Privacy Notice

Pepperlot collects information necessary to operate our restaurant real estate marketplace. The table below describes the categories of personal information we collect, examples of each, and our purpose and lawful basis for collecting it.

Directly from You

We collect information you provide when you create an account, submit a listing, send an inquiry, complete a contact form, correspond with us by email or phone, or contact our support team.

Through Your Use of the Platform

We automatically collect certain technical and usage data when you interact with Pepperlot, including through cookies and similar tracking technologies. This includes IP address, browser type, device information, pages viewed, search queries, and listing interactions. See Section 11 (Cookies & Tracking) for more detail.

From Third Parties

We may receive information about you from other sources, including:

• Other users of the platform (for example, when a buyer submits an inquiry about your listing).
• Public records and publicly available sources.
• Analytics and service providers who help us operate and improve the platform.
• Social media platforms, if you use a social account to log in to Pepperlot.

We use personal information as appropriate for the relationship you have with us. The common purposes for which we use personal information are:

Provision of Services

To create and manage your account, publish and display listings, connect buyers and sellers, facilitate inquiries, and provide the features of the platform you request.

Security and Fraud Prevention

To authenticate users, maintain secure sessions, detect and prevent fraudulent or unauthorized activity, and safeguard the integrity of our platform and its users.

Communication and Support

To respond to inquiries and support requests, send transactional notifications (such as new inquiry alerts and listing updates), and provide service-related communications.

Marketing Communications

To send promotional communications about Pepperlot features, new listings relevant to your interests, and platform updates. We will only send marketing communications where you have provided consent or where permitted by applicable law. You may opt out at any time (see Section 8).

Platform Improvement and Analytics

To analyze how users interact with the platform, identify areas for improvement, conduct internal research, and develop new features.

Legal and Regulatory Compliance

To comply with applicable laws and regulations, respond to lawful requests from public authorities, enforce our Terms of Use, and protect the rights and safety of our users and the public.

Automated Decision-Making

We may use automated systems to support fraud detection, content moderation, and listing relevance. We do not use automated decision-making to make decisions that have legal or similarly significant effects on you without human review.

We do not sell, trade, or rent your personal information to third parties for their own marketing purposes. We may disclose information in the following limited circumstances.

Between Users

When you submit an inquiry about a listing or a buyer contacts you, the relevant contact information and listing details are shared between the parties to facilitate the transaction. Information you choose to display publicly on your listing or profile is visible to all platform users.

Service Providers

We share personal information with trusted third-party vendors who perform services on our behalf, such as cloud hosting, platform analytics, email delivery, and customer support tooling. These vendors are contractually required to handle personal information only as necessary to perform services for us and are prohibited from using it for their own purposes.

Real Estate Professionals

Where a transaction involves a licensed broker, agent, or attorney, we may share relevant transaction information with those professionals solely to facilitate the deal you have initiated.

Legal and Regulatory Disclosures

We may disclose personal information to law enforcement agencies, regulatory authorities, courts, or other public bodies as required by law, in response to a valid legal process, or to protect the rights, property, or safety of Pepperlot, our users, or others.

Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the platform before your information becomes subject to a different privacy policy.

With Your Consent

We may share your information in other ways if you have given us explicit consent to do so.

Pepperlot is based in the United States. If you are located outside the United States, your personal information will be transferred to and processed in the United States.

Where we transfer personal information from the EEA, UK, or Switzerland to countries that may not have equivalent data protection laws, we implement appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner's Office. You may request a copy of the relevant transfer mechanism by contacting us at team@pepperlot.com.

We implement industry-standard technical and organizational safeguards designed to protect personal information against unauthorized access, disclosure, loss, or alteration. Our security measures include:

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256).
• Role-based access controls and multi-factor authentication for internal systems.
• Regular security assessments, vulnerability scanning, and updates.
• Secure, compliant cloud infrastructure with physical and logical access controls.
• Staff training on data protection obligations and security practices.

No method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach that is likely to result in a risk to your rights, we will notify you and the appropriate regulatory authorities as required by applicable law, within the timeframes those laws prescribe.

We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Notice, to provide our services, and to comply with our legal obligations. The table below describes our standard retention periods.

In some circumstances we may anonymize or aggregate personal information so that it can no longer be associated with you. We may use such de-identified data indefinitely without further notice.

