your personal data, to object to processing based on legitimate interests, and to withdraw consent where processing rests on it. E-mail support@perlicom.com and we will answer within one month. Where you are acting as the controller of your own customers' details, we will help you meet a request one of them makes to you.
You have the right to lodge a complaint with the Irish Data Protection Commission (www.dataprotection.ie) or with the supervisory authority where you live or work.
10. Children
LootCRM is a business tool intended for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.
11. Changes to this policy
We will update this page if the app or the law changes, and change the effective date above. If a change materially affects how your data is used, we will also tell you in the app or on the Google Play listing.
12. Contact
Perlicom Systems Limited (company number 546999, Ireland)
E-mail: support@perlicom.com