Data Processing Addendum

Last updated: October 16, 2026

This Data Processing Addendum ("DPA") is part of the Terms of Service. It applies when Pipecove processes personal data about a workspace's contacts, leads, correspondents, signers, and ad audiences on the workspace's instructions. The workspace is the controller. Pipecove is the processor.

If you need this text signed as a PDF, email privacy@pipecove.com and we will countersign it.

1. What we process

Personal data the workspace submits, or that arrives because the workspace connected a channel or turned on a feature:

• names, email addresses, phone numbers, company details, notes, tags, and custom fields,
• custom-object records the workspace chooses to store,
• message content and metadata for email, SMS, voice, WhatsApp, Messenger, and Instagram,
• documents, signature images, and signer details,
• lead-form and booking submissions,
• AI instructions, prompts, replies, and logs,
• social posts and comments the workspace schedules,
• ad account data, lead-ad fields, and audience members the workspace syncs,
• identity details the workspace submits to buy a phone number.

We do not sell that data. We do not use it to market other products to those people. We do not use Facebook, Instagram, WhatsApp, LinkedIn, or Google data except to provide the feature the workspace turned on.

2. Instructions

We process Customer Data only to provide, secure, and support the Service, and on documented instructions from the workspace. The Terms, this DPA, the AI Use Policy, and the settings you choose in the product are those instructions.

If a law forces us to process differently, we will tell you unless the law forbids the notice. If we believe an instruction breaks applicable privacy law, we will tell you and we may pause that instruction.

3. Our people

Access to production data is limited to people who operate the Service and who need it for support, security, or delivery. They are bound by confidentiality. We do not give support contractors a standing copy of your database.

4. Security

The measures we actually use:

• The application and database run on infrastructure we administer, not inside a third-party CRM.
• The database is PostgreSQL, with access restricted to the application and to operators.
• TLS protects traffic between the browser and the Service, and between the Service and Stripe, carriers, Meta, LinkedIn, Google, and model providers.
• Passwords are stored hashed. Two-factor authentication is available on every plan. Five failed sign-ins lock the attempt.
• API keys are credentials. Roles limit which agent can open which feature.
• We keep operational backups and test that we can restore.
• We do not claim a SOC 2 or ISO/IEC 27001 certification. If we obtain one, we will say so on the security page, not before.

We will notify the workspace without undue delay after becoming aware of a personal-data breach affecting its Customer Data, and we will include the information a processor must give a controller, to the extent we have it.

5. Subprocessors

Infrastructure we run ourselves is not a third-party subprocessor. The company that hosts the server is.

• Stripe — card payments, invoices, and wallet top-ups.
• Messaging carriers — SMS, voice, WhatsApp, number provisioning, and identity checks for numbers.
• Meta Platforms — Messenger, Instagram, and Meta ads, only if the workspace connects them.
• LinkedIn — social planner, only if the workspace connects it.
• Google — Calendar or sign-in, only if the workspace connects them.
• Model providers — AI Sales Manager and AI Ads Manager prompts, only when the workspace uses those features.
• The infrastructure host of our servers.

We will update this list before we add a subprocessor that handles Customer Data in a new category, by changing this page at least 15 days in advance, except where the change is urgent for security. If you object on reasonable data-protection grounds, you may cancel before the change takes effect. Cancellation follows the refund policy.

Subprocessors are bound by written terms that require protection consistent with this DPA.

6. International transfers

Customer Data may be processed outside the workspace's country. Where the law requires a transfer tool, we use an approved one. Ask privacy@pipecove.com for the current hosting country if your own record needs it.

7. Help with requests

We will help the workspace with access, deletion, correction, and objection requests, and with a data-protection impact assessment that the Service specifically gives rise to. Most deletion can be done in the product: delete the contact, delete the document, disconnect the channel, turn off AI, or close the workspace. Email privacy@pipecove.com if the product control is not enough.

We will not answer a contact by handing over the whole workspace. We will point the contact to you or help you answer, unless the law requires us to answer directly.

8. Deletion and return

During the subscription you can export contacts with the tools the plan includes, including CSV. After cancellation we retain Customer Data for 60 days so you can reactivate, then we delete or anonymize it, including backups on their overwrite cycle. We keep what tax, accounting, or a carrier rule requires, and only for that purpose. You may email privacy@pipecove.com to ask us to delete sooner. We will do so within 30 days unless a legal hold applies.

9. Audits

Once in any 12-month period, on 30 days' notice, a workspace may ask for a written description of the controls in section 4 and the subprocessors in section 5. We do not allow unescorted access to production, because it holds other customers' data. If the law gives you a stronger audit right, we will meet it without exposing other workspaces.

10. Liability and order

Liability under this DPA follows the Terms. Where the law says the parties are jointly liable to a person, that law applies, and this sentence does not rewrite it.

If this DPA conflicts with the Terms on a privacy-processing point, this DPA wins. If it conflicts with a platform's required terms for data we receive from that platform, the stricter protection for that platform data wins.

11. Contact

privacy@pipecove.com