Last updated September 2026 (v7)
This Privacy Policy is issued by BluePath Software Inc. ("we," "us," or "our"), the operator of Peppercorn.
Peppercorn is a study and preparation platform for prospective and current law students, as well as bar and law society candidates. This policy explains what personal information we collect when you use Peppercorn, why we collect it, how it is processed, and who receives it.
Account Information: your email address and a salted, hashed version of your password (we never view or store plain-text passwords). If you voluntarily complete optional profile fields, such as a phone number or mailing address, we store that information as well.
Study Progress & Activity: your topic history, practice mode accuracy, review schedules, subject preferences, and study activity logs (including timestamps, scores, and specific submission attempts such as essays or outlines). This data allows your progress to sync seamlessly across devices.
Security & Access Logs: sign-in and registration attempt records (including IP addresses, timestamps, and success/failure status) and active session data. We use these logs to monitor platform security, prevent unauthorized access, and enable you to review or terminate active sessions across your devices.
Service Usage Metrics: daily counts of your requests and approximate model output volumes. We monitor aggregate usage to maintain infrastructure performance and prevent platform abuse. We do not inspect or review the contents of your generated prompts or outputs for this purpose.
AI Request Records: the material you submit for AI generation and the response you receive, kept for as long as your account remains active — see "What we keep, and for how long" below for why and for how long.
When you paste material into Peppercorn to generate study materials — such as notes, a syllabus, or a fact pattern — we transmit that text to our AI service provider to fulfill your specific request. We also keep a record of that request (the material you submitted and the response you received) for as long as your account remains active, so that a disputed grade, a scoring-pattern question, or a support issue can be resolved against exactly what you were given and what you submitted, not just a summary. This record is deleted when your account is deleted (see "Your Rights" below), and access to it is limited to the purposes described here — investigating a reported problem, a security concern, or a valid legal request.
If you save or log a generated response to your account (such as a practice essay answer, outline, or activity log entry), that output also appears in your visible study history, separately from the request record described above.
All payment transactions are securely processed by our third-party payment provider, Stripe. When subscribing or making a purchase, you interact directly with Stripe's secure hosted checkout components.
To complete transactions, Stripe collects payment details (e.g., credit or debit card numbers), billing addresses, email addresses, and transaction history. Stripe may also collect technical metadata, such as device identifiers and IP addresses, for fraud prevention and checkout optimization.
We never collect, transmit, or store raw payment credentials on our servers. Stripe manages payment security in compliance with the Payment Card Industry Data Security Standard (PCI-DSS). Our access is strictly limited to a non-sensitive Stripe customer identifier and your subscription status (e.g., active, trialing, or past due) to manage account permissions. For further details, please review Stripe's Privacy Policy.
We retain account information, study progress, security logs, and the AI request records described above for as long as your account remains active — to maintain your progress history and spaced-repetition scheduling, and so a support or dispute question can be resolved against your actual activity.
When you request account deletion, we permanently delete your account details, study progress, and AI request records. Limited security logs (such as account creation records) may be retained for a temporary, defined period to fulfill legal obligations or investigate suspected security breaches.
We maintain technical and organizational safeguards to protect your personal information:
When you accept the Terms of Service, Privacy Policy, or the terms of a specific purchase (a Bar Prep Pass, Baby Bar Pass, or Core-to-prep add-on), we log the date, time, your IP address, and what you agreed to, and email you a copy.
Our public marketing pages (distinct from the main Peppercorn web application) use a lightweight, privacy-focused analytics script to gather aggregate metrics on website usage, such as general geographic region (city-level, based on IP address), page views, and session duration.
This tracking is non-identifiable and uses temporary browser sessionStorage (which resets when you close your browser tab) rather than cookies. Marketing analytics are not connected to user accounts, shared with third parties, or used for targeted advertising.
Regardless of your jurisdiction, you may submit the following requests regarding your personal data:
Some records are retained for a defined period even after a deletion request:
If we can't act on part of your request because it falls under one of these categories, we'll tell you specifically what we're retaining and why. If you're a California resident, you have the right to appeal that decision by contacting us at [email protected]. If you're in a jurisdiction with its own data protection authority — for example, Canada's Office of the Privacy Commissioner — you may also bring a complaint there.
To exercise these rights, please contact us at [email protected] from your registered account email. We review and fulfill verified requests in accordance with applicable legal timeframes.
BluePath Software Inc. is responsible for personal information under its control in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
We collect, use, and disclose personal information solely for the purposes identified in this policy. Continued use of Peppercorn constitutes consent to the collection and handling of your data as described herein.
If you have unresolved concerns regarding our privacy practices, you may contact our privacy officer or lodge a formal complaint with the Office of the Privacy Commissioner of Canada.
Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have specific statutory rights regarding their personal information.
We have not sold or shared (for cross-context behavioral advertising) any categories of personal information in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than providing the requested services.
Subject to legal limitations, California residents have the right to request access to, correction of, or deletion of their personal information, as well as the right to equal service without discrimination for exercising privacy rights.
To submit a request, email [email protected]. Authorized agents submitting requests must provide written authorization from the consumer.
We may update this Privacy Policy periodically to reflect operational, legal, or regulatory changes. Whenever this policy or the Terms of Service changes, we'll ask you to review and affirmatively accept the updated version the next time you log in before you can keep using your account — see the Terms of Service's "Changes to Terms" section for how that works.
For privacy inquiries or to exercise your privacy rights, please contact:
BluePath Software Inc.
20 Bay Street, Suite 1100
Toronto, Ontario M5J 2N8
Canada
Email: [email protected]