Privacy Policy

Effective date: October 2026

1. Who We Are

Zero Loop Labs Ltd ("we", "us", "our") is the data controller for the personal data described in this policy, processed through getpeppr and the getpeppr.dev website — see "Our role" below for where we act as a processor instead. We are registered in England & Wales, Company No. 17035492, and registered with the UK Information Commissioner's Office (ICO), registration reference ZC202770.

Zero Loop Labs Ltd
17 Heronsforde
London W13 8JE
United Kingdom
privacy@getpeppr.dev

Our role. For the data described in this policy — your account, billing, website, support, and newsletter data — we act as the data controller. For personal data contained in the invoices our customers send and receive through getpeppr (for example contact names of their counterparties), we act as a processor on the customer's behalf: the customer remains the controller of that data, and data-subject requests concerning invoice content should be addressed to the business that issued or received the invoice.

2. Data We Collect

2.1 Developer Accounts & API Usage

When you create an account and use the getpeppr API, we collect:

We also keep internal research notes about the business behind an account, from sources other than you. That is a separate matter with its own legal basis, and section 2.7 sets it out.

2.2 Support Correspondence

We answer support questions by email. When you write to hello@getpeppr.dev or support@getpeppr.dev, we process your email address, the name you sign with, and the content of your message, so that we can answer you and keep a record of what was asked and what we replied. That correspondence is hosted in Proton Mail (section 5).

We no longer run a live chat widget. No chat provider is loaded on this website or in the console, so nothing new is written to your device for one and no new conversation reaches one. We used Crisp (Crisp IM SAS, France) until 19 September 2026.

Two things remain true after that date, and we would rather say them than imply otherwise. Crisp still holds the conversations it received before it, and our internal Slack workspace still holds the copies that were relayed there, until we have both deleted — so section 5 still lists them as recipients of that earlier data. And if you opened the chat before that date, the cookie and browser storage Crisp placed then remain in your browser until you clear them: removing the widget stops anything from writing to or reading them, it does not reach into your browser to erase them. You can clear them yourself through your browser's site-data settings for this site.

2.3 Website Analytics & Monitoring

We use Vercel Web Analytics on the website and in the console — a cookieless service that counts page views without advertising identifiers or cross-site tracking. For each page view it records the page address, the approximate location derived from the network address, and the browser and operating system; the page you arrived from is recorded on the first page view of a visit. In the console, we replace document identifiers with route templates and remove search parameters and fragments before sending page views. The console sends only the origin in HTTP referrers; we omit analytics events when the referring page address contains a path or search information that cannot be removed. We also use Sentry for error and performance monitoring on both the website and the console. We do not use Google Analytics or advertising trackers, and no tracking cookies are placed by the marketing website.

The basis for each of these. Page-view statistics rely on paragraph 5 of Schedule A1 to the Privacy and Electronic Communications Regulations, which permits measurement to improve a service without consent — provided we tell you clearly, do not share the data beyond that purpose, and give you a simple, free way to object. That way is the control below. Error monitoring relies on paragraph 4, which names detecting technical faults. We record no sampled session replays. Sentry captures a replay only around an error, with all text, inputs and media masked in your browser before anything is sent.

Object to usage statistics

Loading your current choice…

Your choice is stored in this browser as a single cookie holding nothing but the choice itself, and it covers both getpeppr.dev and the console. It takes effect on the next page you load. Clearing your browser storage clears it too.

