Last updated: September 17, 2026

<aside> 🇫🇷

Disponible ici

[pepline.ai — Politique de confidentialité](https://initventures.notion.site/pepline-ai-Politique-de-confidentialit-39f6ffe0e769806a97e7ec11d5118ad1)

</aside>

Pepline is an embeddable AI intake and qualification agent for service businesses. This policy explains what personal data we handle, why, and what your rights are. It is written to describe what the product actually does — not generic boilerplate.

Who we are. Pepline is operated by INIT VENTURES, a French SARL, 4 rue d'Angoumois, 44000 Nantes, France, RCS Nantes 999 592 793 ("Pepline", "we"). Contact for anything privacy-related: [email protected].

1. Our two roles: controller and processor

Pepline handles personal data in two distinct capacities:

• Data controller for the data of our customers — the businesses that create a Pepline account ("owners"). Sections 2a, and the owner-related parts of this policy, describe that processing.
• Data processor for the data of visitors — the people who chat with an agent embedded on a customer's website ("visitors" or "leads"). That data is collected for and on behalf of the customer, who is the data controller. The customer decides why the widget is on their site and is responsible for the lawful basis of that collection; we process visitor data only to provide the service to them.

If you chatted with a Pepline-powered agent on a business's website, that business is the controller of your data. You can exercise your rights either with them or directly with us (Section 7) — we assist either way.

2. What data we collect

2a. Customer (owner) account data — Pepline as controller

• Identity and authentication: email address, name (optional), password (stored only as a bcrypt hash — never in plaintext), language preference, timestamp of terms acceptance, email verification status.
• Organization data: organization name, sending identities for outbound email (display name, reply-to, copy-to address, signature), billing-related fields.
• Access data: roles and per-agent access grants; API keys (stored as SHA-256 digests; the plaintext key is shown once and never stored).
• Support access log: if our staff accesses your account for support, the access is recorded permanently (who, when, and the stated reason) — see Section 8.
• Support conversations: if you write to us through the support chat in the dashboard, the conversation, your email, name and organization are handled by Crisp (see Sections 4 and 5).
• AI assistant connections: if you connect your own AI assistant (for example Claude or Cursor) to your account through our MCP endpoint, the data that assistant requests is sent to its provider under your own agreement with them. We are not a party to that transfer.

2b. Visitor (lead) data — Pepline as processor for the customer

When a visitor chats with a customer's agent (via the embedded widget or a hosted chat page), we process:

• The full conversation transcript — every visitor and agent message, verbatim.