PepoChat

Privacy Policy

Last updated: July 16, 2026

This policy explains how PepoCloud LLC("we", "us") handles personal data in connection with PepoChat — the website at pepochat.com, the application at app.pepochat.com, and the embeddable chat widget.

1. Two roles: controller and processor

For data about our own customers (account holders, website visitors, contact-form senders) we act as a data controller. For data that flows through a customer's chat widget — their end users' names, emails, messages, and any connected meeting context — we act as a data processoron that customer's behalf; the organization operating the widget is the controller.

2. Data we collect

Account data

  • Name, email, and organization details when you sign up.
  • Billing information, processed by our payment provider.

Widget end-user data (processed for our customers)

  • Name and email the end user provides to start a chat.
  • Chat messages and conversation history.
  • Technical metadata (browser, timezone, referring page) used for context and support quality.
  • Email verification status, when the end user chooses to verify via a one-time code.
  • If the organization enables scheduling or meeting memory: appointment details, and meeting summaries or extracted notes related to that end user from the organization's connected systems.

Website data

  • Contact-form submissions (name, email, message).
  • Basic server logs for security and reliability.

3. How we use data

  • To provide, secure, and improve the Service.
  • To generate AI responses: relevant knowledge-base content and conversation context are sent to our AI model providers to produce answers.
  • To send transactional email (e.g. verification codes).
  • To respond to inquiries and provide support.
  • To comply with legal obligations.

We do not sell personal data, and we do not use your private knowledge-base content or your end users' conversations to train our own or third parties' foundation models.

4. Subprocessors

We rely on vetted service providers to operate PepoChat, including cloud database and hosting providers, AI model providers (for answer generation and embeddings), authentication and billing providers, voice-AI infrastructure (when voice is enabled), email delivery, and error monitoring. Each processes data only as needed to provide their function to us. A current list is available on request at [email protected].

5. Security

  • Data is encrypted in transit and at rest.
  • Integration credentials are additionally encrypted at the application layer (AES-256-GCM) before storage.
  • Personalized meeting context is locked behind one-time email verification and per-organization opt-in, and excludes raw transcripts and internal analytics.
  • Public endpoints are rate-limited; organizational data is isolated per tenant.

6. Retention

Account data is retained while your account is active. Customer Data (conversations, knowledge bases) is retained under the controlling organization's configuration and deleted or exported on account termination after a reasonable wind-down period. Expired, conversation-less widget sessions are purged automatically.

7. Your rights

Depending on your location (including under GDPR and CCPA/CPRA), you may have rights to access, correct, delete, or export your personal data, restrict or object to processing, and lodge a complaint with a supervisory authority. Contact us at [email protected] to exercise them. If you are an end user of a widget operated by one of our customers, we may redirect your request to that organization, which controls your data.

8. Cookies

Besides essential cookies, the marketing site sets one first-party cookie (pc_attr) that remembers how your first visit reached us: the referring site, any campaign tags in the link, and the page you landed on and when. It holds no identifier, is used only to attribute a later sign-up to the channel that brought you, and expires after 90 days. The application uses cookies and browser storage necessary for authentication and for keeping widget sessions alive; the widget stores a session identifier in the end user's browser.

9. International transfers

Data may be processed in the United States and other countries where our subprocessors operate, with appropriate safeguards such as standard contractual clauses where required.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

11. Changes

We will post updates to this policy here and, for material changes, notify account holders by email or in-app notice.

12. Contact

PepoCloud LLC
16192 Coastal Highway, Lewes, DE 19958, USA
[email protected]