Pepper — User Privacy Notice

Effective August 13, 2026 · Version 1.1

This notice explains how Vycari Incorporated (“Vycari,” “we,” “us”) processes personal information when you create an account or use Pepper. Vycari is the controller of the processing described here. This notice does not cover people who do not have a Pepper account; see our Non-user Privacy Notice.

1. Information we process

Depending on the features you use, we process:

• Account and profile data: name, email, picture, phone, timezone, location, preferences, connected identities, and records of agreements, choices, and channel consent.
• Conversations and content: prompts, messages, email, files, artifacts, audio and transcripts, feedback, group content, and Pepper’s replies.
• Connected-service data: OAuth credentials, permissions, and information you ask Pepper to access or change in services such as Gmail, Calendar, Contacts, Google profile/directory services, and GitHub.
• Agent, tool, and product data: tool requests and results, citations, schedules, todos, feeds, generated images, usage records, errors, and external actions.
• Personalization data: summaries, memories, embeddings, dossiers, preferences, and inferences Pepper creates to retrieve or use context.
• Communications and device data: email/SMS/WhatsApp addresses and content, delivery and stop status, push tokens and preferences, browser/device details, IP address, and necessary cookies or local storage.
• Operations data: authentication, security, audit, support, privacy-request, and incident records.

2. Sources of information

We receive information from you and your device; services and identities you connect; people who communicate or share a group with you; sources you ask Pepper to retrieve; communication, identity, security, and AI providers; and inferences Pepper creates from those sources.

3. Why we use it

We use personal information to create and authenticate accounts; answer requests; operate connected services and tools; save work and conversations; deliver communications and scheduled tasks; provide user-controlled personalization; maintain and improve reliability; secure and debug Pepper; prevent abuse; provide support; comply with law; and establish or defend legal claims.

We do not sell personal information or use it for cross-context behavioral advertising. We do not use Pepper to make decisions about you that have legal or similarly significant effects.

4. Legal bases for people in the EEA, UK, or Switzerland

• Contract: information needed to create your account and provide features you request.
• Consent: separately enabled optional uses, including persistent cross-session personalization where consent is required, and channel or notification choices. You may withdraw consent as easily as you gave it without affecting earlier lawful processing.
• Legitimate interests: proportionate security, abuse prevention, debugging, support, minimal auditing, requested communications, bounded, minimized reliability evaluation, and the development, evaluation, and improvement of our services and AI models as described in section 5. You may object to this processing at any time, including to model improvement specifically — see section 9.
• Legal obligation and legal claims: records we must keep or reasonably need to establish, exercise, or defend claims.

Acknowledging this notice is not consent to every use. Where we rely on consent, we present a separate choice. Account and request data identified as required is needed to provide the relevant feature; connections, optional profile fields, and consent-based features are optional.

5. AI and personalization

Pepper is an AI system. It uses configured model providers to generate replies, summaries, embeddings, tool decisions, images, and other requested results. We send only the context we reasonably need for the request, although that context may include personal or connected-service data you ask Pepper to use. AI output may be wrong; review important output and external actions.

We may use minimized product events and selected examples to test safety, debug defects, measure reliability, and evaluate Pepper. Access to message content for these purposes is limited to authorized cases, and we honor applicable objections and restrictions.

We may create a personalized model, memory, dossier, summary, or embedding that serves only your experience when that feature is enabled. You can review, correct, disable, or request deletion of personalization data.

Using interactions to improve our models

We use certain interactions with Vycari to develop, evaluate, and improve our services and AI models. Where applicable, we process personal data for these purposes on the basis of our legitimate interests in improving our products. You can opt out of having future interactions used for model improvement by emailing [email protected], as described in section 9.

Opting out applies to interactions created after you opt out; it does not change development or evaluation already completed, and it does not reduce any part of Pepper available to you. Where this processing involves human review, access is limited to authorized reviewers under confidentiality obligations. Examples selected for this purpose are retained under section 8.

The following are never used to develop or improve our AI models, whether or not you opt out:

• information received from Google Workspace APIs, and any raw, summarized, embedded, inferred, or otherwise derived form of it;
• content from connected accounts, external tools, and MCP servers;
• credentials, tokens, private keys, and payment information; and
• content concerning people who are not Pepper users, and content concerning children.

