PEPPULA

Legal

Privacy policy

Last updated: October 2026

This policy covers the Peppula owner-facing website (peppula.com), including Coat Check, wellness insights and Peppy chat, and the Peppula Business API. The Peppula app remains available as a secondary tool for professional groomers and is covered by this policy as well.

1. Who we are

Peppula ("we", "us", "our") is currently operated as a registered Belgian sole trader (zelfstandige / indépendant): Rajarshi Bhattacharjee, BCE/KBO number BE1028.715.583, established in Belgium. The sole trader is the data controller for personal data collected through peppula.com, the Peppula Business API and the Peppula app. Once Peppula BV is incorporated, the controller will transfer to the company and this page will be updated; existing users will be notified by email.

Processing is governed by Regulation (EU) 2016/679 (GDPR) and the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

Contact: info@peppula.com.

2. What we collect and why

2.1 Website (peppula.com)

  • Access request and contact forms — name, email, business name, city, and a free-text "about" field. Used to evaluate and grant access to Peppula services, including Business API keys and groomer onboarding. Legal basis: pre-contractual measures (Art. 6(1)(b) GDPR).
  • Website chatbot (Peppy) — the free-text messages you send, optionally your name and email if you share them, plus a conversation ID. Messages are stored on our backend to provide continuity across visits, operate Peppy and improve the service. The Peppula team may access conversations for quality assurance; no human reads them in real time. Chat messages are not exported to analytics or training datasets. Please only share personal data that is necessary for your question. We do not need sensitive health information, exact addresses, ID numbers or similar details; your name and email are sufficient if you choose to provide them. Legal basis: legitimate interest (Art. 6(1)(f)); consent (Art. 6(1)(a)) when you voluntarily share contact details.
  • Coat Check and wellness tracking (pet owners) — the photos you upload (a full-body photo, optionally a close-up and a photo of an area of concern), your dog's name and breed (optional), an optional note about a concern, your name and email address, and optionally your postcode (used only to show local grooming price ranges). We send the photos to our AI provider to produce visual observations, store the results as your report, and email you the report with a link to view it and a PDF. If you choose to sign in and save a check, we also store a dog profile and a wellness timeline linked to your account, and your account ID. Your marketing opt-in is a separate, unticked box; you can withdraw it at any time. Please photograph only your dog — avoid people, children, house numbers or other identifying details in the background. Anyone who has the report link can open the report, so do not share it publicly. Peppula gives visual observations only, never veterinary advice. Legal basis: performing the service you request (Art. 6(1)(b)); consent for marketing emails (Art. 6(1)(a)); legitimate interest for security and abuse prevention (Art. 6(1)(f)).
  • Recurring care checklist emails — if you opt in, we store your email address, chosen dog, breed and coat type, language, frequency, next send date and the latest linked Coat Check so we can send that dog’s requested checklist. Each email contains care guidance and a reminder to run and save a new Coat Check. This is an app email you request, not marketing; you can stop it at any time in My Dogs or through the email link. Legal basis: performing the service you request (Art. 6(1)(b) GDPR).
  • Analytics (Google Analytics 4) — anonymized IP, page views, button clicks, device/browser type. Loaded only if you accept analytics cookies. Legal basis: consent (Art. 6(1)(a)).
  • Product analytics (PostHog) — pages and features used, a random visitor ID, your account ID if you are signed in, language, device/browser, and session recordings with all typed text and photos hidden. No email, name, photos or chat text are sent. Full tracking, including recordings, is loaded only if you accept analytics cookies; withdrawing consent stops it immediately. Legal basis: consent (Art. 6(1)(a)).
  • Anonymous visit counts (PostHog, before you choose) — if you have not yet answered the cookie banner, we count a few anonymous steps (pages opened, coat check started, report viewed, language chosen) without cookies, without storing anything on your device, without any visitor ID or profile and without recordings. Report IDs and URL parameters are removed and no personal data is sent. If you click “Reject”, nothing is counted. Legal basis: legitimate interest (Art. 6(1)(f)) in understanding aggregate use of the service.
  • Email notifications — when you submit a form or start a chat we send an internal notification to info@peppula.com via Resend. Legal basis: legitimate interest (Art. 6(1)(f)).
  • Technical logs — minimal request metadata kept by our hosting and backend providers for security and debugging. Legal basis: legitimate interest (Art. 6(1)(f)).

2.2 Peppula Business API

When a business integrates the Peppula Business API, it submits dog photos (with location metadata removed) and basic context such as breed, and Peppula returns coat and wellness observations. In this processing the business is the data controller and Peppula acts as a processor under a data processing agreement; we process this data only on the business's documented instructions.

2.3 Peppula app (for professional groomers)

The app is Peppula's secondary product, used by professional groomers.

Account data: email address (via Google Sign-In), name (entered during onboarding), optional phone number, salon name and address.

