Privacy Policy

This policy explains how Pep Halo, operated by Jonathan Cortes (“we,” “us”), handles information when you use pephalo.com and the Pep Halo iOS app. For privacy questions or requests, email johnny.cortesj@gmail.com.

Information we collect

• Account information: your name, email address, account ID, authentication information, and information supplied by a sign-in provider when you choose that option.
• Health and journal information: peptide and vial records, quantities, routines, schedules, logs, notes, and other health-related information you choose to enter. These records are associated with your account.
• AI and image content: messages, uploaded photos, extracted label information, analysis, drafts, and record changes made through AI features. Uploaded images and related drafts can be stored with your account and conversation. Canceling a draft does not necessarily delete its uploaded image.
• Billing and affiliate information: subscription status, purchase history, Stripe customer and subscription identifiers, referrals, affiliate applications, commissions, earnings, and payout status. Stripe collects payment details through its payment services and may collect identity, tax, or bank details for affiliate onboarding. Pep Halo receives billing and payout records needed to operate these features.
• Activity and technical information: AI and scan usage, credit balances, request and transaction records, and website activity. The website stores a random browser identifier and records visits, viewed app sections, and activity times. This identifier can be linked to your account when signed in. Hosting and other service providers also process technical connection information, such as IP addresses and request information, to deliver and secure the service.
• Support information: information you send when contacting us.

How we use information

We use information to authenticate accounts, save and synchronize records, provide calculations and reminders, process AI requests, personalize responses using records you make available, manage subscriptions and affiliate payments, enforce usage limits, prevent abuse, provide support, and understand service usage and reliability. Administrative tools show account, usage, subscription, and affiliate information needed to operate Pep Halo.

AI processing and your records

Pep Halo sends AI messages, selected images, relevant conversation context, and applicable record information to OpenAI to generate responses and analyze images. When Use My Records is enabled, relevant saved records can be retrieved, sent for AI processing, and changed through supported AI actions. You can turn this option off to stop those record-access features in subsequent requests. It does not remove information already sent or prevent processing of information you type or upload yourself.

Research features may send a question or derived search terms to OpenAI’s web research tools and access public sources. Avoid including unnecessary personal information in research requests. Provider retention and security practices apply to information sent to them; turning off record sharing or clearing your chat display does not itself erase previously processed data. See OpenAI’s privacy policy.

Service providers and other disclosures

We use Supabase for account authentication, Cloudflare and the Sites hosting platform for hosting, databases and uploaded-file storage, OpenAI for AI features, and Stripe for subscriptions and affiliate payments. Where enabled, Resend delivers service emails such as trial and subscription notices. If you choose Apple, Google, or another offered sign-in method, that provider processes your authentication under its own policy.

These providers receive information necessary for their services. We may also disclose information when required by law, to address fraud or security incidents, to protect rights, or as part of a business transfer subject to appropriate protections. We do not sell your personal information or provide your health records to advertisers. The current app does not use an advertising network to target ads across other companies’ apps and websites.

Storage on your device

The website uses browser storage and cookies for sign-in, preferences, referral attribution, and the visitor identifier described above. The iOS app stores session and preference information and may schedule local notifications. You can manage camera, photo, and notification permissions in device settings. Clearing browser storage may sign you out and reset preferences; it does not delete server records.

Retention and deletion

Account and saved-record information is retained to provide your account and features until you delete supported records or request deletion. Uploaded images, AI-related records, usage records, and administrative records do not all have an automatic deletion period. Contact us to request removal of information that has no deletion control in the app. Deleting a saved entry, canceling a draft, signing out, or uninstalling the app does not necessarily delete all associated server information.

We retain information only as needed for service operation, security, resolving disputes, and legal or accounting obligations. Some billing, transaction, fraud-prevention, and payout records may need to remain after account deletion. Backups and service-provider records may remain for their applicable retention periods. Subscription cancellation and account deletion are separate requests; manage your subscription through the billing controls or contact us for help.

Your choices and requests

You can edit or delete records using available controls, turn off Use My Records, stop uploading images, and change device permissions. To request account deletion, access, correction, a copy of your information, or withdrawal of consent for optional processing, email johnny.cortesj@gmail.com from your account email. We may verify your identity before acting. We respond according to applicable law and explain any information we must retain. Depending on where you live, you may also have rights to restrict or object to processing, portability, and to complain to your local data protection authority. Withdrawing consent does not undo processing that already occurred.

Security and international processing

We use access controls and encrypted network connections to protect information. No service can guarantee absolute security. Our providers may process information in the United States and other countries, where privacy laws may differ from those where you live.

Children

Pep Halo is intended for adults aged 18 and over. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us so we can investigate and remove it as appropriate.

Changes and contact

We update this page when our practices change and revise the effective date. For material changes, we will provide an appropriate notice. Contact Jonathan Cortes, Pep Halo, at johnny.cortesj@gmail.com with questions about this policy.