2.4 Peppol Identifier Verification (KYB / Trust Layer)

To comply with our obligations as an OpenPeppol-accredited Integrator (UK EDIRA scheme) and to prevent impersonation on the Peppol e-invoicing network, when you register a Peppol identifier that requires verification we verify it against the relevant verification source:

Where the verification source returns a company name, we compare it with the name you declared. Some schemes validate only the identifier, while unavailable or unsupported automatic paths may require review. We retain the resulting verification record — the identifier, your declared company name, the verification status and date — for the lifetime of your account: removing an identifier from your dashboard marks it as removed but keeps its verification record, and the record is removed from our production database with the rest of your account data after account deletion (section 7). The Know-Your-Business evidence we keep alongside it is a minimised audit record — provider, verdict, similarity score, partially masked identifier, and verification metadata; the raw registry name and address are not stored. That evidence is kept for 6 years from the verification date — a period we align with the six-year limit for bringing a claim on a simple contract under the Limitation Act 1980, so we can establish and defend claims about who we admitted to the network. It is then purged by a monthly job, so it may persist for up to a further month (see section 7).

2.5 Newsletter

Our newsletter (the EU e-Invoicing Mandate Tracker, which also carries getpeppr product announcements) has two subscription channels:

Processor: We use Resend (Plus Five Five, Inc., USA) to deliver emails. Email delivery data is governed by Resend's privacy policy and a Data Processing Agreement we have in place.

Retention: We retain your data while you are subscribed. If you unsubscribe, we keep your email address, your subscription status, and the signup evidence we hold (for website signups: the date, IP address, and browser of your most recent signup, or of its confirmation if you had unsubscribed before). The suppression record ensures we send you no further newsletter. The only email that can still reach that address is a confirmation link, sent if someone submits it on our signup form again; it changes nothing unless you confirm it. The signup evidence documents that consent (Article 7(1) UK GDPR). Both are kept until you request full erasure via privacy@getpeppr.dev.

You can unsubscribe at any time using the link in any newsletter email, or by emailing privacy@getpeppr.dev.

2.6 Business Prospect Contacts

We contact businesses that publish invoicing or business-management software, to introduce getpeppr. Where the details we use identify a person — a named work email address, for example — they are personal data that we did not obtain from that person directly. This section is the information notice required by Article 14 UK GDPR in that situation. We provide it, or a link to it, no later than the earliest of these three moments: one month after we obtain the details, our first message to you, and the first time we pass the details to anyone else — the deadlines set by Article 14(3)(a) to (c).

What we hold. The company name and its registration or VAT number, the name of its software product, the business contact details it publishes (email address, telephone number, website), the functional claims it publishes about that product — for instance whether it declares that it can send or receive electronic invoices — our own assessment of whether getpeppr is relevant to it, and a record of any message we send and any reply we receive.

Where it comes from (Article 14(2)(f)). The company details and the contact details we start from come from publicly accessible sources only: official government registers — such as the list of compliant e-invoicing applications published on the Belgian federal e-invoicing portal operated by the FPS Policy and Support (BOSA) at efacture.belgium.be — the public Peppol participant directory operated by OpenPeppol, and the company's own public communications, chiefly its website. Three things in the record do not come from those sources: our relevance assessment, which we produce ourselves; the messages we send, which we also produce ourselves; and any replies, which come from you directly. We do not buy contact lists, we do not use contact-enrichment services, and we do not collect personal data from private or access-restricted sources.

Why, and on what basis. Business-to-business prospecting, on our legitimate interests (Article 6(1)(f) UK GDPR) in offering a service to companies whose published activity indicates it may be useful to them. We have weighed that interest against the rights of the people concerned: the details are professional rather than private, the business published them so that it could be contacted, each message concerns that business's own stated activity, and every message carries a plain way to stop it.

Who we may write to. Being allowed to hold these details is not the same as being allowed to email them: that is governed by electronic-marketing law, which differs by country, and we apply the rules of the recipient's own country. Two tests matter in practice. Under the UK Privacy and Electronic Communications Regulations, sole traders and some partnerships count as individual rather than corporate subscribers, and we do not send to them without consent. In Belgium, Article XII.13 of the Code of Economic Law requires prior consent as the rule, and exempts only impersonal addresses at legal persons — so for Belgian recipients we write to generic addresses such as info@ or sales@ only, never to a named individual's address, unless we have consent. Publishing an address is not by itself consent to receive marketing, and we do not treat it as such.

