Privacy Policy

This Privacy Policy covers how we handle information when you access or use Peppermint.

1. Introduction

Peppermint, Inc. (“Peppermint,” “we,” “us,” or “our”) is a Delaware corporation based in Berkeley, California. We build software that automates financial operations for clinical research sites, including payment reconciliation, invoice validation, and identifying unbilled or underpaid amounts.

2. Information We Collect

We collect only what we need to run the product.

Account information

• Name
• Email address
• Company and job title
• Login credentials
• Billing contact

Data you or your organization put into Peppermint

• Clinical trial agreements and budgets
• Invoices, remittances, and payment records
• Visit and procedure line items
• Files you upload

Data accessed through Google Workspace APIs

• Gmail messages and attachments
• Basic Google account profile information (name, email address)

Our access to this data is governed by Section 5.

Usage data

• IP address, browser, and device information
• Pages viewed and actions taken in the product
• Log data

3. How We Use Your Information

We use the information we collect to:

• Reconcile sponsor payments against your clinical trial agreements
• Generate and validate invoices, and flag unbilled or underpaid amounts
• Provide support and respond to your questions
• Bill you
• Secure the service and detect abuse
• Improve the product
• Meet legal obligations

4. Third-Party AI Models

Peppermint uses AI models to read and structure documents and emails so we can extract payment terms, match remittances, and draft invoices. Our AI provider is Anthropic, PBC.

Content sent to our AI provider is processed to return a result to you and nothing else. Our provider does not retain it after processing. We do not permit our AI providers to use your data to develop, improve, or train generalized artificial intelligence or machine learning models.

5. Google Workspace APIs - Limited Use

Peppermint connects to Gmail so it can reconcile sponsor payments and send invoices from your own mailbox. Our access to and use of this data is governed by the Google API Services User Data Policy, including its Limited Use requirements.

Scopes we request and why

• openid, userinfo.email, userinfo.profile: to access your unique user identifier, primary email address, and basic profile information (such as your display name) in order to identify and display your connected mailbox in Peppermint
• gmail.readonly: to find and read email from sponsors and CROs about payments, remittances, and invoices, so we can match them against your clinical trial agreements.
• gmail.send: to send invoices and payment follow-ups from your mailbox when you tell us to.

We do not request modify or delete access. We cannot change or remove anything in your mailbox.

What this means in practice

• User-facing features only. We use Google user data solely to provide features that are visible and prominent in the Peppermint interface.
• No advertising. We do not use Google user data for advertising of any kind.
• No sale of data. We do not sell Google user data and do not transfer it to third parties except as required to provide or secure the service, or where required by law.
• No generalized AI or ML training. We do not use, and do not permit our AI providers to use, raw or derived Google Workspace data to develop, improve, or train generalized artificial intelligence or machine learning models.
• Limited human access. Our staff do not read your email unless (i) you have given us explicit consent to access specific messages, (ii) it is necessary to investigate a security incident or abuse, or (iii) it is required by law.

What we store

Message headers, message bodies, attachments, and OAuth tokens. Tokens are encrypted at rest.

6. Revoking Access and Deleting Data

You can disconnect Google from inside Peppermint or revoke our access at any time from your Google account permissions page.

When you disconnect, or when your account is terminated, we revoke your tokens and delete the Google data we hold within 30 days.

To request deletion sooner, email [email protected]. We respond within 7 days.

7. Data Security

• Encryption. Data is encrypted in transit using TLS and encrypted at rest. OAuth tokens are encrypted at rest.
• Access controls. Access to customer data is limited to authorized staff on a need-to-know basis and requires multi-factor authentication.
• Audits. We are currently pursuing SOC 2 Type II certification. We will update this page when the audit is complete.

8. Data Retention

We keep your data for as long as your account is open and for as long as we need it for the purposes in this policy, to comply with the law, or to resolve disputes. You can delete your account and your data at any time. Some data may remain in backups for up to 90 days.

9. Third-Party Services

We share information with service providers who help us operate Peppermint, under contracts that require them to keep it confidential. We do not sell or trade your personal information.

Our core subprocessors include:

• Google Cloud Platform (Google LLC): Cloud hosting, database, and core infrastructure
• Anthropic, PBC

10. Analytics

We use third-party analytics to understand how people use our website and product. These services do not receive any data obtained through Google Workspace APIs.

11. Payment Processing

We use third parties to process payments and do not store your card details. We currently use Stripe, Inc. For more information, see their Privacy Policy.

12. Links to Other Websites

Our website and product may link to sites we do not operate. We are not responsible for their privacy practices. Review their policies before giving them your information.

13. Children’s Privacy

Peppermint is a business product. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we have, we delete it. If you believe a child under 13 has given us personal information, email [email protected].

14. Your Privacy Rights

If you live in California, you can ask us what personal information we hold about you, ask us to correct or delete it, and ask us not to sell or share it. We do not sell or share it. Email [email protected] and we will verify your identity before we act.

If your personal information is in data your organization put into Peppermint, contact your organization first. We will help them respond.

15. Changes to This Privacy Policy

We may update this policy from time to time. If we make a material change, we will post the new version here with a new date and notify account administrators by email.

16. Applicable Law

This Privacy Policy is governed by the laws of the State of California, without regard to conflict of law rules.