Privacy policy

Who this applies to

This policy covers Pepperwire ("we", "us"), the publisher of the HubSpot Marketplace app Twilio SMS + Workflows, and everything at pepperwire.app — the website, the dashboard, the app inside HubSpot, and the services behind them.

It applies to two groups of people, and the difference matters:

• Customers — the businesses and staff who install the app and sign in to the dashboard. For their account data, we are the controller.
• Message recipients — the people your business texts, and who text you back. For their data, we are a processor acting on your instructions. Your own privacy policy governs why you hold their information; ours covers what we do with it while it passes through us.

What we collect, and why

When you install the app

When you connect Twilio

We deliberately never ask for your Twilio Auth Token — the master credential to your Twilio account. An API key can be revoked by you at any time from the Twilio Console without affecting anything else you run there.

When messages are sent or received

Message content is personal data, and sometimes sensitive. We treat it that way: it is never used for anything except delivering your messages, showing them to you, and supporting you when you ask us to look into a problem.

When you subscribe

We never see or store your card details. Checkout runs entirely on our payment provider's systems.

When you use the website or dashboard

We set one cookie, pw_session. It holds a signed token proving you signed in with HubSpot, it expires after seven days, and it is not readable by JavaScript. It exists so the dashboard knows who you are.

We do not use advertising cookies, tracking pixels, session recording, or third-party analytics on this site.

Our hosting provider keeps standard server logs — IP address, request path, timestamp, user agent — for security and diagnostics. Application errors are logged with enough context to fix them, deliberately without message content.

What we never do

• We never sell or rent personal data. There is no scenario in which we would.
• We never share your data for advertising, or with data brokers.
• We never use your messages, contacts, or HubSpot data to train machine learning or AI models — ours or anyone else's.
• We never access data outside the permissions you approved when you installed the app.
• We don't read your messages. Staff access is limited to what a specific support request requires, and only when you've asked us to look.

Our legal grounds for using it (GDPR)

Where we act as a processor on message-recipient data, you are responsible for having a lawful basis to contact those people — including the consent that US carriers require before you send business text messages.

Who else processes the data

We use a small number of vendors. Each is bound by contract to process data only on our instructions.

Two other services are involved, but as your providers, not ours:

• HubSpot — your CRM. We read and write there using the access you granted, under HubSpot's own terms and privacy policy.
• Twilio — your messaging carrier. You hold the account and the contract; message carriage happens under their terms and privacy policy.

We will update this list before adding a new sub-processor that handles personal data. To be told when that happens, email privacy@pepperwire.app.

International transfers

We are based in India and our infrastructure is primarily in the United States, so data about people in the EEA, the UK, or Switzerland is transferred internationally. Those transfers rely on the European Commission's Standard Contractual Clauses, together with the technical measures described below. A copy of the clauses is available on request.

How long we keep it

Uninstalling the app revokes our access to HubSpot immediately. It does not by itself erase what we already hold, so that you can reinstall without losing your message history.

To have everything erased, email privacy@pepperwire.app. We complete deletion within 30 days and confirm by email. Data already written to your HubSpot account — timeline entries, contacts, conversations — is yours and stays in your CRM; we can't delete it for you, and you can remove it in HubSpot at any time.

How we protect it

• Everything travels over TLS. Nothing about this service is available over plain HTTP.
• Your message content, Twilio API key secrets, and HubSpot refresh tokens are all encrypted with AES-256-GCM before they are written to the database. The encryption key is held only in our hosting provider's environment configuration — never in our source code, never in the database it protects. A copy of that database, on its own, contains no readable messages.
• We never write message content to our application logs, our error monitoring, or our product analytics. We record how long a message was, never what it said.
• The database rejects all access except from our server, using a credential that only the server holds. Row-level security is enabled with no public policies, so the browser-facing keys can read nothing at all.
• Every incoming webhook is signature-verified before it is acted on — HubSpot's v3 request signatures and per-account secrets on Twilio's callbacks — so a forged request can't inject or extract messages.
• We ask HubSpot for the narrowest set of permissions the features need, and nothing that would let us read your deals, emails, files, or reports.

No system is perfectly secure. If a breach ever affects your data, we will tell you and the relevant regulator without undue delay, and within the timeframes the law requires.

Your rights

If you're in the EEA, the UK, or Switzerland, you have the right to access your data, correct it, have it erased, restrict or object to how we use it, receive a portable copy, and complain to your data protection authority.

If you're a California resident, you have the right to know what we collect, to have it deleted, to correct it, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CPRA, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising any right.

To exercise any of these, email privacy@pepperwire.app from the address associated with your account. We respond within 30 days. If you're asking on behalf of someone we hold data about as a processor — a message recipient — please contact the business that texted them; we'll help that business respond.

Data processing agreement

If your organisation needs a signed data processing agreement, including the Standard Contractual Clauses, email privacy@pepperwire.app and we'll send one.

Children

This is a business product. It isn't directed at children, and we don't knowingly collect data from anyone under 16. If you believe a child's data has reached us, tell us and we'll delete it.

Changes to this policy

We'll update this page when what we do changes, and change the effective date at the top. For changes that materially affect your rights, we'll email account owners before they take effect.

Contact

Privacy questions and requests: privacy@pepperwire.app

Everything else: support@pepperwire.app