Privacy Policy

The short version

• We only read what you send to Peppr, so we can reshape it and deliver it the way each person prefers. Everything else in your workspace we see only as patterns, never words.
• We never try to work out who is neurodivergent, and we never ask anyone to disclose anything.
• What you tell us about how you like to work stays yours. Managers don't see it.
• We don't sell personal information. Ever.

1. Who we are

Peppr is run by Peppr Limited, a New Zealand company. We build tools that adapt a team's workflows to how each person thinks.

This policy explains what we collect, why, and what we do with it. It covers our website (peppr.io), our newsletter, our workshops, and the Peppr product. It applies to visitors, pilot customers, and people who work at organisations using Peppr.

We follow the New Zealand Privacy Act 2020 and its Information Privacy Principles.

2. What we collect

If you visit the website

• Contact details when you book a pilot: your name, email, company, and team size, plus the times you say suit a call.
• Your email address if you subscribe to the newsletter.
• Anonymous usage data: which pages people visit, how long they stay, and where they came from. We use this to improve the site. We don't use it to identify you.

If your organisation uses Peppr

• Messages you send to Peppr, by writing to your workspace's Peppr mailbox or to the Peppr bot in Slack or Teams. We read those, because that is the job: we turn a rushed or tangled message into a form everyone can follow, and deliver it to each person in the format they asked for. We keep them only as long as needed to do that.
• The shape of your team's messaging everywhere else in Slack or Teams: when messages are sent, who is in which channel, and how quickly people reply. We do not read, store, or process the content of messages that weren't sent to Peppr.
• Calendar details: meeting titles, who is invited, how long meetings run, and how often. We don't touch meeting notes, attachments, or recordings.
• Your answers to our preference questions. These describe how you prefer to work, for example whether you like to read before a meeting or talk it through. They are not a test, an assessment, or a diagnosis.

3. What we never do

• Read, store, or analyse messages that weren't sent to Peppr.
• Try to identify, screen for, or diagnose anyone as neurodivergent.
• Show a person's preferences to their manager or colleagues.
• Ask anyone to disclose a condition, diagnosis, or cognitive trait.
• Sell personal information.

4. What we use it for

• To reply to pilot requests and set up a call.
• To send the newsletter, if you asked for it. Every email has an unsubscribe link.
• To run Peppr: writing agendas, shaping meetings and messages, and adapting workflows based on team patterns and each person's preferences.
• To improve the product, using patterns across many teams with nobody identifiable.
• To tell you about Peppr, but only if you said yes to hearing from us.

5. Who owns the data

Your organisation's data belongs to your organisation. Your preference answers belong to you. We only hold it to run the service. We don't claim ownership of any of it.

If your organisation stops using Peppr, we delete everything tied to it within 30 days, unless the law requires us to keep something longer.

6. How we keep it safe

• Everything is encrypted, both while it moves and while it is stored.
• Only the people on our team who need access to do their job have it.
• We review the security of our systems and code regularly.
• Connections to Slack, Teams, and calendars use the providers' own secure sign-in (OAuth 2.0).

7. How long we keep it

• Pilot requests: as long as we need to follow up, then deleted within 12 months.
• Newsletter addresses: until you unsubscribe.
• Product data: for as long as your organisation uses Peppr, then deleted within 30 days.
• Anonymous usage data: kept, because it can't be linked back to anyone.

8. Other services we use

• Resend sends our emails, including the newsletter and form notifications.
• PostHog collects the anonymous website usage data.
• Vercel hosts the website.
• Slack, Microsoft, and Googleprovide the integrations, with your organisation's permission.

Each has its own privacy policy. We choose providers with strong data protection.

9. Your rights

Under the Privacy Act 2020 you can:

• Ask what personal information we hold about you.
• Ask us to correct it.
• Ask us to delete it.
• Tell us to stop contacting you.
• Complain to the Office of the Privacy Commissioner if you think we've got it wrong.

Email hey@peppr.io and we'll reply within 20 working days.

10. Cookies

The website uses only the cookies it needs to work, plus one from our analytics tool so it can tell visits apart. It doesn't identify you. No advertising or tracking cookies. If that changes, we'll update this page and ask first where the law requires it.

11. Data outside New Zealand

Some of the services above run outside New Zealand, including in the United States. Where data leaves the country we make sure it is protected to the standard the Privacy Act requires.

12. Children

Peppr is for workplaces. We don't knowingly collect information from anyone under 16. If we find we have, we delete it.

13. Changes

If we change this policy we'll post the new version here with a new date. If the change matters to you, we'll email you about it.

14. Contact

Questions about any of this? Email hey@peppr.io. Peppr Limited, New Zealand.