Pepliful ("Pepliful", "we", "us", or "our") operates pepliful.com and the Pepliful brand-fulfillment platform (the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your information.
This policy applies to two groups: (1) "Brand Operators" — the businesses and individuals who create an account with Pepliful to fulfill orders under their own brand, and (2) "End Customers" — the people whose orders a Brand Operator submits to us for fulfillment. End Customers are primarily the customers of the Brand Operator, not of Pepliful. We process End Customer data on the Brand Operator's behalf, and the Brand Operator's own privacy policy governs the relationship with that End Customer.
1. Information we collect
From Brand Operators
- Account information: name, email address, password hash, brand name, and account preferences.
- Brand kit: storefront name, support email, return address, label accent color, and uploaded logo files.
- Billing information: subscription status, wallet balance, transactions, and payment-processor identifiers. Card details are handled directly by our payment processor (Stripe) and are not stored on Pepliful's servers.
- Integration data: store-platform connection details, webhook URLs, and inbound order tokens you choose to share with us.
- Communications: messages you send to support, scheduled calls, survey responses, and metadata about emails we send you.
- Device and usage data: IP address, browser type, pages viewed, referring URLs, and timestamps, collected through cookies and standard server logs.
From End Customers (received from Brand Operators)
- Order details: order number, line items, dose, and quantities.
- Recipient details: name, shipping address, optional email address, and optional order notes.
- Fulfillment status: tracking number and delivery state.
We do not knowingly collect health information, biometric data, financial-account numbers, or government IDs from End Customers. Brand Operators must not submit any such information to us.
2. How we use information
- To operate the Service, create accounts, authenticate sessions, and provide customer support.
- To fulfill orders submitted by Brand Operators — including printing labels, packing, and shipping the requested products to the End Customer.
- To debit a Brand Operator's wallet, process subscription payments, and issue invoices.
- To send transactional messages (order confirmations, shipping updates, account alerts) and, where permitted, onboarding and product-update messages. Brand Operators can opt out of non-transactional emails at any time.
- To improve and secure the Service, including fraud prevention, debugging, analytics, and capacity planning.
- To comply with legal obligations, enforce our Terms, and protect Pepliful, Brand Operators, End Customers, and the public.
3. Legal bases (EEA / UK users)
Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (operating the Service and shipping orders), legitimate interests (securing and improving the Service, communicating with our customers), consent (where required for marketing or non-essential cookies), and compliance with legal obligations.
4. How we share information
We do not sell personal information. We share it only in the following ways:
- Service providers acting on our behalf — including our hosting, database, email, analytics, payment, and shipping providers — under written contracts that restrict their use of the information to providing services to us.
- Carriers and fulfillment partners who must receive shipping information to deliver End Customer orders.
- Brand Operators, who can see the orders, fulfillment status, and End Customer information that they submitted to us.
- Legal and safety — when required by law, subpoena, or to protect rights, property, or safety.
- Business transfers — if Pepliful is acquired or merged, information may be transferred to the successor, subject to this policy.
5. Cookies and similar technologies
We use strictly necessary cookies to keep you signed in and to remember your preferences. We also use limited analytics and advertising identifiers (for example, to measure conversions on our marketing pages). You can control cookies through your browser settings; blocking strictly necessary cookies will break parts of the Service.
6. Data retention
We retain Brand Operator account data for as long as the account is open and for a reasonable period afterward to handle taxes, accounting, disputes, and legal obligations. Order records are retained for at least seven years for tax and regulatory purposes. We retain logs and security data for a shorter period, typically twelve months. End Customer information that we process on behalf of a Brand Operator is retained until the Brand Operator instructs us to delete it, or until the underlying retention requirement expires, whichever is later.
7. Security
We use industry-standard administrative, technical, and physical safeguards — including encryption in transit, role-based access controls, and audit logging — to protect personal information. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you in accordance with applicable law.
8. International transfers
We operate primarily in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for international transfers.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain uses. To exercise these rights as a Brand Operator, email privacy@pepliful.com. End Customers should contact the Brand Operator they purchased from; we will assist that Brand Operator in responding.
California residents have rights under the CCPA/CPRA, including the right to know, delete, correct, and limit certain uses of sensitive personal information, and the right not to be discriminated against for exercising those rights. We do not "sell" personal information and do not "share" it for cross-context behavioral advertising as those terms are defined under California law.
10. Children
The Service is intended for businesses and adults over 18. We do not knowingly collect personal information from children under 13 (or 16 in the EEA/UK). If you believe a child has provided us with personal information, contact us and we will delete it.
11. Research-use products
All products fulfilled through the Service are intended for research use only, are not for human consumption, and have not been evaluated by the FDA. We do not process information for diagnostic, therapeutic, or other medical purposes.
12. Changes
We may update this policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service before the change takes effect. The "Last updated" date at the top of this page indicates when this policy was last revised.
13. Contact
Questions about this Privacy Policy? Email us at privacy@pepliful.com.