Privacy Policy

Effective date: August 2026

1. Who We Are

Zero Loop Labs Ltd ("we", "us", "our") is the data controller for the personal data described in this policy, processed through getpeppr and the getpeppr.dev website — see "Our role" below for where we act as a processor instead. We are registered in England & Wales, Company No. 17035492, and registered with the UK Information Commissioner's Office (ICO), registration reference ZC202770.

Zero Loop Labs Ltd
17 Heronsforde
London W13 8JE
United Kingdom
privacy@getpeppr.dev

Our role. For the data described in this policy — your account, billing, website, support, and newsletter data — we act as the data controller. For personal data contained in the invoices our customers send and receive through getpeppr (for example contact names of their counterparties), we act as a processor on the customer's behalf: the customer remains the controller of that data, and data-subject requests concerning invoice content should be addressed to the business that issued or received the invoice.

2. Data We Collect

2.1 Developer Accounts & API Usage

When you create an account and use the getpeppr API, we collect:

2.2 Live Chat

We use Crisp (Crisp IM SAS, France) to provide a live chat widget on our website and dashboard. Crisp may set cookies on your device to maintain chat sessions and remember conversation history. These cookies are functional and are not used for advertising or cross-site tracking.

2.3 Website Analytics & Monitoring

We use Vercel Web Analytics, a cookieless, privacy-friendly service that counts page views without advertising identifiers or cross-site tracking. We also use Sentry for error and performance monitoring on both the website and the console, including sampled, fully masked session replays (see section 5). We do not use Google Analytics or advertising trackers. Apart from the cookies set by Crisp for live chat functionality (see section 2.2), no tracking cookies are placed by the marketing website.

2.4 Peppol Identifier Verification (KYB / Trust Layer)

To comply with our obligations as an OpenPeppol-accredited Integrator (UK EDIRA scheme) and to prevent impersonation on the Peppol e-invoicing network, when you register a Peppol identifier that requires verification we verify it against the relevant public business registry:

The verification compares your declared company name to the registry's name and returns a verdict (match / mismatch / not found). We retain the verification record — the identifier, your declared company name, the verification status and date — for the lifetime of your account: removing an identifier from your dashboard marks it as removed but keeps its verification record, and the record is removed from our production database 30 days after account deletion. The Know-Your-Business evidence we keep alongside it is a minimised audit record — provider, verdict, similarity score, partially masked identifier, and verification metadata; the raw registry name and address are not stored. That evidence is kept for 6 years from the verification date — a period we align with the six-year limit for bringing a claim on a simple contract under the Limitation Act 1980, so we can establish and defend claims about who we admitted to the network. It is then purged by a monthly job, so it may persist for up to a further month (see section 7).

2.5 Newsletter

Our newsletter (the EU e-Invoicing Mandate Tracker, which also carries getpeppr product announcements) has two subscription channels:

Processor: We use Resend (Resend.com Inc., USA) to deliver emails. Email delivery data is governed by Resend's privacy policy and a Data Processing Agreement we have in place.

Retention: We retain your data while you are subscribed. If you unsubscribe, we keep your email address, your subscription status, and the signup evidence we hold (for website signups: the date, IP address, and browser of your most recent signup). The suppression record ensures we never email you again, and the signup evidence documents that consent (Article 7(1) UK GDPR). Both are kept until you request full erasure via privacy@getpeppr.dev.

You can unsubscribe at any time using the link in any newsletter email, or by emailing privacy@getpeppr.dev.

2.6 Business Prospect Contacts

We contact businesses that publish invoicing or business-management software, to introduce getpeppr. Where the details we use identify a person — a named work email address, for example — they are personal data that we did not obtain from that person directly. This section is the information notice required by Article 14 UK GDPR in that situation. We provide it, or a link to it, no later than the earliest of these three moments: one month after we obtain the details, our first message to you, and the first time we pass the details to anyone else — the deadlines set by Article 14(3)(a) to (c).

What we hold. The company name and its registration or VAT number, the name of its software product, the business contact details it publishes (email address, telephone number, website), the functional claims it publishes about that product — for instance whether it declares that it can send or receive electronic invoices — our own assessment of whether getpeppr is relevant to it, and a record of any message we send and any reply we receive.

Where it comes from (Article 14(2)(f)). The company details and the contact details we start from come from publicly accessible sources only: official government registers — such as the list of compliant e-invoicing applications published on the Belgian federal e-invoicing portal operated by the FPS Policy and Support (BOSA) at efacture.belgium.be — the public Peppol participant directory operated by OpenPeppol, and the company's own public communications, chiefly its website. Three things in the record do not come from those sources: our relevance assessment, which we produce ourselves; the messages we send, which we also produce ourselves; and any replies, which come from you directly. We do not buy contact lists, we do not use contact-enrichment services, and we do not collect personal data from private or access-restricted sources.