The use of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. When we disclose information

We disclose information only as needed to:

• infrastructure, security, secrets, and backup providers;
• configured AI model, embedding, image, voice, and grounding providers;
• identity and connected-service providers such as Google and GitHub;
• communications providers such as Twilio, Resend, Meta/WhatsApp, Apple, and the push service selected by your browser;
• websites, feeds, search/maps sources, remote MCP servers, recipients, and other third parties you direct Pepper to contact;
• members of groups and recipients of actions you request;
• professional advisers, insurers, incident responders, authorities, or another party when required by law or reasonably necessary to protect rights and security; and
• a successor in a merger, financing, reorganization, or sale, subject to applicable notice and consent requirements.

See our Vendor List for current providers, purposes, and important provider-side retention information. A third party you choose, such as a remote MCP server or message recipient, is governed by its own terms and is not necessarily our processor.

7. SMS privacy

Reply STOP to withdraw SMS consent for that number and HELP for help. You may also contact [email protected]. Stopping SMS does not delete your account.

8. Retention and deletion

We keep personal information only as long as reasonably necessary for the service, security, legal, and recordkeeping purposes described above. We use the following criteria to determine the period:

• Account, profile, and connected-service data: whether your account or connection remains active and whether the data is still needed to provide a feature you use.
• Conversations, personalization data, and user-created work: whether you retain the content, the relevant feature remains enabled, the content is part of a shared record, or the data remains needed to provide the requested service.
• Model, tool, application, infrastructure, and security records: the time reasonably needed to operate and debug Pepper, evaluate reliability, prevent abuse, protect the Service, and investigate incidents, taking account of the record's sensitivity and usefulness.
• Exports and other temporary data: the time needed to complete the requested operation and address failures.
• Backups: residual copies remain until overwritten through the ordinary backup cycle.

We may keep minimized agreement, consent, stop, security, incident, privacy-request, fraud, tax, or legal-claim records longer where necessary for those purposes. A documented legal hold pauses deletion only for the affected records and only while needed. Providers may keep limited data under their abuse-prevention or legal obligations as described in the Vendor List.

9. Your choices and rights

You can disconnect services, manage communications and notifications, review or correct supported profile and personalization data, delete supported content, and request account closure. Email [email protected] to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent where applicable. We may use proportionate steps to verify your identity.

If EEA, UK, or Swiss privacy law applies, we generally respond within one month and will explain any extension or exception. You may complain to the data-protection authority where you live or work or where you believe a violation occurred. EU authority contacts are available from the European Data Protection Board.

Residents of California and other U.S. states may have rights to know, access, correct, delete, or obtain a portable copy of personal information and to appeal or opt out of certain processing. Pepper does not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising an applicable privacy right.

10. International transfers

Vycari is based in the United States. We and our providers may process information in the United States and other countries. Where required, we use an adequacy decision, the EU-U.S. Data Privacy Framework for a verified participant and covered service, the European Commission’s Standard Contractual Clauses with supplementary measures, or another lawful mechanism. Contact us for information about applicable safeguards.

11. Cookies, local storage, and tracking choices

Pepper uses cookies and browser/device storage needed for sign-in, security, preferences, chat drafts and navigation, and push registration. We do not use advertising cookies or cross-site behavioral tracking at launch. Because we do not track users across unaffiliated sites for advertising, Pepper does not currently respond differently to browser “Do Not Track” signals. We will add an appropriate consent control before using non-essential cookies or similar technologies where consent is required.

12. Security

We use administrative, technical, and organizational measures designed to protect personal information, including TLS in transit, restricted production access, and encryption for stored OAuth credentials. No service can guarantee absolute security. Please contact [email protected] about a suspected security issue.

13. Children

Pepper is for adults and is not directed to anyone under 18. We do not knowingly create accounts for children. Contact us if you believe a child has provided personal information.

14. Changes

We will post changes here and update the version and effective date. We will give additional notice of material changes and request new agreement or consent where required.

15. Contact and controller details

Vycari Incorporated is a United States corporation and the controller for Pepper. Contact [email protected] for questions and requests. Vycari has not appointed a data protection officer.

Before Pepper is offered to people in the EEA, this section will also identify Vycari’s appointed Article 27 representative and its contact details.

Terms of Service · Non-user Privacy Notice · Vendor List