Peppermint Privacy Policy
Peppermint Pay Merchant · Effective October 1, 2026
This policy explains what information Peppermint Bizmoto Inc. ("Peppermint Pay", "we", "us") collects when you use the Peppermint Pay Merchant app for iPhone, iPad and Android and the merchant portal at merchant.peppermint-pay.com (together, the "Service"). It also explains why we use that information, who we share it with, and the rights you have. We process personal information in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission.
1. Who the Service is for
The Service is for businesses that have a Peppermint Pay merchant account, and for the people they authorize to use it. Peppermint Pay creates merchant accounts during merchant onboarding; you cannot sign up in the app.
Your customers do not use the Service. They pay your store with their own e-wallet or banking app by scanning your QR Ph code. We still receive some of their information, such as the payer name their bank reports, as part of each payment record (see section 2).
2. Information we collect
| Category | Examples | Why we need it |
|---|---|---|
| Merchant and contact details | Store name, owner name, mobile number, email address, city, business category, merchant username | To run your account, show your store name with your QR code and contact you about your account |
| Bank account details | Bank or e-wallet name, account name and account number that you save | To record where your funds should be sent |
| Store QR code | Your store's static QR Ph code | To show it to your customers |
| Transaction information | Amount, date and time, reference number, status, the paying e-wallet or bank, and the payer name it reports | To show your payments, totals, balance and reports, and to alert you when you are paid |
| Sign-in and security data | Password (stored only as a one-way hash), passkey public keys, authenticator-app settings (encrypted), sign-in attempts with IP address and time | To let you sign in securely, block repeated wrong attempts and investigate misuse |
| Device information | Push-notification token and device name, for each device where you allow notifications | To send payment notifications to your devices |
| Activity records | Changes to your profile, bank accounts and security settings, with the time, IP address and source (app, web portal or support) | To keep an audit trail that protects your account |
| Support communications | What you tell us when you contact support | To answer you and resolve the issue |
We do not collect your location, contacts, photos or files, and the app does not use your camera or microphone. The Service has no advertising and no third-party analytics or tracking tools.
3. Where it comes from and how we use it
We get information from three places: from you, when you use the app or portal; from Peppermint Pay, when your merchant account is set up; and from the Peppermint Pay payment platform, which receives the QR Ph payments made to your store through the InstaPay network.
We use it to:
- provide the Service: show your QR code, payments, balance and reports, and send payment alerts;
- keep accounts secure and prevent fraud and misuse;
- give support and tell you about changes to the Service;
- meet our legal and regulatory obligations, including those that apply to payment services in the Philippines.
We process your information because it is necessary to provide the Service under your merchant agreement, to comply with the law, and for our legitimate interest in keeping the Service secure. We do not sell your personal information or use it for advertising.
4. Who we share it with
We share information only as needed to run the Service:
- Service providers that host and operate the Service for us under contract and our instructions: Amazon Web Services, and Apple Push Notification service for notifications on iPhone and iPad.
- The Peppermint Pay payment platform and its banking partners, to process and reconcile the payments made to your store.
- Government authorities and regulators, when the law requires it.
- A successor business, if Peppermint Pay is merged or sold, under the same protections as this policy.
Your information is stored on Amazon Web Services in the Asia Pacific (Singapore) region, so it is transferred outside the Philippines. We remain responsible for it, and we require our providers to protect it to the standard the Data Privacy Act requires.
5. How long we keep it and how we protect it
| Information | How long |
|---|---|
| Transaction history shown in the Service | Up to 3 months |
| Report files you generate | 7 days |
| Account, bank, security and activity records | While your merchant account is active, then only as long as the law or the resolution of disputes requires |
To protect your information:
- all connections use encryption in transit (HTTPS/TLS);
- passwords are stored only as one-way hashes, and authenticator-app settings are encrypted;
- you can sign in with a passkey or 2-step verification, and sign-in pauses after repeated wrong passwords;
- Peppermint Pay staff access is limited by role, and their changes are logged.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the National Privacy Commission as the law requires.
6. Your rights and choices
Under the Data Privacy Act you have the right to be informed, to access your information, to correct it, to object to its processing, to have it erased or blocked, to data portability, and to be indemnified for damages. You may also file a complaint with the National Privacy Commission (privacy.gov.ph).
You can update your contact details and bank accounts in the app under Account, and turn notifications off in your device settings. To close your merchant account or exercise any other right, contact us (section 9). We reply within 1 working day.
7. Children
The Service is for businesses and is not directed to anyone under 18.
8. Changes to this policy
We will post changes on this page and update the effective date. For significant changes we will also tell you in the app or by email before they take effect.