Where it is held, and who else sees it. Prospect records are kept in a private version-controlled repository, which is mirrored to two hosts: LeaseWeb in the Netherlands and GitHub in the United States. They are also held in our mailboxes at Proton Mail. Older mailbox copies may remain with our former provider, Fastmail, until their deletion is confirmed (section 5). Because the repository is version-controlled, earlier versions of a record stay readable in its history after the record itself is changed. Deleting a record therefore removes it from the current version, and we purge it from the history as well when you ask us to erase your details — that purge rewrites the repository, so we carry it out as a deliberate operation on request rather than automatically. We say so plainly because a policy that promised instant erasure from a version-controlled store would be promising something the storage cannot do. The research and drafting we do on these records uses Anthropic (Claude), which also reads the public pages of a company's website for us; it therefore processes the details too. Prospect records are not loaded into the getpeppr platform, they are not mixed with customer account data, and they are not shared with anyone beyond the providers named in section 5.

How to stop it. Reply “stop” to any message, or email privacy@getpeppr.dev. We add the business to a suppression list and do not contact it again. You may also object to this processing, or ask for erasure or a copy of what we hold, at any time (section 8). We will not ask you to justify an objection to direct marketing: that right is unconditional under Article 21(2) UK GDPR.

2.7 Research on Account Holders

When a business signs up, we look into who it is. We check whether it already exchanges electronic invoices and through which provider, what its national business registry says about it, and whether the person who registered has a public professional profile. We do this to tell a real business from a throwaway signup, to know before we answer whether getpeppr fits the case at all, and to avoid asking you questions we could answer ourselves.

Where these details identify a person — the name of a director published by a registry, for example — they are personal data that we did not obtain from that person directly. This section is the information notice that Article 14 UK GDPR requires in that situation, and it covers research we have carried out on existing accounts as well as research we carry out from now on.

Where it comes from. Public national business registries (section 2.4 lists the ones we query), the public Peppol directory, the company's own website, and public professional profiles. We do not buy data, we do not use data brokers, and we do not look into anything outside a professional context.

What we write down, and where. A short dated note per piece of research, written in our own words: what the business does, its position on the Peppol network, what the registry says, and whether our product covers its case. Each note is kept alongside the account it concerns, in our own database (section 5 gives its location), and is readable only by us — it is never shown to you in the product and never published, and it is shared with no one other than the assistant named below. A note records facts and our assessment of fit; it is not a judgement about a person. The assistant named in section 5 (Anthropic) helps us research and write these notes, so the details in them are processed by that provider for that purpose.

How long. For as long as the account exists. The notes are erased together with the account and its other data, on the same schedule as section 7 sets out for account data. There is no separate archive of them.

Our basis, and your say. We rely on legitimate interests (Article 6(1)(f) UK GDPR): knowing who our customers are, and whether the service suits them, is a normal part of running it, and the details we use are ones the business or the registry already publishes. You can ask for a copy of what we hold, ask us to correct it, or object to this processing entirely, at privacy@getpeppr.dev (section 8). If you object, we delete the notes and stop keeping them for your account; this has no effect on your account or your access to the service.

2.8 Peppol Authorisation Contacts (Platform Sub-tenants)

Some of our customers are platforms: software providers that register their own customers on the Peppol e-invoicing network through getpeppr. Before we register a business, the person acting for that business has to confirm to us, not to the platform, that they are authorised to use its Peppol identifier. We ask for that confirmation by email, at an address the platform gives us, and the platform cannot give it on its customer's behalf. If you have received such an email from us, this section is the information notice that Article 14 UK GDPR requires when personal data has not been obtained from the person it concerns, and it is addressed to you.

