Privacy Policy

PepperLedger is operated by Sprout Financial Inc., a corporation incorporated under the laws of Ontario, Canada, doing business as Realee AI. Contact us at hello@realee.ai.

For the purposes of this Privacy Policy, Sprout Financial Inc. is the data controller — we determine the purposes and means of processing your personal information. Our Privacy Officer is reachable at hello@realee.ai.

PepperLedger is an educational logging and information tool. It does not provide medical advice, diagnose conditions, or prescribe treatment.

This policy applies to residents of Canada (PIPEDA; Quebec Law 25), the United States (CCPA/CPRA for California residents), and other North American jurisdictions.

We collect the information you provide directly:

• Account information — email address, username, password (stored hashed and encrypted — never in plain text)
• Protocol data — compounds, doses, frequencies, cycle dates, inventory, schedules, and notes you enter
• AI Coach conversations — your messages to and responses from the Coach
• Payment information — billing details submitted at checkout (processed and stored by Stripe — we do not store your full card number)
• Support communications — emails or messages you send to hello@realee.ai

We also collect information automatically:

• Usage data — features used, pages visited, session duration, interaction events (via PostHog)
• Device information — browser type, operating system, IP address
• Authentication tokens — session and login tokens managed by Clerk

Your protocol logs may contain health-adjacent information about compounds you personally use. We treat this data with heightened care and do not knowingly collect clinical health records.

Your protocol data is used to:

• Power the AI Coach — your history is the Coach's context
• Surface your logs, inventory, and history in the app
• Generate exports when you request them (Pro)
• Process your subscription and send billing-related communications
• Improve the Service using anonymized, aggregated data that cannot identify you
• Respond to support requests and maintain Service security
• Comply with legal obligations

We do not sell your data. We do not share your data for advertising purposes. We do not use your personal protocol data to train AI models — only anonymized, de-identified aggregate data is used for product improvement.

We share your personal information only with the following trusted third-party service providers. Each processes data only as necessary to provide their specific service.

AI Coach conversations are routed through OpenRouter's Zero Data Retention (ZDR) API — OpenRouter does not retain your message content after the API response is returned. API-tier inference providers do not use your data to train their general models.

You can request access to, correction of, or deletion of your data at any time by contacting hello@realee.ai. We will respond within 30 days.

Pro users can export their full ledger as CSV from within the app at any time.

We retain your data as long as your account is active. On account deletion:

• Account data — protocol logs, AI Coach history, profile information — is permanently deleted within 30 days of your deletion request
• Stripe may retain billing and transaction records as required by tax law (typically 7 years)
• Anonymized, de-identified aggregate data that cannot identify you may be retained indefinitely
• Data subject to a legal hold may be retained until that matter is resolved

We implement appropriate technical and organizational security measures:

• Encrypted data transmission over all connections (TLS/HTTPS)
• Encrypted database storage (managed by Convex)
• Access controls limiting employee access on a need-to-know basis
• Authentication managed by Clerk, a purpose-built authentication platform

No security system is 100% effective. In the event of a security incident affecting your personal information, we will notify you at your registered email address and applicable regulatory authorities (Office of the Privacy Commissioner of Canada; California Privacy Protection Agency; Commission d'accès à l'information for Quebec residents) as required by law, including PIPEDA's mandatory breach reporting requirements.

We use authentication cookies (Clerk) required for login and session management, and analytics tracking (PostHog) to understand how the Service is used. We do not use advertising cookies, cross-site tracking, or third-party behavioral tracking technologies. You may opt out of analytics tracking by contacting hello@realee.ai.

PepperLedger operates from Canada. Our service providers may process your data in the United States. Where data is transferred internationally, we rely on contractual safeguards with each provider and their published security certifications (SOC 2 Type II, ISO 27001, or equivalent).

We may update this policy from time to time. For material changes, we will notify you by email at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance.

Questions about this policy? Email hello@realee.ai.

For unresolved privacy complaints: Office of the Privacy Commissioner of Canada at priv.gc.ca · Commission d'accès à l'information at cai.gouv.qc.ca · California Privacy Protection Agency at cppa.ca.gov.

Sprout Financial Inc. operating as Realee AI · No physical address is published · hello@realee.ai