This Privacy Policy explains how PeppyBooks collects, uses, shares and protects personal information when you visit peppybooks.com, sign up for a trial, or use the PeppyBooks application at app.peppybooks.com (together, the “Service”).

1. Who is responsible for your information

For customers located in India, the responsible entity is Pointage IT Solutions Pvt Ltd, 301 & 302, 3rd Floor, No. 46, Renaissance D C Chambers, Subbarama Chetty Road, NR Colony, Basavanagudi, Bengaluru, Karnataka 560004, India.
For customers located outside India, the responsible entity is PeppyBooks Inc., 1209 Orange Street, Wilmington, Delaware 19801, United States.

Both entities operate the Service together; “PeppyBooks”, “we” and “us” refer to whichever entity applies to you.

2. Information we collect

Account information. When you start a free trial you provide your full name, company name, work email address and mobile number. Your email address is verified with a one-time verification code. When you set up your account you confirm the country (and, for India, the state) your business operates in, and you may create a password. If you later subscribe to a paid plan we also collect the billing details needed to invoice you.

Authentication information. The one-time verification code is stored only as a keyed hash and expires after ten minutes; we never store the code itself. When you sign in we issue session tokens, and we record a device identifier that your browser generates, so that your sessions can be kept secure and signed out.

Business and customer data. The Service stores the data you and your users enter: products, stock, sales, invoices, purchases, your own customers and their contact details, and accounting entries. We process this data on your behalf to provide the Service. You are responsible for it and for the privacy notices you give your own customers.

Billing and subscription information. If you choose a paid plan: the plan, billing period, invoices and payment status. Card or bank details are handled by the payment provider you pay through; PeppyBooks does not collect them at signup.

Device and technical information. IP address, browser and device type, operating system, language, the pages you visit, timestamps, request identifiers and error logs. During signup the IP address is kept only as a hash to limit abuse.

Attribution information. When you arrive from an advertisement or campaign link we record the campaign parameters present in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid, msclkid), the landing page and the referring page, and we keep them with your trial record so we know which campaign led to your signup.

Communications. Messages you send us, support requests and feedback.

Contact form. When you send a message through the contact form on peppybooks.com you provide your first and last name, company name, work email address, an optional phone number, the topic and your message. We also record the page you sent it from, any campaign parameters described above, your IP address and browser type, to prevent abuse and to understand how people reach us. Your message is delivered by email to our sales team so we can reply to you; it is not used for anything else.

We do not ask for age, banking credentials or payment cards to create a trial account.

3. How we use information

To create and operate your account: verifying your email, provisioning your trial company, signing you in and keeping sessions secure.
To provide the Service: storing and processing your business data, sending transactional messages (verification codes, receipts you choose to send, service notices).
To protect the Service: rate limiting, abuse and fraud prevention, security monitoring, troubleshooting.
To understand and improve the Service: usage analytics and campaign attribution, so we know how people find and use PeppyBooks.
To bill you when you subscribe to a paid plan.
To contact you about your account, and — where you have not opted out — about PeppyBooks products and offers.
To comply with law and enforce our Terms.

4. Cookies and analytics

Necessary storage (always on): items required for signup, email verification, sign-in, security and session operation, and the first-party campaign attribution needed to complete a signup you started. These do not require your consent.
Analytics (Google Analytics 4): helps us understand how the website is used. In regions where consent is required, analytics storage is not set until you accept it.
Advertising: PeppyBooks does not currently use advertising or remarketing cookies. If we enable them in future, they will be off until you accept them where consent is required.

You can accept all, reject non-essential, or manage these categories from the privacy banner and the “Privacy preferences” link in the website footer at any time. Rejecting analytics does not affect your ability to sign up or use PeppyBooks.

We do not sell personal information. We share it only:

With service providers who process it on our behalf and under our instructions: Microsoft Azure (hosting and databases), Amazon Web Services (transactional email delivery), Google (analytics), our messaging providers for messages you or your customers request, and our email and support tools.
Within the PeppyBooks group, between the two entities named above, to operate the Service.
With your consent or at your direction, for example when you connect a third-party service to your account.
For legal reasons: to comply with law, a court order or a lawful request; to enforce our Terms; or to protect the rights, property or safety of PeppyBooks, our customers or others.
In a business transfer: if PeppyBooks is involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

6. International processing

PeppyBooks serves customers in many countries. The Service is hosted on Microsoft Azure in India, transactional email is sent through Amazon Web Services in the European Union, and our service providers may process data in other countries, including the United States. Where the law requires, we rely on appropriate safeguards for such transfers, such as standard contractual clauses.

7. Security

We protect information with encryption in transit, hashed passwords and verification codes, secret management for service credentials, access controls, monitoring and regular backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately.

8. Retention

Verification codes: valid for ten minutes; never stored in readable form.
Signup records that never become an account: deleted after 7 days.
Signup security metadata (hashed IP address, browser details): removed 7 days after signup.
One-time sign-in links: removed within 24 hours of being used or expiring.
Trial and account records, including attribution: kept for as long as your account exists and for a reasonable period afterwards for legal, accounting and dispute purposes.
Business data: kept while your account is active; after closure or the end of an unconverted trial it may be deleted following a reasonable retention period.
Logs and technical records: kept for a limited period for security and troubleshooting.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, to withdraw consent, and to complain to a supervisory authority. This includes rights under the EU and UK GDPR, the California Consumer Privacy Act, Australia’s Privacy Act, the UAE Personal Data Protection Law and India’s Digital Personal Data Protection Act. To exercise a right, contact us using the details below; we will verify your request and respond within the time the law requires.

Marketing communications. You can opt out of marketing emails at any time using the unsubscribe link in the email or by contacting us. We will still send transactional and service messages that are necessary to operate your account.

10. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18.

11. Changes to this Policy

We may update this Policy. The current version is always published at peppybooks.com/privacy/ with its effective date, and we will notify you of significant changes by email or in the Service.

12. Contact

Privacy questions and requests: privacy@peppybooks.com

Pointage IT Solutions Pvt Ltd, 301 & 302, 3rd Floor, No. 46, Renaissance D C Chambers, Subbarama Chetty Road, NR Colony, Basavanagudi, Bengaluru, Karnataka 560004, India

PeppyBooks Inc., 1209 Orange Street, Wilmington, Delaware 19801, United States