Who we are in this relationship. Zero Loop Labs Ltd, the company in section 1. For this record we are an independent controller — we are not acting as the platform's processor, even though the platform is our customer and sent us your address. The evidence is our own proof that we were entitled to make the registration, so the platform cannot instruct us to alter it, to keep it, or to delete it, and your rights over it are exercised with us directly rather than through the platform.

Where your details come from (Article 14(2)(f)). From the platform, not from you. It gives us the email address to write to, the legal name of the business you act for, and the Peppol identifier it wants registered for that business; we ask the platform to tell its customer that it has done so. We do not buy contact details, we use no contact-enrichment service, and we do not look you up anywhere else for this purpose.

What we record, and when. Your email address is recorded when the request is sent, before you have done anything at all — it has to be, because it is where the email goes. Nothing else about you is recorded unless you press the confirmation button. If you do, we additionally record the IP address the confirmation came from, the moment it happened, the language you confirmed in and a fingerprint (a SHA-256 hash) of the exact wording shown to you. The version and the language of the attestation wording you are asked to agree to, and our internal reference to the Terms between us and the platform, are fixed and stored when the request is sent rather than when you answer it. Confirming ties you to that wording only: our Terms bind us and the platform, and confirming does not make the business you act for a party to them. Alongside it we keep what the confirmation was about: the legal name of the platform, the legal name of the business, and the Peppol identifier registered. Your name is not stored against this evidence — where the platform gives it to us we use it to address the email to you, and nothing keeps it afterwards. We do not record your browser or your device.

Why we do it. Three purposes, and no others: to operate our Peppol access point, which may not put a business on the network unless someone authorised for it has said so; to prevent fraudulent registrations, which is the harm this whole step exists to stop — without it, anyone could ask us to route invoices in a company's name; and to establish or defend legal claims about a registration we made, whether the claim comes from you, from the business, or from the network. We do not use these details to market anything to you, and we do not pass them to anyone beyond the providers in section 5.

Our lawful basis. Legitimate interests (Article 6(1)(f) UK GDPR): running an access point that can show, for every identifier it routes, who authorised it. We have weighed that against your rights. The details are professional rather than private, they are the minimum that the act of confirming requires, we build no profile of you from them, and you are told about the processing in the same message that asks for the confirmation. We do not rely on Article 6(1)(c): the duties that require this check come from our OpenPeppol Integrator agreement, which is contractual rather than statutory.

How long we keep it, and why. Confirmed evidence outlives the platform's own account with us — it has to, because a claim about a registration can arise long after the platform has stopped being our customer — and it is kept for 6 years: We keep the evidence of a Peppol authorisation for as long as the registration it authorises is active, and then for six years — the period in which a claim about that authorisation can still be brought under the Limitation Act 1980. If the platform account is deleted while we still record that registration as active, the period instead runs from the deletion of the account. A request that is never confirmed evidences nothing, and is deleted twelve months after it expires. Your IP address goes sooner than the rest. We erase it 12 months after you confirm, from the live record and from the copy that outlives the platform's account alike. It answers one question — whether the confirmation came from somewhere plausible at the time — and that is a fraud-prevention question with a short useful life; the evidence that you gave the authorisation at all does not depend on it, and one period applied to unlike fields would not be data minimisation.

If you do nothing. Nothing happens: the link stops working on its own and no business is registered on your authority. We send no reminder of our own, although the platform can ask us to send the request again, in which case you receive a fresh email from us. A request you never confirmed never becomes evidence of anything — it is deleted on the schedule set out just above, together with the address we wrote to.

Your rights, and how to object. You may object to this processing at any time, and ask us for a copy of what we hold about you, for it to be corrected, for it to be erased, or for the processing to be restricted, at privacy@getpeppr.dev (section 8). Because we rely on legitimate interests, that right to object is real but not unconditional: we will stop unless we have compelling legitimate grounds to continue, or need the evidence to establish or defend a legal claim. Where the registration you authorised is still live, the second of those will usually apply, and we will say so and explain why rather than leave you to guess. You may also complain to us (section 8) or to the Information Commissioner's Office.

