Pepper — Non-user Privacy Notice
Effective August 11, 2026 · Version 1.0
Pepper is an AI assistant. A Pepper user may ask Pepper to communicate, schedule, or collaborate with you. Vycari Incorporated processes the contact information and content needed for that interaction. You can ask Pepper to stop or leave the interaction and can exercise the rights below.
1. Who we are
Pepper is provided by Vycari Incorporated (“Vycari,” “we,” “us”), a United States corporation. Vycari is the controller for the processing described in this notice. Contact [email protected]. Vycari has not appointed a data protection officer.
2. Why we may have information about you
A Pepper user may ask Pepper to email, text, schedule, book, or collaborate with you; include you in a group; use a calendar, email, contact, file, or other connected source that mentions you; or consider information about you when fulfilling the user’s request. You may also provide information directly when you reply to Pepper or use a Pepper booking page.
3. Categories and sources
We may process your name or label, email address, phone number, organization, calendar availability and event details, contact or directory information, group membership, booking details and timezone, communications with a Pepper user or Pepper, delivery and stop status, content about you supplied by a user or connected service, and limited inferences needed to complete the request.
The information may come from a Pepper user; a message, group, mailbox, calendar, contact list, directory, or file the user connects; your direct interaction with Pepper; a public or user-selected source; or a provider that delivers or secures the interaction.
4. Purposes and legal bases
We use the information to carry out the requested and reasonably expected communication, scheduling, booking, or collaboration; secure the Service; prevent duplicate or abusive delivery; honor stop, leave, and privacy choices; and comply with law.
Where EEA, UK, or Swiss law applies, we ordinarily rely on Vycari’s and the requesting user’s legitimate interests in completing the expected interaction, balanced by first-contact notice, easy stop and leave controls, purpose limits, shorter retention, security, and privacy rights. We rely on legal obligation where law requires processing. We do not sell non-user personal information or use it for cross-context behavioral advertising or intentional sensitive profiling.
5. AI and recipients
Pepper uses configured AI providers to process content needed for the interaction. We may also disclose the minimum necessary information to:
- Vycari’s hosting, security, and backup providers;
- the active email, SMS, WhatsApp, push, identity, connected-service, or booking provider;
- the Pepper user, relevant group members, and recipients of the requested action;
- a website, remote tool, feed, search/maps provider, or other destination the user asks Pepper to contact; and
- advisers, incident responders, authorities, or other parties where law or protection of rights and security requires it.
See the Vendor List for current providers and purposes. A user-selected recipient or tool is governed by its own privacy practices and is not necessarily Vycari’s processor.
6. Retention
- Direct-interaction content is kept while the relevant conversation, account, group, or requested interaction remains active or the content is otherwise needed for the expected service.
- A stop or leave instruction blocks further contact promptly. Related data is kept only while needed to honor that instruction and address any shared record involving other people.
- Routing, agent, tool, delivery, and security detail is kept for the time reasonably needed to operate and debug Pepper, prevent abuse, protect the Service, evaluate reliability, and investigate incidents.
- Minimized notice and stop records may be kept longer where needed to prove and continue honoring the request.
Information merely viewed in a connected mailbox, calendar, or contact list is not copied into a general Vycari address book. Residual copies may remain in backups until overwritten through the ordinary backup cycle. A documented legal hold may pause deletion for specific information only while necessary. Providers may have limited abuse-prevention or legal retention described in the Vendor List.
7. Your choices and rights
You can tell Pepper to stop or leave a direct interaction, use the channel’s stop or unsubscribe control, or email [email protected]. Depending on the law and circumstances, you may ask for access, correction, deletion, restriction, portability, or object to legitimate-interest processing. We use proportionate verification and will not expose a Pepper user’s private information or another person’s rights when responding.
Where EEA, UK, or Swiss law applies, we generally respond within one month. You may complain to the data-protection authority where you live or work or where you believe a violation occurred. EU authority contacts are available from the European Data Protection Board.
8. Notice timing
When Pepper communicates directly with you, the message or surrounding flow should identify Pepper as AI, identify Vycari, link to this notice, and provide an effective stop or leave instruction at or before the first interaction.
When you appear only incidentally in a user’s connected mailbox, calendar, contacts, or content, Vycari does not automatically message every person in that source. We instead make this notice public, minimize and secure the data, limit its use and retention, and provide this rights channel. This approach does not apply once Pepper communicates with you directly or discloses your information to a new recipient.
9. International transfers and security
Vycari and some providers are in the United States or other countries outside the EEA. Where required, we use an adequacy decision, a verified Data Privacy Framework certification, Standard Contractual Clauses with supplementary measures, or another lawful mechanism. We use safeguards designed to protect personal information, but no service can guarantee absolute security.
10. Changes and EU representative
We will post changes here and update the version and effective date. Before Pepper is offered to people in the EEA, this notice will identify Vycari’s appointed Article 27 representative and its contact details.