All Pepperlot users have the following choices and rights with respect to their personal information. Additional jurisdiction-specific rights are described in Section 13.

Access and Correction

You may access and update most of your personal information through your account settings. If you cannot access or correct your information through your account, contact us at team@pepperlot.com.

Deletion

You may request deletion of your account and associated personal information by contacting us at team@pepperlot.com. We will process your request subject to any legal obligations that require us to retain certain data (see Section 7).

Marketing Opt-Out

You may opt out of receiving marketing emails at any time by clicking the unsubscribe link in any marketing email or by contacting team@pepperlot.com. Opting out of marketing does not affect transactional communications related to your account or active listings.

SMS Opt-Out

You may opt out of SMS messages at any time by replying STOP to any message we send. See Section 10 for more details.

Cookie Preferences

You may manage non-essential cookie preferences through your browser settings or our cookie preference center. See Section 11 for more details.

Data Portability

You may request a copy of the personal information we hold about you in a portable, machine-readable format by contacting team@pepperlot.com.

Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. We will not deny you services, charge different prices, or provide a different level of service because you exercised a right described in this Privacy Notice.

We comply with the CAN-SPAM Act of 2003. All commercial email communications from Pepperlot will:

• Identify themselves clearly as a communication from Pepperlot with accurate sender information.
• Include a valid physical postal address: Pepperlot, Los Angeles, CA.
• Include a clear and conspicuous opt-out mechanism in every message.
• Honor opt-out requests within 10 business days.

We distinguish between transactional emails (account confirmations, inquiry notifications, listing updates), which are necessary to provide our services and cannot be opted out of, and marketing emails, which are optional and can be unsubscribed from at any time.

We do not sell, transfer, or share your email address with third parties for their own marketing purposes.

We comply with the Telephone Consumer Protection Act (TCPA) and applicable FCC regulations. Specifically:

• We will only send you SMS messages or make autodialed or pre-recorded calls if you have provided prior express written consent.
• Consent to receive SMS messages is not a condition of using any Pepperlot service.
• Standard message and data rates may apply.
• You may opt out of SMS messages at any time by replying STOP. You will receive a single confirmation message and will not receive further SMS unless you re-subscribe.
• For assistance, reply HELP or contact team@pepperlot.com.
• We do not share or sell your phone number to third parties for their telemarketing use.

We use cookies and similar tracking technologies (such as pixels and web beacons) to operate and improve the Pepperlot platform.

Types of Cookies We Use

• Essential Cookies: Required for the platform to function (e.g., maintaining your session). These cannot be disabled.
• Functional Cookies: Remember your preferences such as saved searches and login state.
• Analytics Cookies: Help us understand how users interact with the platform (e.g., pages visited, time on site). We use aggregated analytics to improve the platform.
• Marketing Cookies: Used to deliver relevant advertising and measure campaign effectiveness. These are only set with your consent where required by law.

Managing Your Preferences

You can manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect platform functionality. California residents may also use the Global Privacy Control (GPC) browser signal to opt out of the sale or sharing of personal information via cookies. We honor GPC signals as a valid opt-out request.

Children Under 18

Pepperlot is a business platform intended for adults aged 18 and over. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal information, please contact team@pepperlot.com and we will promptly delete it.

Third-Party Links

Our platform may contain links to third-party websites or services. Pepperlot is not responsible for the privacy practices of those third parties and this Privacy Notice does not apply to them. We encourage you to review the privacy notices of any third-party sites you visit.

Changes to This Privacy Notice

We may update this Privacy Notice periodically to reflect changes in our practices or applicable law. We will notify you of material changes by email or by posting a prominent notice on the platform at least 30 days before the changes take effect. The Last Updated date at the top of this notice reflects the most recent revision.

Conflict with Terms of Use

Where there is a conflict between this Privacy Notice and our Terms of Use, this Privacy Notice shall prevail with respect to the processing of personal information.

California Residents — CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months, including sources, purposes, and third parties with whom we share it.
• Right to Delete: Request deletion of personal information we have collected, subject to legal exceptions.
• Right to Correct: Request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out: Pepperlot does not sell personal information. If this practice changes, you will have the right to opt out. You also have the right to opt out of sharing for cross-context behavioral advertising.
• Right to Limit Sensitive Information: Request that we limit our use of sensitive personal information to what is necessary to perform the services you requested.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right.