3. Legal Basis for Processing

4. How We Use Your Data

5. Third-Party Processors and Data Sources

We share data with the service providers below. For each of them, a document setting out its role (our processor, or an independent controller), where it processes data and the safeguard that applies to transfers outside the UK, together with a copy of that safeguard where one applies (for example the Standard Contractual Clauses and the UK Addendum), is available on request at privacy@getpeppr.dev.

For Peppol identifier verification (section 2.4) and Peppol directory lookups we additionally query business registries and directories operated by public authorities and independent providers. We transmit the identifier being verified (or, for directory searches, the name or identifier you search for); for sole traders these values can themselves be personal data:

The prospect data described in section 2.6 is held in a private repository mirrored to LeaseWeb and GitHub, researched and drafted with Anthropic, which also reads public web pages for us, delivered by Resend, and stored as correspondence in Proton Mail — all listed above. We do not use contact-enrichment or list-broking services, and we do not buy contact data.

The account notes described in section 2.7 are held somewhere else and are a different thing: they sit in our own database at Neon, alongside the account they concern, and they are covered by the same backups and the same deletion as the rest of that account. They are researched and written with the assistant named above (Anthropic), which also reads public pages for us, and they are not copied into the prospect repository above.

Former mail provider: we stopped using Fastmail for incoming mail in September 2026. We have not yet confirmed deletion of older mailbox copies and backups held by Fastmail Pty Ltd (Australia, with US infrastructure). Its DPA provides EU Standard Contractual Clauses; a UK Addendum was not in place. Our switch to Proton Mail does not resolve that historical gap.

We do not sell your personal data to third parties.

6. International Transfers

Some providers are located outside the UK/EEA (for example Clerk, Stripe, PandaDoc, Resend, Vercel, Sentry, Cloudflare, GitHub, Slack, Proton AG and OpenAI). The safeguards we use for these transfers are UK adequacy regulations (which cover, for example, the EEA and Switzerland), the UK Extension to the EU-US Data Privacy Framework where the provider is certified, the UK International Data Transfer Agreement (IDTA), and the EU Standard Contractual Clauses with the UK Addendum. Which one applies to each provider, and where a safeguard is still being put in place, is set out in the document described in section 5, which we send on request together with a copy of the safeguard concerned. For Proton Mail storage in Switzerland, Germany and Norway, we rely on UK adequacy regulations. Part of our data stays in the UK or the EU: our database is hosted in London, our cache in Ireland, Sentry event data in Germany, and database backups under EU jurisdiction. Other processing takes place in the United States, including our API and console functions, which run on Vercel in Washington, D.C.

7. Data Retention

8. Your Rights

Under UK GDPR, you have the right to:

If we have contacted you as a business prospect (section 2.6), your right to object is unconditional: we stop on request, without asking for a reason, because the processing is direct marketing (Article 21(2) UK GDPR). You may also ask us to confirm where we obtained your details; section 2.6 sets out the sources we use.

To exercise any right, email privacy@getpeppr.dev. We will respond within 30 days.

Complaining to us. You have the right to complain directly to us if you believe we have infringed your data protection rights (section 164A of the Data Protection Act 2018, in force since 19 June 2026). Write to privacy@getpeppr.dev with “complaint” in the subject line, or by post to the address in section 1. We will acknowledge your complaint within 30 days of receiving it, look into it, and tell you the outcome. You do not have to complain to us first: you may go straight to the ICO.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority.

9. Security

We implement appropriate technical and organisational measures including TLS encryption in transit, SHA-256 hashing of API keys, rate limiting keyed on pseudonymised IP addresses, encrypted off-site backups, and access controls. No method of transmission over the internet is 100% secure.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email (to registered users) or a notice on this page. Continued use of the service after changes constitutes acceptance.

11. Contact

Questions about this policy? Email us at privacy@getpeppr.dev.