Customer data and privacy

For: business owners responding to customer data requests. Covers: customer data export and data retention.

Customer data export

You need data.export and access to the records. Owners, admins and accountants have export access by default. Custom roles can include it.

Open Customers.
Click Export.

Pepper downloads a CSV with customer fields only.

Pepper has no per-customer export of documents, payments or messages, and no anonymization action. To answer a data request, open the customer's page and the documents linked to it, and export the reports you need.

Data retention

Pepper does not automatically delete finalized invoices. You remain responsible for the retention rules that apply to your business.

Soft-deleted customers and documents remain in the database with a deleted_at timestamp. There is no maintenance command for permanent removal.

Optional external processing

Pepper includes owner controls for an optional TypeSafe provider. It is disabled by default.

The current connection test sends a fixed synthetic sentence, with no customer or invoice data. Customer-data features await independent evaluation and remain inactive.

Pepper encrypts the saved API credential. Saving provider settings clears optional decision history. Daily maintenance removes optional metadata older than 30 days. Financial documents keep their existing retention behavior.

The provider’s own terms govern received data. Disabling cannot retract an earlier disclosure. Pepper makes no zero-retention or data-residency promise.

See Configure optional suggestions for access, consent, limits, deletion and connection-test instructions.

Assistant conversations

The owner can enable a separate hosted generation provider: Anthropic, OpenAI or an OpenAI-compatible endpoint. Without configuration, no chat panel or generation request exists. Each person chooses an expiring grant within their current permissions and confirms every change. The provider receives messages, selected task instructions, tool definitions and permitted business results needed for the request.

Local display history starts off; the owner can select 7 or 30 days. Bounded operational confirmation and receipt state can remain eligible for recovery for up to 24 hours. Expired state is unavailable to readers; the next successful hourly cleanup removes its bytes. Keep the scheduler running. Usage counts and opaque started-action facts remain, and business records retain their own rules.

Use Delete conversation in the panel or Delete assistant history on Your profile. You can delete your own local history after a grant is revoked or the owner disables the provider. You cannot inspect or delete another person's conversations. Deletion preserves business records and charged usage. It cannot recall provider copies or copies in older backups.

Pepper encrypts saved provider keys and conversational state. It never returns the key to the browser. OpenAI requests disable response storage, but provider abuse-monitoring and other retention terms can still apply. Check your account's provider terms before enabling disclosure. See Assistant setup.

External client connections

Pepper provides owner-granted MCP and HTTP access. Both interfaces use the same permissions. Access starts off. The owner chooses an active staff delegate, permitted access and expiry. Guests cannot hold connections. Clients use a pasted credential or OAuth browser sign-in.

A client receives only the fields its tools and delegated user permit. Customer reads return active permitted IDs and names. Document reads include public lines, notes, exact totals and references. Internal notes, customer addresses and bank details stay outside those document responses.

People tools can disclose work email, job title, skills, teams, manager, time zone and weekly working hours. They exclude guests, private contact details, rates, time-off records and sign-in settings.

A client can prepare invoice drafts. Issuing needs the delegated person’s approval of each invoice, followed by client execution within the approval window (10 minutes from preparation unless the owner changes it). These tools send no email, record no payment and export no files.

The client can retain received records or send them to another service under its own settings and terms. Revocation stops later access. It cannot retract earlier copies.

Your server keeps connection metadata, credential hashes, draft attribution, request receipts, approval summaries, decisions and results. These records have no automatic deletion or pruning. A pasted credential appears once. Pepper keeps its hash, without plaintext in stored connection or audit data. OAuth clients manage access and refresh tokens.

See Connect an external client for grants, expiry, limits, review and revocation.

Booking records

The personal-data report includes explicitly linked booking answers, history, waitlist contact details, service messages and retained attachment versions.

A waitlist entry links to an enquiry in the same business. It does not create an offer membership or staff account.

Confirmed erasure clears personal answers and message contents, revokes visitor access and releases waiting-list holds. It prevents later retries of those messages.

The booking's time, state, accepted policy and exact price basis remain. Issued originals remain unchanged; attachments require their separate retention review.

An in-flight email may already have reached its destination. Erasure cannot recall it, and its delivery result stays uncertain.

The owner can open Personal-data request from the saved booking or connected enquiry. Read booking follow-up.

A case keeps the client's decision, consent statement and exact published version. Structured client details remain private until consent. Withdrawal stops their publication and future logo access. It cannot recall copies already downloaded.

A guide acknowledgement records which version the addressed recipient read and when they confirmed it. It grants no staff access and is not treatment consent or a signature.

Topic subscriptions require email verification and explicit consent. Each record keeps its statement, topic, version and time. Unsubscribe links stop pending messages; an attempt already underway may finish.

The privacy report includes these records within the operator's permitted scope. Subscriber email lookup does not create a lead or customer. Erasure removes the email and source facts, closes the subscription and clears pending mail payloads. The retained statement and withdrawal time preserve the consent history.

Private recipient links use an email-verified session restricted to the content reader. Public reading uses no visitor storage. Optional analytics still requires permission for each page load.

See cases and portfolios, business updates and guides for the visitor and manager steps.