Last updated: July 2026
The data controller responsible for data processing on this website is:
If you have questions about data protection, please contact us at [email protected].
We collect the minimum data necessary to provide and improve our service:
Your name and email address, provided during registration (including via Google OAuth). Legal basis: Art. 6(1)(b) GDPR (performance of contract).
Payment information (credit card details, billing address) is collected and processed exclusively by Stripe, our payment processor. We only receive a confirmation of payment status, your Stripe customer ID, and subscription state. We do not store your full card number. Legal basis: Art. 6(1)(b) GDPR (performance of contract).
Login timestamps, IP addresses, and basic service interaction logs (e.g., VM provisioning status). This data is used to operate, secure, and improve the service. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in service security and improvement).
Each customer gets their own dedicated virtual machine, isolated from other customers at the hypervisor level. Within your VM, the customer-facing user account is separated from the platform service account that runs Peter's bundled software.
We are the operator of your VM. We have administrative access to it via our private Tailscale network so we can provision it, apply security updates, ship deploys of Peter's software, respond to incidents, and act on abuse reports. As a matter of policy we do not browse your business data, conversations, or files outside of those operational reasons, and we do not run any routine job that copies VM contents back to our infrastructure. We do not claim to be technically incapable of accessing your VM, because we are not.
Peter runs on the OpenAI ChatGPT/Codex account you connect. Your prompts and Peter's responses are sent to OpenAI under that account and are governed by OpenAI's terms and privacy policy for it; usage counts against your account's own quota, and a paid ChatGPT plan is required. Our software makes these calls on your instruction, but the account, its plan, and its data-handling settings are yours, not ours. We do not use a shared or pooled model key, and there is no alternate AI provider behind the scenes. We log operational metadata such as the model used, timestamps, and observed quota headers for service health and abuse prevention. We do not retain prompt or response content beyond the brief window needed for in-flight processing.
We use Stripe, Inc. to process payments. Stripe processes your payment data under their own privacy policy. See: stripe.com/privacy
Your dedicated VM and our platform infrastructure run on cloud servers located within the European Union.
We use Tailscale for secure network management between our platform and customer VMs. See: tailscale.com/privacy-policy
Peter runs on the ChatGPT/Codex account you connect. Your prompts and Peter's responses are transmitted to OpenAI under your own account, which OpenAI processes as your provider under the terms and privacy policy applicable to that account. OpenAI is therefore not a SayPeter sub-processor for this data; it is a service you connect, like the other accounts you link to Peter. See: openai.com/policies/privacy-policy
If you accept marketing cookies, we deploy the Meta Pixel and the Meta Conversions API to measure the performance of our advertising on Facebook and Instagram. The Pixel sets the _fbp and _fbc cookies in your browser; the Conversions API sends a parallel server-to-server event with the same hashed identifiers we already process for your account (email, phone, name, country) so duplicate browser/server events are deduplicated by Meta. We act as joint controllers with Meta for this measurement. You can revoke consent at any time using ; revoking will stop the Pixel firing and prevent future Conversions API events that rely on browser identifiers. See: facebook.com/privacy/policy
Cookies fall into three categories. The first is set automatically; the other two are off until you opt in via the consent banner.
cookie_consent). These are exempt from consent under ePrivacy Article 5(3)._fbp, _fbc) so we can measure how our ads on Facebook and Instagram perform. Off by default; only set after you accept marketing cookies. We don't run ads on this site. Retained for up to 90 days.You can change your mind at any time via .
You have the following rights regarding your personal data:
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority.
Your data is primarily processed within the European Union. Where data is transferred to third countries, we ensure adequate safeguards:
We may update this privacy policy from time to time. We will notify you of material changes by email or by posting a notice on our website.
For data protection inquiries and to exercise your rights:
Email: [email protected]