Privacy policy

1Who this policy covers

This policy explains how The Pep Company (“we”, “us”) handles personal information on thepepcompany.com, in our application and onboarding, and when we provide services to merchants. It covers people who visit our site, people who apply, the owners and managers named in an application, and anyone who emails us.

It doesn't cover the customers of merchants' stores. When we build or host a store for a merchant, the merchant decides how its customers' information is used and its own privacy policy applies. We handle that information only to run the store for the merchant.

2What we collect

When you apply

• Your business: legal name and any trade name, business type, EIN, phone number, support email, business address, store website, what you sell, expected monthly sales, the services you want, the name to show on card statements and a description of your products.
• Compliance details: your product list, your answers to our compliance questions and any fixes you ask our team to make.
• Owners and managers: each person's name, job title, ownership share, email, phone number, home address, date of birth and the last four digits of their Social Security number. If you list other people, make sure they know, and point them to this policy.
• Bank details for payouts, if you type them in. They go from your browser straight to Stripe, and we receive only a token from Stripe that stands in for them.

When you finish setup with Stripe

Stripe collects your photo ID, a selfie and any other verification details on its own pages. We don't ask for or keep copies of your ID. Stripe tells us whether your setup is complete.

When you work with us

What you tell us by email or on calls, your quote, the content you give us for your store, and the status of your plan and payments, which we get from Stripe. We never see full card numbers.

When you visit our site

Our hosting provider processes standard information about each request, such as your IP address, browser type and the page you asked for, to deliver the site and keep it secure. We don't use analytics, advertising pixels or tracking cookies, and our emails don't track whether you open them or click their links.

In your browser

The application saves your progress in your browser's local storage so you can come back to it. That copy stays on your device. It holds the answers you've typed, such as names, email addresses, phone numbers and addresses, but never your EIN, dates of birth, SSN digits, bank numbers or files. To remove it, clear this site's data in your browser's settings.

If you type in bank details, Stripe's script loads when you submit them and may set cookies that Stripe uses to prevent fraud.

3How we use it

• To review your application and decide whether we can work together.
• To create and fill in your Stripe account, so Stripe can verify you and set up payments and payouts.
• To email you about your application and setup: confirmations, approvals, reminders to finish setting up or start your plan, and notices about your account.
• To provide the services: building and hosting stores, compliance checks and support.
• To bill for our services and keep business records.
• To prevent fraud and abuse, keep our services secure and meet our legal obligations.

We don't sell personal information, and we don't use it for advertising.

4Who we share it with

We share information with the companies that help us run the services, and only what each one needs:

• Stripe, our payment processing partner, receives the details in your application, apart from the product list file. Stripe keeps your account record, verifies identities and processes payments. When you provide personal data in connection with The Pep Company, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.
• RedFynn Payments, a payment processing company we work with as an independent sales organization, keeps your application in its CRM (IRIS CRM): your business and contact details, your answers about sales and card history, and your product list. That lets us offer you a merchant account through RedFynn and the banks and processors it works with when that suits your business better than Stripe. We never send RedFynn your EIN, dates of birth, SSN digits, bank details or home address. If we set you up with RedFynn, you give RedFynn what its bank needs in RedFynn's own application, and RedFynn handles that under its own privacy policy.
• Resend sends our emails, and our email providers deliver the mail you send to our addresses.
• Google stores our team's private list of applications in Google Sheets, and the product lists you upload in Google Drive. The list holds business and contact details, city and state, store, what you sell, expected sales, services and status. It never holds EINs, dates of birth, SSN digits, bank details or home addresses.
• Vercel hosts our website.

We may also share information with our professional advisers, with authorities when the law requires it or to protect people's rights and safety, and with a buyer or successor if we're part of a merger, acquisition or sale of assets.

5Where it's kept and for how long

We don't run our own database. Your application is kept in your Stripe account. Our onboarding team also gets a summary of it by email, with your product list attached, keeps a list of applications in Google Sheets, and keeps your application as a lead in RedFynn's CRM. None of these includes EINs, dates of birth, SSN digits, bank details or home addresses. These providers may process information in the United States and other countries where they operate.

If we decline an application, we delete the Stripe account and the CRM lead we created for it, although Stripe and RedFynn may keep some information where the law requires. We keep our team's record of each application, and our emails, for as long as we need them for business, legal and tax purposes, and then delete them.

If you become a merchant, we keep your information while we work together, and afterwards for as long as the law requires or we need it to resolve disputes and enforce our agreements.

6How we protect it

• Sensitive numbers never reach our storage. Your EIN, dates of birth and SSN digits pass through our server to Stripe without being saved or logged, and bank numbers go from your browser to Stripe directly.
• Instead of accounts and passwords, we email links that are signed, expire, and work for one purpose only.
• Information travels over encrypted connections (HTTPS), and on our side only our team can see it.

No system is perfectly secure. If a breach affects your information, we'll tell you as the law requires. To report a security problem, email security@thepepcompany.com.

7Your choices and rights

• You can ask us for a copy of your information, or ask us to correct or delete it, by emailing privacy@thepepcompany.com. We'll check it's you, usually by replying to the email address we have, and respond within the time the law allows.
• We may need to keep some information, such as records the law or Stripe requires, and deleting some information may mean we can't keep providing the services.
• Our reminder emails stop once you finish the step they're about, and we send at most two for each step.
• If your state's privacy law gives you rights over your information (California's does, for example), you can use them by emailing us, and we won't treat you differently for doing so. We don't sell or share personal information as those laws define it. Someone you authorize in writing can make a request for you.

8Children

Our services are for businesses and the adults who run them. We don't knowingly collect information from anyone under 18.

9Changes to this policy

When we change this policy, we'll post the new version here and update the date at the top. If a change materially affects how we use your information, we'll email merchants and applicants before it takes effect.