Privacy Policy

1.Who we are and what this policy covers#

Demirius Ltd, trading as My-Pepts, is the controller of the personal data this policy describes. That means we decide why and how it is used, and we are the ones you can hold to this policy.

Company

Demirius Ltd, trading as My-Pepts

Registered in

England and Wales

Company number

16820023

Registered office

47 Cranwell Crescent, Eaton Leys, Milton Keynes, MK17 9GS, England

VAT number

GB 505 3821 14

Email

hello@my-pepts.com

This policy covers:

• people who visit my-pepts.com;
• people who sign up for My-Pepts or use its account dashboard or a store admin, including lab owners and the staff they invite;
• people who contact us, or buy a service from us such as a branding package.

For anything about your data, including a request to see or delete it, email hello@my-pepts.com. We are a small company and are not required to appoint a Data Protection Officer, so requests are handled by us directly.

2.If you shop at a lab's store#

Each store on My-Pepts is run by an independent lab, which is the seller and the controller of the personal data it collects from its shoppers. We host and run the software for the lab, as its processor, under our Data Processing Agreement. The lab's own privacy notice, on its store, explains what it does with your data.

To make a request about data a store holds about you, contact the lab that runs it. If you write to us instead, we pass your request to the lab and tell you we have done so.

We act as a controller for a few purposes that span every store: protecting the Platform from attacks, fraud and abuse, for which we use technical data such as IP addresses and request logs, and responding to lawful requests from authorities. This policy covers that use.

3.What we collect#

• When you visit my-pepts.com: what our hosting provider records with each request, which is your IP address, browser and device type, the page requested, the page that linked to it, and the time. We do not use analytics or advertising cookies on my-pepts.com.
• When you sign up: your name, email address and password (stored only as a salted hash, so nobody here can read it), and your business's name, address and country, its company and VAT or tax numbers where it has them, and the store address you choose.
• When you pay: your billing name, address and email, your plan and your invoices. Your card details go straight to Stripe; we receive only the card brand, the last four digits, the expiry date and whether the payment succeeded.
• If we verify your business: the documents and information we ask for, such as company registration documents, proof of address, the address you ship from and the payment provider you use.
• When you use your account dashboard or store admin: sign-in records (time, IP address and browser), the actions we log for security and support (such as changing plan, inviting staff or creating an API key), and how much of your plan's limits you use.
• When you invite staff: their name, email address and role. If you are a member of staff, your lab gave us these.
• When you use AI features: what you send to the feature and what it returns.
• When you connect another service: the identifiers and access tokens needed to connect it, such as your Google Ads customer ID. Access tokens are stored encrypted.
• When you buy a domain through us: the registrant details the registry requires (name, organisation, postal address, email and phone number). We pass them to our registrar partner and the registry, and the registry's rules may require some of them to appear in the public registration database.
• When you order a branding package: your brief, the files you share and our correspondence about the work.
• When you contact us: your message, your contact details and our reply.
• If you ask to hear from us: your email address and the record of when you agreed.

We do not ask for special category data, such as anything about health, ethnicity, beliefs or sexuality. Please do not send it to us.

4.Why we use it, and our lawful basis#

UK GDPR requires a lawful basis for each use of personal data. Here they all are.

Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that it is not overridden: each use is narrow and expected. You can object to any of them, and we will stop unless we have compelling grounds to continue. See your rights.

5.Marketing#

We send news and offers by email only to people who have opted in, and every message has a one-click unsubscribe. Service emails about your account, billing or security are not marketing, and you receive them for as long as you have an account.

6.Cookies#

my-pepts.com uses only the cookies it needs to work, such as the one that keeps you signed in, and the ones our payment provider sets on checkout pages to prevent fraud. We do not use analytics or advertising cookies; if we ever do, they will be off until you agree to them. The full list is in our Cookie Policy.

7.Who we share it with#

• Our sub-processors, the providers that host, store, email, bill and provide AI features for us (currently Vercel, Neon, Hetzner, Amazon Web Services, Resend, Stripe, Anthropic and Google), under contracts that require them to protect the data and use it only on our instructions. What each one does, and where, is on our Sub-processors page.
• Stripe, for our billing, is also a controller of some payment data for its own purposes, such as preventing fraud and meeting its regulatory duties, under its own privacy policy.
• Google, only if you connect your Google Ads account, under your own agreement with Google.
• Domain registrars and registries, for a domain you buy through us.
• Our professional advisers, such as accountants, lawyers and insurers, who are bound to keep it confidential.
• Authorities, such as HMRC, regulators, courts and the police, where the law requires it, or where it is needed to establish or defend a legal claim or to prevent fraud.
• A buyer of our business, if the business is ever sold or transferred, under this policy, and we would tell you.

We never sell personal data.

8.Where your data goes#

We keep account data in the United Kingdom (London). Each lab's store, with its own database, files and backups, is hosted in the European Union (Germany or Finland) by default, or the United States for a store hosted there. Some of our providers are based in the United States or process data there, including Vercel, Hetzner, Amazon Web Services, Resend, Stripe, Anthropic and Google, as the Sub-processors page shows. We would rather say that plainly than describe the stack as if it were all local.

When personal data leaves the UK, we rely on a safeguard UK data protection law allows: UK adequacy regulations (which cover the EEA, among others), the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask us for a copy of the safeguard that applies to a particular provider.

9.How long we keep it#

We keep personal data only as long as we have a reason to, and then delete it. A fixed period runs from when the reason for keeping the data ends: the account closing, the conversation ending, or the financial year closing.

Store Data, including shoppers' personal data, belongs to the lab and follows the timetable in our Terms of Service: available to export for 30 days after a subscription ends, deleted from live systems within 30 days after that, and its backups deleted or made permanently unreadable within 35 days after that.

10.How we protect it#

• Everything is served over HTTPS, and our database provider encrypts account data at rest.
• Passwords are stored only as salted hashes, so a forgotten password is reset, never recovered.
• Card details never reach our servers: Stripe handles them.
• Each lab's store runs as its own deployment with its own database, so one store cannot read another's data.
• Access to production systems is limited to the people who run the Platform, and protected by multi-factor authentication.
• Credentials and keys are kept in our providers' secret stores, never in source code.

No system is perfectly secure. If a breach puts your rights at risk, we will tell the Information Commissioner's Office within 72 hours of finding out, and tell you without undue delay where the risk to you is high.

11.Your rights#

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you, and tell you what we do with it;
• correct anything inaccurate or incomplete (much of it you can edit yourself in your account);
• delete it, where we no longer need it. We cannot delete billing records before the period tax law sets, and we will say so rather than pretend otherwise;
• restrict how we use it while a dispute about it is resolved;
• object to any use we base on legitimate interests, and to marketing at any time;
• move the data you gave us to another service, in a machine-readable format;
• withdraw consent where we rely on it. Withdrawing does not undo what was lawful before.

Email hello@my-pepts.com. We complete a request within one month, which the law lets us extend by up to two further months for a complicated one. There is no charge. We may ask you to confirm your identity, and we ask only for what we need to be sure.

12.Complaints#

If you are unhappy with how we have handled your data, tell us first at hello@my-pepts.com. We acknowledge a complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the UK's data protection regulator at any time: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113, ico.org.uk/make-a-complaint.

13.Children, automated decisions and changes#

Children. My-Pepts is for businesses and is not for anyone under 18. We do not knowingly collect data about children; if you think we have, tell us and we will delete it.

Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. A person reviews every decision to refuse, suspend or close an account.

Changes. We update this policy when what we do changes, and the date at the top is the date it last changed. If a change is significant, we email account holders rather than relying on you to check.