Why, and on what basis. Business-to-business prospecting, on our legitimate interests (Article 6(1)(f) UK GDPR) in offering a service to companies whose published activity indicates it may be useful to them. We have weighed that interest against the rights of the people concerned: the details are professional rather than private, the business published them so that it could be contacted, each message concerns that business's own stated activity, and every message carries a plain way to stop it.

Who we may write to. Being allowed to hold these details is not the same as being allowed to email them: that is governed by electronic-marketing law, which differs by country, and we apply the rules of the recipient's own country. Two tests matter in practice. Under the UK Privacy and Electronic Communications Regulations, sole traders and some partnerships count as individual rather than corporate subscribers, and we do not send to them without consent. In Belgium, Article XII.13 of the Code of Economic Law requires prior consent as the rule, and exempts only impersonal addresses at legal persons — so for Belgian recipients we write to generic addresses such as info@ or sales@ only, never to a named individual's address, unless we have consent. Publishing an address is not by itself consent to receive marketing, and we do not treat it as such.

Where it is held, and who else sees it. Prospect records are kept in a private version-controlled repository, which is mirrored to two hosts: LeaseWeb in the Netherlands and GitHub in the United States. They are also held in our mailboxes at Fastmail. Because the repository is version-controlled, earlier versions of a record stay readable in its history after the record itself is changed. Deleting a record therefore removes it from the current version, and we purge it from the history as well when you ask us to erase your details — that purge rewrites the repository, so we carry it out as a deliberate operation on request rather than automatically. We say so plainly because a policy that promised instant erasure from a version-controlled store would be promising something the storage cannot do. The research and drafting we do on these records uses Anthropic (Claude) and OpenAI (Codex), and we use Firecrawl to read the public pages of a company's website; each of these therefore processes the details too. Prospect records are not loaded into the getpeppr platform, they are not mixed with customer account data, and they are not shared with anyone beyond the processors named in section 5.

How to stop it. Reply “stop” to any message, or email privacy@getpeppr.dev. We add the business to a suppression list and do not contact it again. You may also object to this processing, or ask for erasure or a copy of what we hold, at any time (section 8). We will not ask you to justify an objection to direct marketing: that right is unconditional under Article 21(2) UK GDPR.

3. Legal Basis for Processing

4. How We Use Your Data

5. Third-Party Processors and Data Sources

We share data with trusted processors under Data Processing Agreements:

For Peppol identifier verification (section 2.4) and Peppol directory lookups we additionally query business registries and directories operated by independent data controllers. We transmit the identifier being verified (or, for directory searches, the name or identifier you search for); for sole traders these values can themselves be personal data:

The prospect data described in section 2.6 is held in a private repository mirrored to LeaseWeb and GitHub, researched and drafted with Anthropic and OpenAI, enriched from public web pages via Firecrawl, delivered by Resend, and stored as correspondence in Fastmail — all listed above. We do not use contact-enrichment or list-broking services, and we do not buy contact data.

We do not sell your personal data to third parties.

6. International Transfers

Some processors are located outside the UK/EEA (for example Clerk, Stripe, PandaDoc, Resend, Vercel, Sentry, Cloudflare, GitHub, Slack, Fastmail, and — for prospect research under section 2.6 — Anthropic, OpenAI, and Firecrawl). Where data is transferred internationally, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (where this policy mentions Standard Contractual Clauses for a processor, they are implemented together with the UK Addendum), or the UK Extension to the EU-US Data Privacy Framework where the processor is certified. Where a processor offers UK or EU data residency, we use it: our database is hosted in London, Sentry event data is stored in Germany, and database backups are stored under EU jurisdiction.

7. Data Retention

8. Your Rights

Under UK GDPR, you have the right to:

If we have contacted you as a business prospect (section 2.6), your right to object is unconditional: we stop on request, without asking for a reason, because the processing is direct marketing (Article 21(2) UK GDPR). You may also ask us to confirm where we obtained your details; section 2.6 sets out the sources we use.

To exercise any right, email privacy@getpeppr.dev. We will respond within 30 days.

Complaining to us. You have the right to complain directly to us if you believe we have infringed your data protection rights (section 164A of the Data Protection Act 2018, in force since 19 June 2026). Write to privacy@getpeppr.dev with “complaint” in the subject line, or by post to the address in section 1. We will acknowledge your complaint within 30 days of receiving it, look into it, and tell you the outcome. You do not have to complain to us first: you may go straight to the ICO.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority.

9. Security

We implement appropriate technical and organisational measures including TLS encryption in transit, SHA-256 hashing of API keys, rate limiting keyed on pseudonymised IP addresses, encrypted off-site backups, and access controls. No method of transmission over the internet is 100% secure.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email (to registered users) or a notice on this page. Continued use of the service after changes constitutes acceptance.

11. Contact

Questions about this policy? Email us at privacy@getpeppr.dev.