Privacy Policy

1. Who we are

PeppyPOS is a point of sale and inventory system for small businesses in the Philippines, operated by EulClavie, a business registered with the Bureau of Internal Revenue.

• Registered business name: EulClavie
• Contact: reach us through Ask Peppy? in the PeppyPOS app

2. Our role and the store owner's role

Under the Data Privacy Act, there are two roles:

• We are the personal information controller for information about store owners and visitors to our website: your account details, billing, payment proofs, support messages, and how you found us.
• We are a personal information processor for information the store owner puts into their store: staff records, time-in selfies, sales, and customer details such as names for utang. The store owner is the controller of that data and decides how it is used. We process it only on their instructions, to provide PeppyPOS.

If you are a staff member or customer of a store that uses PeppyPOS, please contact that store first about your information. We will help the store answer your request.

3. What we collect

From store owners

• Name, email address and mobile number.
• Business information: business name, type of business, store address and settings.
• Plan and billing records, and payment proofs (GCash reference codes and screenshots).
• Support tickets and AI help chat messages.
• Marketing source: how you found us (for example, the ad campaign, UTM tags, click IDs and the referring website), used to measure which channels bring signups.

Store data (processed for the store owner)

• Staff names, roles, login PINs and passwords (stored hashed, never in readable form).
• Optional staff selfies taken at time-in, with time-in and break records.
• Sales, products, stock, suppliers, expenses and drawer records.
• Any customer details the store chooses to record, such as names for utang.

Collected automatically

• Device and browser information, IP address, login times and activity logs, used for security and support.

4. How we use it

• To create and run your store, sync your sales and keep your data available on your devices.
• To manage your plan, check payments and send billing reminders.
• To answer support questions and AI help chat messages.
• To keep accounts secure, prevent fraud (including fake payment proofs) and investigate problems.
• To understand which marketing channels bring signups, and to improve PeppyPOS using overall usage numbers.
• To send service messages, such as replies to your messages and notices about your account or billing.

We do not sell personal information, and we do not use store data to advertise to your customers.

5. Lawful basis

We process personal information when the Data Privacy Act allows it, mainly:

• Contract: to provide the service you signed up for and collect payment.
• Legitimate interests: security, fraud prevention, support and measuring our marketing, in ways that do not override your rights.
• Legal obligation: keeping records the law requires, such as tax records.
• Consent: where we ask for it, for example optional marketing messages. You can withdraw consent at any time.

For store data, the store owner is responsible for having a lawful basis, for example telling staff that selfies are taken at time-in.

6. Who we share it with

We share information only with service providers that help us run PeppyPOS, under agreements that require them to protect it:

• Contabo, our server host (Tokyo, Japan).
• Our own backup server in the United States, which keeps backup copies of store data.
• OpenAI, which powers the AI help chat and the automatic check of payment screenshots (amount and recipient). Our staff also review payment proofs.

We may also disclose information if the law, a court or a government authority requires it, or to protect the rights and safety of people or of PeppyPOS.

7. Where your data is stored

Our servers are in Japan (Contabo, Tokyo). Backups are kept in the United States. OpenAI may process AI chat messages and payment screenshots outside the Philippines. These are cross-border transfers. We remain responsible for your information when it is transferred and use providers with appropriate security, as required by the Data Privacy Act.

8. Cookies

We use cookies and browser storage only to keep you logged in, to remember your preferences, and to make offline selling work. Our website also remembers in your browser how you first arrived (for example, from an ad) so we can link it to your signup. We do not use advertising cookies to track you across other websites.

We use Google Analytics to understand how visitors use our website, such as which pages are viewed, the type of device and the general location. Google Analytics sets its own cookies. You can block them in your browser settings or with Google's opt-out browser add-on.

9. Website and app activity

We record pages viewed and buttons tapped on peppypos.com and in the app, with IP address and device, to improve PeppyPOS and keep accounts safe. Our website keeps a random visitor ID in your browser for this. We never record passwords or what you type. Kept 180 days. No third-party advertising trackers.

10. How long we keep it

• Store data: for as long as your store is active. If your store moves to the Free plan, your data is kept.
• After you close your store or ask us to delete it: deleted within 30 days. Backups are overwritten on their normal schedule.
• Billing and payment records: as long as needed for tax and accounting laws.
• Security and login logs: 90 days, unless needed to investigate a problem.
• Website and app activity (pages viewed, buttons tapped): 180 days.

11. How we protect it

• Each store's data is kept in its own separate database file, and logins only work on their own store.
• Passwords and PINs are stored hashed.
• Connections to PeppyPOS are encrypted (HTTPS).
• Access to our systems is limited to staff who need it, and actions are logged.
• We keep regular backups in a separate location.

No system is perfectly secure, but we work to protect your information and review our measures regularly.

12. If there is a data breach

If a personal data breach is likely to put people at real risk of harm, we will notify the National Privacy Commission and the affected people within 72 hours of finding out, as the law requires. If it affects store data, we will also tell the store owner right away so they can meet their own duties.

13. Your rights

Under the Data Privacy Act, you have the right to:

• Be informed about how your information is processed.
• Access the personal information we hold about you.
• Correct information that is wrong or incomplete.
• Erasure or blocking of information that is no longer needed or was processed unlawfully.
• Object to processing, including withdrawing consent.
• Data portability: get your data in a common electronic format.
• Damages if you are harmed by inaccurate or unlawfully processed information.
• File a complaint with the National Privacy Commission (privacy.gov.ph).

To use these rights, contact our Data Protection Officer through Ask Peppy? in the PeppyPOS app. We may ask you to confirm your identity. We aim to reply within 15 days.

14. Export and deletion

Store owners can export data as CSV files from the app (depending on plan), or ask us for a full export. You can ask us to delete your store and all its data at any time. We will confirm when it is done.

15. Children

PeppyPOS is for businesses and is not meant for children. Store owners must be at least 18.

16. Changes to this policy

We may update this policy. For important changes, we will tell store owners in the app or by email before they take effect. The date at the top shows the latest version.

17. Contact and Data Protection Officer

Data Protection Officer: reach our Data Protection Officer through Ask Peppy? in the PeppyPOS app, or the message form on peppypos.com.

EulClavie, the business behind PeppyPOS. Contact us through Ask Peppy? in the PeppyPOS app.