To submit a California privacy request, email team@pepperlot.com with the subject line "California Privacy Request." We will verify your identity and respond within 45 days (extendable to 90 days with notice). You may designate an authorized agent to make a request on your behalf with written proof of authorization.

Do Not Sell or Share: To submit a CCPA opt-out request, email team@pepperlot.com with the subject line "CCPA Opt-Out." California Civil Code Section 1798.83 (Shine the Light): We do not disclose personal information to third parties for their own direct marketing purposes without your consent.

EEA, UK & Switzerland Residents — GDPR

If you are located in the European Economic Area, United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and applicable national laws provide you with the following rights:

• Right of Access: Obtain a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data in certain circumstances.
• Right to Restriction: Request that we restrict processing of your personal data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, machine-readable format.
• Right to Object: Object to processing based on our legitimate interests.
• Rights Related to Automated Decision-Making: Not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

Pepperlot is the controller of the personal data it collects. To exercise any GDPR right or to request information about the safeguards we use for international transfers, email team@pepperlot.com with the subject line "GDPR Data Request." You also have the right to lodge a complaint with your local data protection supervisory authority.

Nevada Residents

Nevada law permits us to make marketing calls to existing customers. If you prefer not to receive marketing communications, you may opt out by contacting us at team@pepperlot.com.

Other U.S. State Privacy Laws

Pepperlot respects the privacy rights of residents of all U.S. states that have enacted consumer privacy legislation. The following states currently have active privacy laws that may grant you rights with respect to your personal information:

• Connecticut — Data Privacy Act (CTDPA), effective July 2023
• Colorado — Privacy Act (CPA), effective July 2023
• Virginia — Consumer Data Protection Act (VCDPA), effective January 2023
• Texas — Data Privacy and Security Act (TDPSA), effective July 2024
• Oregon — Consumer Privacy Act (OCPA), effective July 2024
• Utah — Consumer Privacy Act (UCPA), effective December 2023
• Montana — Consumer Data Privacy Act (MCDPA), effective October 2024
• Delaware — Personal Data Privacy Act (DPDPA), effective January 2025
• New Hampshire — Privacy Act (NHPA), effective January 2025
• New Jersey — Data Privacy Act (NJDPA), effective January 2025
• Nebraska — Data Privacy Act (NDPA), effective January 2025
• Iowa — Consumer Data Protection Act (ICDPA), effective January 2025
• Indiana — Consumer Data Protection Act (INCDPA), effective January 2026
• Minnesota — Consumer Data Privacy Act (MCDPA), effective July 2025
• Maryland — Online Data Privacy Act (MODPA), effective October 2025
• Tennessee — Information Protection Act (TIPA), effective July 2025
• Rhode Island — Data Transparency and Privacy Protection Act (RIDPPA), effective January 2026

Rights available under these laws vary by state but commonly include: the right to access personal information we hold about you; the right to correct inaccurate information; the right to delete your personal information; the right to data portability; the right to opt out of targeted advertising and profiling; and in many states, the right to appeal a denial of a privacy request.

Note that most of these laws apply only to businesses that exceed certain processing thresholds, typically 100,000 or more consumers per year. Regardless of whether a threshold applies, Pepperlot is committed to honoring reasonable privacy requests from all U.S. residents.

To exercise any of these rights, contact team@pepperlot.com with the subject line "[State] Privacy Request" (e.g., "Colorado Privacy Request"). We will verify your identity and respond within the timeframe required by your state's law, typically 45 days with the option to extend by an additional 45 days with notice.

If we deny your request, you may appeal by replying to our denial communication with your reasons. We will respond within the timeframe required by applicable law. If you remain unsatisfied, you may submit a complaint to your state Attorney General or applicable regulatory authority.

For questions about this Privacy Notice, to exercise your privacy rights, or to submit a data request, contact us using the details below. We aim to respond to all verified requests within 45 days.

Email: alex@pepperlot.com

Phone: 650 770 8709

Mailing Address: Pepperlot, Los Angeles, CA

For California privacy requests, use subject line: "California Privacy Request"

For GDPR requests, use subject line: "GDPR Data Request"

For CCPA opt-out requests, use subject line: "CCPA Opt-Out"

For SMS opt-out, reply STOP to any message or email team@pepperlot.com.