Pebble Hosted Privacy Policy

Last updated: October 29, 2026

This policy explains what Tomek Group LLC ("Pebble", "we") collects when you use Pebble Hosted, and why. Contact: hello@pebble.bot, 480 NE 31st St, Unit 1802, Miami, FL 33137, USA.

1. Two kinds of data

Your server's data. You control it; we don't collect it. Your bot chats, files, instructions, outputs, settings and AI provider keys or sign-ins live on your own Pebble Hosted server. We don't copy them to our systems, read them, sell them, or use them to train AI models. We access your server only to run, secure or repair it, when you ask for help, or when the law requires it. For this data, we act on your instructions as your service provider (a "processor" under GDPR).

Our data: what we need to sell and run the Service. We are responsible for this data (the "controller").

2. What we collect

Data	Example	Why
Account	Email address, account ID from your Pebble sign-in	Identify you, contact you about your service
Order	Plan, region, order status, server ID and address, dates	Order, set up, run and cancel your server
Billing references	Stripe customer, subscription, checkout and invoice IDs; amounts; country for tax; refund records	Bill you, charge the right tax, return payment if we can't deliver
Checkout consent (EU/EEA/UK)	Your consent to an immediate start and your acknowledgement that you lose the withdrawal right, with a timestamp	Prove it lawfully, as consumer law requires
Waitlist	Email address you give us when a plan is sold out	Tell you when a plan is available
Technical logs	Request times, error codes, server health	Keep the Service working and secure
Support	Messages you send us	Answer you

We don't receive your full card number. Stripe collects your payment details and billing address directly.

We don't use advertising trackers on the ordering service, and we don't sell or "share" personal data for cross-context advertising.

3. Legal bases (GDPR: EU, EEA and UK)

If you're in the EU, EEA or UK, GDPR (or UK GDPR) applies. We rely on these legal bases:

Contract: account, order, billing and server operation.
Legal obligation: tax and accounting records. This includes recording your consent to an immediate start, and your acknowledgement that you lose the 14-day withdrawal right.
Legitimate interests: security, fraud prevention and fixing problems. You can object.
Consent: optional emails such as the waitlist. You can withdraw consent anytime.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who processes data for us

Provider	What they do	Data involved
Stripe	Payments, tax, invoices, refunds	Payment and billing details, email
OVHcloud	Hosts your server (US or Canada datacenters)	Everything on your server, stored on their hardware
Cloudflare	Runs our ordering service and database; carries the secure connection to your server	Account and order data; connection traffic
Dynamic	Pebble account sign-in	Email, account ID
AI providers you choose (e.g. Anthropic)	Run the AI models your bots use	Whatever your bots send them. You choose the provider, and their privacy terms apply. If you use a Pebble-provided key, requests go to that provider under our account.

We share data otherwise only when the law requires it, to protect rights and safety, or as part of a merger or sale (with notice to you).

5. International data transfers

We sell Pebble Hosted worldwide, but we process data mainly in the United States, and your server runs in the US or Canada (US East, US West or Canada). If you live elsewhere, including the EU, EEA or UK, your personal data is transferred to those countries.

Canada has an EU adequacy decision.
Transfers to the US rely on one of two safeguards. Either the recipient is certified under the EU-US Data Privacy Framework (and its UK Extension), or the EU Standard Contractual Clauses (with the UK Addendum) apply. Stripe and Cloudflare offer these in their data processing terms.
You can ask us for a copy of the safeguards at hello@pebble.bot.
Your AI provider may process your bots' requests in other countries under its own terms.

6. How long we keep it

Your server's data: deleted with the server when your paid month ends after you cancel.
Account and order records: while you have an account, then as long as we need them for legal, tax or dispute purposes.
Billing and tax records: as long as the law requires, typically 7 years.
Waitlist emails: until you ask us to remove them, or once we've told you the plan is available.
Logs: up to 90 days.

7. Your rights

Depending on where you live (for example under GDPR, UK GDPR or CCPA/CPRA), you can ask to:

access, or get a copy of, your personal data;
correct it;
delete it (we may keep what the law requires, such as tax records);
object to or restrict some uses, and withdraw consent;
move your data to another service.

We won't treat you differently for using these rights. Email hello@pebble.bot. We may need to verify your identity, and we'll reply within the legal deadline (generally 30 days for GDPR, 45 days for CCPA). EU/UK residents can also complain to their local data protection authority.

For your server's data, you can export or delete it yourself while your server runs.

8. Security

Your server is private to you. Connections are encrypted (TLS).
We restrict and log administrative access, and keep the base system updated.
Card data stays with Stripe.
No system is perfectly secure. If a breach affects your personal data, we'll tell you as the law requires.

You are responsible for the security of the keys, sign-ins and accounts you add to your bots.

9. Children

Pebble Hosted is not for anyone under 18. We don't knowingly collect children's data. If you think a child has given us data, contact us and we'll delete it.

10. Changes

We'll post updates here and email you about material changes before they take effect.

11. Contact

Tomek Group LLC, 480 NE 31st St, Unit 1802, Miami, FL 33137, USA, hello@pebble.bot