Privacy Policy
Last updated: June 11, 2026
This Privacy Policy explains how Zen National Corporation (“Peppaca”, “we”), which operates the Peppaca Store marketplace, collects, uses, shares, and protects your personal information. The data controller is Zen National Corporation, 1141 Ringwood Court Ste 160, San Jose, CA 95131, USA.
1. Information we collect
- Account information — email, name/display name, password (stored hashed) or Google sign-in identifier.
- Maker information — shop details, listings, and your connected PayPal email (used to receive payments).
- Order information — items purchased, shipping address, order status. Card/PayPal payment details are handled by PayPal, not stored by us.
- Content — reviews, product text, and images you upload.
- Usage & device data — basic technical information needed to operate, secure, and improve the Service.
2. How we use it & legal bases
We use your information to: create and secure your account; display listings and translate them into buyers’ languages; process and route orders; send transactional and notification emails; provide reviews; and improve, support, and protect the Service. Where the EU/UK GDPR applies, our legal bases are performance of our contract with you, our legitimate interests in operating and securing the marketplace, your consent (e.g. for certain notifications), and compliance with legal obligations.
3. Service providers we share with
- PayPal — to process payments directly between Buyers and Makers.
- Cloudinary — to host and deliver product images.
- Resend — to send transactional and notification emails.
- Supabase — database hosting (servers located in Japan).
- Translation providers (DeepSeek, Google) — to translate listing text.
These providers may process your information only to provide services to us. We may also disclose information to comply with law or to protect rights, safety, and the integrity of the Service.
4. We do not sell your personal information
We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law.
5. Cookies & local storage
We use your browser’s local storage and similar technologies to keep you signed in and to remember your cart and language preference. These are essential to the Service. We do not use third-party advertising trackers.
6. Marketing & notification emails
We send transactional emails (e.g. order confirmations) that are necessary to provide the Service. We also send optional emails — for example, “new drop” alerts for makers you follow. You can stop those at any time by unfollowing the maker or using the unsubscribe option in the email.
7. Data retention
We keep your information for as long as your account is active and as needed to provide the Service, comply with legal and tax obligations, resolve disputes, and enforce our agreements. When no longer needed, we delete or anonymise it.
8. International transfers
Peppaca serves a global audience and uses providers in various countries, including the United States and Japan. When we transfer personal information across borders, we rely on appropriate safeguards where required by law.
9. Security
We use reasonable technical and organisational measures, including encryption in transit and hashed passwords, to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
10. Your privacy rights
Subject to applicable law, you may request to access, correct, delete, or port your personal information, and to object to or restrict certain processing. To make a request, email support@peppaca.com. We will verify your request and respond within the time required by law. You will not be discriminated against for exercising your rights.
11. California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how we use and share it; to request access to and deletion or correction of your information; and to opt out of any “sale” or “sharing” of personal information — which we do not do. You may exercise these rights, including through an authorised agent, by contacting support@peppaca.com. We will not discriminate against you for exercising them.
12. European & UK privacy rights (GDPR)
If you are in the EEA, UK, or Switzerland, you have the rights described in Section 10 above, plus the right to withdraw consent and to lodge a complaint with your local data-protection authority. To exercise your rights, contact support@peppaca.com.
13. Children
Peppaca is not directed to children under 18, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.
14. Changes & contact
We may update this policy and will post changes here with a new date. Questions or requests: Zen National Corporation, 1141 Ringwood Court Ste 160, San Jose, CA 95131, USA · support@peppaca.com.
