Privacy policy.

Peppit Ltd is a company incorporated in England and Wales (company number 17433912), with its registered office at Unit 145, Stratford Workshops, Burford Rd, London E15 2SP, United Kingdom. For privacy enquiries, contact support@peppit.ai.

This policy covers three groups of people:

• Merchants: shop owners and staff who use the Peppit app.
• Shoppers: people who order from a shop through Peppit Direct, for click and collect or delivery.
• Website visitors: anyone who visits peppit.ai.

Depending on the circumstances, we act as a data controller (we decide why and how personal data is used) or a data processor (we use it on a merchant's behalf and following their instructions). When you order through Peppit Direct, Peppit and the Shop are each independently responsible for the personal data they hold, as separate controllers. Peppit is responsible for the information it holds to run Peppit Direct, take payments and arrange delivery. The Shop is responsible for the information it holds to fulfil your order.

Merchants

• Account and contact information: your name, email address, telephone number, login details, and your communications with us, including support requests.
• Business information: business or trading name, company registration and VAT information where applicable, business and store addresses, opening hours, and other information about your stores and operations.
• Identity and business verification: where certain features, payments or integrations require it, photo identification, beneficial ownership and company information, food-safety information (such as an FSA rating), and information required by payment, verification or compliance providers.
• Product and catalogue information: product names, barcodes, prices, descriptions, images (including photos you take and edit), brands, categories, sizes, allergens and dietary information.
• Promotions and orders: leaflet designs, delivery and contact details for leaflet orders, discount codes and delivery offers you set up, and the orders you receive.

Shoppers (Peppit Direct)

• Contact details: your first and last name, email address and mobile number.
• Delivery details: your delivery address, its location (map coordinates), and any notes for the courier.
• Order details: what you ordered, from which shop, when, the amounts paid and refunded, and any discount code used.
• Age confirmation: when you order age-restricted items, your confirmation that you are 18 or over, and the outcome of any ID check by the courier.
• Delivery records: delivery status updates, tracking information and proof of delivery, which may include a photo of the delivered order or a signature.
• Payment information: payments are processed by Stripe. We receive limited details such as the card type and last four digits, but never your full card number.
• Communications: messages you send us or the shop about an order.

Everyone, including website visitors

• Technical and usage information: IP address, browser and device information, technical and diagnostic logs, security information, and how you use our website and services.
• Leaflet QR scans: when someone scans a Peppit leaflet QR code, we record the time and device type to count scans. We do not record IP addresses or identify the person scanning.

We may receive information about you from third parties where needed to provide our services, verify information or run integrations:

• Companies House: publicly available company information.
• Google (Places, Geocoding and Maps): business details and location information, and the address you choose when you search for your delivery address.
• postcodes.io: the location of a UK postcode, used to check a delivery address.
• HubRise and delivery platforms you connect (Deliveroo, Just Eat, Uber Eats): catalogue and order information.
• Stripe: payment status and verification information.
• Our third-party courier: delivery status, tracking, courier details shown to you, and proof of delivery.
• Open Food Facts: product information and photos (not personal data).

We use information from these sources only for purposes allowed by law and this policy.

For merchants, we use personal data to:

• create and manage your account, and provide the Peppit app
• digitise, identify, match and maintain your product catalogue
• run your Peppit Direct shop, delivery settings and promotions
• design, print and deliver leaflets you order
• connect integrations you choose
• verify your business or identity where required
• process payments, billing and payouts

For shoppers, we use personal data to:

• take, process and confirm your order, and send you order updates by email
• take payment, place and release card holds, and process refunds
• arrange delivery: check your address can be reached, work out the delivery price and size, book a courier, and share tracking with you
• check whether a discount code applies to you (for example, that it's your first order from that shop)
• confirm age-restricted orders and record the outcome of ID checks
• handle failed deliveries, cancellations, complaints and disputes, including using proof of delivery

For everyone, we use personal data to:

• provide customer support and communicate with you
• keep Peppit secure, and detect and prevent fraud and misuse
• monitor, improve and develop our services
• comply with legal and regulatory obligations
• establish, exercise or defend our legal rights

Merchants can connect Peppit to third-party services, including HubRise, Deliveroo, Just Eat and Uber Eats. When you connect one, we send the information needed to run that connection. Those services process information under their own terms and privacy policies, and we don't control how they use it once it's transferred. Please read their terms before connecting.

