Privacy policy

Pepper may collect information you provide directly, including your email address, sign-in details, account preferences, support messages, and consent choices.

When you connect a bank, fintech, wallet, card, or payment account, Pepper may receive account names, institution names, account identifiers, balances, transactions, income records, merchant details, categories, account status, and other data made available by the connected provider.

Pepper may also collect technical information such as device details, browser details, IP address, request logs, webhook records, session records, error logs, and security events needed to keep the product reliable and safe.

Pepper uses data to create and manage your account, connect financial accounts, answer your money questions, show account activity, and manage access from supported AI apps.

Pepper may use data to keep the product working, debug errors, prevent fraud and abuse, secure accounts, confirm consent, send sign-in codes, send account notices, and improve reliability.

Pepper may also use aggregated or de-identified information to understand product usage and improve the service. This kind of information should not identify you personally.

Pepper is built to work with AI apps like ChatGPT and other supported clients. When you connect Pepper to an AI app, that app may request permission to access selected Pepper data or use selected Pepper tools.

Pepper only shares data with an AI app after access has been granted through the connection flow. The access may include balances, transactions, account summaries, spending information, income information, or other supported read-only data depending on the tools and scopes approved.

You can revoke AI app access from Pepper. After access is revoked, the AI app should no longer be able to request new Pepper data through your account.

AI apps are separate services. Your chats, prompts, files, and responses inside those apps are handled under their own terms and privacy policies.

Pepper uses account connection providers and financial institution integrations to help link and refresh financial accounts.

Those providers may process your information to verify the connection, retrieve account data, refresh account data, detect issues, and keep the connection working.

The exact data available to Pepper depends on the institution, the provider, the account type, and the permissions granted during the connection flow.

Pepper may use email to send sign-in codes, account notices, security alerts, connection updates, access notices, support replies, and important product messages.

Pepper does not use passwords for the current sign-in flow. Email access is important because it may be used to confirm your identity and restore access.

Product or marketing messages, if added, should include a way to opt out where required. Security and account messages may still be sent when needed.

Pepper may share data with service providers that help operate the product, including hosting providers, database providers, email providers, analytics or logging tools, account connection providers, and security tools.

Pepper may share selected data with supported AI apps after you connect and approve access.

Pepper may share information if required by law, legal process, fraud prevention, security investigation, user protection, or to enforce our terms.

Pepper does not sell your connected financial account data.

Pepper keeps personal data while it is needed to provide the product, maintain your account, support connected accounts, keep audit and consent records, resolve disputes, prevent abuse, and meet legal or operational requirements.

If you disconnect an account, Pepper may stop receiving new data from that account, but may keep older records where needed for security, support, logs, legal requirements, or product integrity.

If you ask Pepper to delete data, we will review the request and delete or de-identify data where required and where we no longer need to keep it.

You can sign in to Pepper to review connected accounts, disconnect accounts, review AI app access, and revoke access.

You can contact Pepper to ask about your data, request deletion, request correction, or raise a privacy concern.

Some requests may require us to verify that you control the account or email before we act on them.

Pepper is designed around consent, limited access, and user control. We work to protect connected account data, access tokens, consent records, account activity, and technical systems.

No system is perfect. Banks, fintechs, account connection providers, AI apps, networks, and hosting systems can fail or be attacked.

If you believe your Pepper account, email, connected account, or AI app access has been used without permission, contact us quickly at hello@andalabx.com.

Pepper is not designed for children. You should not use Pepper if you are not old enough to manage the financial accounts you connect or to agree to these terms in your location.

Pepper will change as the product grows. We may update this policy when the product, law, providers, data practices, or security needs change.

If a change is important, we may notify users through the product, email, or another reasonable channel.

Pepper is in the process of registering with the Nigeria Data Protection Commission (NDPC) as a Data Controller of Major Importance under the Nigeria Data Protection Act 2023.

As a data subject under the NDPA, you have the right to: access personal data Pepper holds about you, request correction of inaccurate data, request deletion of your data, object to or restrict how your data is processed, and lodge a complaint with the NDPC at ndpc.gov.ng.

To exercise any of these rights, contact our Data Protection Officer at hello@andalabx.com. We will respond within the timeframes required by applicable law.

Pepper uses third-party service providers located outside Nigeria, including OpenAI (United States), which may process your data as part of delivering the product.

Where data is transferred outside Nigeria, Pepper takes steps to ensure appropriate protections are in place consistent with the requirements of the NDPA.

Questions or privacy requests can be sent to hello@andalabx.com.