Dog and appointment data: dog names, breed and owner contact details, appointment dates, times and status, coat assessment results and groomer notes, grooming workflow selections and pricing.

Photos: photos taken during coat assessments. Photos are processed to remove location metadata (EXIF/GPS) before storage or analysis.

Usage data: assessment decisions (confirmed/dismissed conditions), anonymized feature usage analytics, crash reports (device type, OS version, error details).

3. AI processing

Peppula uses artificial intelligence in three ways:

  • On the website — Coat Check and wellness insights. Photos are stripped of location metadata (EXIF/GPS) and sent securely to the Google Gemini Vision API, which returns breed and coat observation suggestions only. Google does not use your photos to train their models (per Google Cloud terms). Every AI suggestion can be confirmed, modified, or dismissed by you and does not replace professional judgment.
  • Via the Business API — coat and wellness analysis. Photos submitted by integrated business partners go through the same analysis: stripped of location metadata and returned as observations only.
  • On the website — Peppy chat. Messages are routed through the Lovable AI Gateway to an AI model to generate replies. Do not use the chat for emergencies or veterinary diagnosis.

Anonymous coat analysis data (breed, coat type, and mathematical image representations) is retained to improve the accuracy of our AI models. This data contains no personal information and cannot be linked to any individual.

4. Who we share data with (processors)

We rely on a small set of trusted processors: cloud storage and authentication, AI coat analysis (Google Gemini API), app authentication (Google Sign-In), website analytics (Google Analytics 4 — consent only), product analytics and session recordings (PostHog, EU hosting — consent only), transactional email (Resend), Peppy chat replies (Lovable AI Gateway), content delivery and hosting (Cloudflare / Lovable), and optional crash monitoring (Sentry, no PII). The Peppula team may access stored chat conversations for quality assurance.

We do not sell personal data and do not share it with advertisers.

International transfers. Some processors (Google, Resend, Lovable AI Gateway) may process data in the United States. Where data leaves the European Economic Area, transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses (SCCs, Decision 2021/914), together with the processors' supplementary measures. Primary storage is provisioned in an EU region (AWS Frankfurt) where available.

5. Where data is stored

  • Local: on your device (SQLite database, encrypted in transit).
  • Cloud: Lovable Cloud on AWS EU (Frankfurt region).
  • AI processing: Google Cloud EU endpoints.

6. How long we keep your data

  • Coat Check photos (website) — 30 days for unclaimed checks. Photos linked to a saved profile are kept until you delete them.
  • Coat Check reports and results, and — if you sign in — saved dogs and wellness timeline — until you ask us to delete them or delete your account.
  • App account, appointments, assessments and photos — until account deletion.
  • AI processing cache — cached temporarily to avoid redundant processing. Cache entries contain mathematical representations only, not photos or personal data.
  • Debug logs — 30 days (auto-deleted).
  • App analytics events — 90 days (auto-deleted).
  • Access requests (website) — up to 24 months, then deleted.
  • Active recurring care checklist subscriptions — until you stop the checklist or ask us to delete it.
  • Website chatbot conversations — up to 90 days, then automatically deleted. Website chat data can be deleted sooner through our data request form or by emailing us.
  • Google Analytics 4 — GA4 default retention (14 months).
  • PostHog — events up to 12 months, session recordings up to 30 days.
  • Internal email notifications — deleted from inbox after follow-up.

7. Your rights under GDPR

You have the right to:

  • Access the personal data we hold about you (Art. 15) — in the app: Profile > Export my data.
  • Request correction of inaccurate data (Art. 16) — edit in app or contact us.
  • Request deletion ("right to be forgotten") (Art. 17) — in the app: Profile > Delete Account.
  • Restrict or object to processing (Art. 18 and 21).
  • Data portability (Art. 20) — in the app: Profile > Export my data.
  • Withdraw consent at any time (e.g. notifications via device settings), without affecting prior processing.

For website requests, the easiest way is the data request form, or email info@peppula.com. We respond within 30 days (GDPR Art. 12(3)).

You also have the right to lodge a complaint with the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be — dataprotectionauthority.be.

8. Data deletion

When you delete your app account: all profile data is permanently deleted; all dogs, appointments and assessments are permanently deleted; all photos are permanently deleted from cloud storage; local data on your device is cleared. Website-only chat data can be deleted on request through our data request form or by email. This action is irreversible.

9. Cookies

We only set non-essential cookies on the website after you consent via the cookie banner. See our cookie policy for the full list.

10. Children

The Peppula website is primarily for dog owners, and the Business API is used by businesses; the Peppula app is a secondary tool for professional groomers. None of these is directed to children under 16, and we do not knowingly collect data from minors.

11. Changes to this policy

We may update this policy as the product evolves. The "last updated" date at the top will change and material updates will be announced on this page and, for the app, in-product.

12. Contact

Email: info@peppula.com.