We share personal data only where needed, with:

• Shops: a shopper's name, contact details, order and delivery details go to the shop fulfilling the order.
• Our third-party courier: a shopper's name, mobile number, delivery address, courier notes and order reference, so the order can be delivered. Couriers and shoppers can call each other through masked numbers, so neither sees the other's real number.
• Payment and verification providers: Stripe.
• Address and location services: Google (Places, Geocoding and Maps) and postcodes.io, to find and check addresses.
• Our printing partner: Brightside Print and Design receives the shop name, delivery address and contact details for leaflet orders.
• Integration and delivery platforms merchants connect: HubRise, Deliveroo, Just Eat and Uber Eats.
• Communications providers: Resend, which sends our emails.
• Technology providers: hosting, cloud, storage, security, analytics, document rendering, image processing and AI services that support Peppit.
• Public bodies: Companies House and other authorities where appropriate.
• Professional advisers: accountants, insurers and lawyers.
• Courts, regulators and law enforcement: where required or permitted by law.

We do not sell your personal data. Where a third party processes personal data for us, we take appropriate steps to make sure it is handled in line with data protection law.

Some of our service providers may process personal data outside the United Kingdom. Where they do, we use an appropriate legal mechanism and the safeguards required by data protection law. You can ask us about these safeguards at support@peppit.ai.

When a merchant account is closed, we disable it and apply the retention periods above. Your product catalogue may be kept for up to 2 years after closure so we can deal with support requests, disputes and possible reconnection. After the retention period, information is securely deleted or anonymised, unless we have a legitimate reason or legal duty to keep it longer. Information held only in backups may remain until it is removed through our normal backup cycle.

Shoppers don't need an account to order. To ask us to delete your shopper information, contact support@peppit.ai. We will delete what we're not required to keep, such as order records needed for accounting.

Merchants keep their rights in the business and catalogue information they provide, subject to the rights of others. Peppit may keep a copy of your catalogue because it is needed to provide and maintain the services.

Some third-party platforms don't let merchants export catalogues held in their systems, so the copy held by Peppit may be the lasting copy available to you. Peppit may restrict bulk catalogue exports. This does not restrict your data protection rights or any other rights that can't lawfully be excluded.

Where merchants approve product photos and details for our Global Product Registry, those photos and details may be shared with other merchants using Peppit.

We use automated technology, including AI, to identify, match, organise and improve product and catalogue information, for example to recognise products from photos and barcodes and to remove photo backgrounds. This uses product information, not personal data about shoppers.

Some checks in Peppit Direct are automated, such as whether a delivery address can be reached, whether a discount code applies, and whether a payment can go ahead. These follow fixed rules and you can always contact us if you think a decision is wrong. We do not use personal data to make solely automated decisions that have legal or similarly significant effects on you, unless the law allows it and appropriate safeguards are in place.

Depending on the circumstances, you may have the right to:

• access the personal data we hold about you
• correct inaccurate or incomplete information
• ask us to delete your personal data
• ask us to restrict how we use it
• object to our use of it where we rely on legitimate interests
• object to direct marketing
• receive certain personal data in a portable format
• withdraw consent where we rely on consent

If you object to processing based on legitimate interests, we will stop unless we have compelling legitimate grounds, or need it to establish, exercise or defend legal claims. To use your rights, contact support@peppit.ai. We may need to verify your identity first, and we will respond within the time required by law.

Some information is needed to provide a service. Merchants must provide certain details to create an account, verify their business, take payments or connect integrations. Shoppers must give their name, email and mobile number to order, and a delivery address for delivery. If you don't, we may not be able to provide the service. Where information is optional, we'll make that clear.

We send messages about your account, orders, payments, security and how the services work. These are not marketing. We do not send marketing to shoppers. We only send marketing to merchants where the law allows. You can opt out at any time using the unsubscribe link or by contacting support@peppit.ai. Opting out doesn't stop essential account or order messages.

We only use cookies and similar technologies that are essential to run and secure our website and services, for example to keep you logged in, remember your basket and protect against fraud. These don't need your consent. If we start using non-essential cookies, such as analytics, we will ask for your consent first and update this policy.

If you give us someone else's personal data, for example ordering for delivery to another person, you must make sure you're entitled to share it and that they know how it will be used.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, change, disclosure, loss or destruction. These include access controls, authentication, encryption where appropriate, private storage for photos and documents, monitoring and logging. Card details are handled by Stripe and never stored by us. No internet service can be guaranteed to be completely secure. Merchants must keep their login details confidential and tell us promptly if they think their account has been accessed without permission.

Peppit is intended for people aged 18 or over. We do not knowingly provide merchant accounts to anyone under 18. Shoppers must be 18 or over to order age-restricted items, and the courier or shop will check ID.

We may update this policy to reflect changes to our services, technology, the law or how we use personal data. When we do, we'll update the date at the top. Where a change is significant, we'll give extra notice where the law requires it.

If you're concerned about how we've handled your personal data, please contact us first at support@peppit.ai. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

Peppit Ltd, company number 17433912, Unit 145, Stratford Workshops, Burford Rd, London E15 2SP, United Kingdom.

Email: support@peppit.ai