Privacy Policy

Last updated: October 16, 2026

This policy explains how Pipecove ("we", "us") handles personal information when you use pipecove.com and app.pipecove.com. It is written so a workspace, an agent, a person in a lead list, and a platform reviewer can see the same facts.

We do not sell personal information. We do not use information from Facebook, Instagram, WhatsApp, LinkedIn, or Google APIs to advertise on our own behalf, and we do not transfer it to data brokers.

1. Who this covers

• Workspace customers — the person or business that opens a workspace and pays, if they pay.
• Agents — people a workspace invites in.
• Partners — people with a partner account. See the Partner Program Terms.
• Visitors — people who only read this site.
• Contacts and signers — people whose details a workspace stores, messages, or asks to sign. For that data the workspace is the controller and we are the processor. Section 11 and the Data Processing Addendum cover that role.

2. Information we collect

Account. Name, email, a password hash, business name, billing contact, and two-factor secrets when you turn on an authenticator app.

Workspace content. Contacts, companies, tags, notes, custom fields, custom objects, deals, pipelines, calendar events, appointment details, files, message templates, workflow definitions, and the activity timeline.

Messages. Email you send or receive through a connected mailbox, including attachments and open events when a tracked message is opened. SMS content and delivery status. WhatsApp content and delivery status. Facebook Messenger and Instagram direct messages, attachments, and the basic profile details the platform includes (such as a name or username). Call metadata needed to place, receive, and bill a call.

Phone numbers. Identity, address, and business details a carrier requires before a number can be purchased, and the numbers you buy or release.

Documents. PDFs you upload, edits and stamps, signature images, signer name and email, the time of a signature, and share-link tokens.

Forms and booking. Submissions to a public lead form, including the consent line you displayed, and the slot a person picks on a booking page.

AI. Instructions you save, the conversation context sent to a model, the reply, lead summaries, token counts, and ads drafts or optimizer suggestions. We keep this to provide the feature, to bill the wallet, and to show you a log.

Social and ads. Account identifiers for Facebook, Instagram, and LinkedIn when you connect them, posts and comments you schedule, analytics the network returns, ad account identifiers, campaign drafts, lead-ad submissions, and the contacts you choose to sync to an audience.

API. The contact payload a key submits, and a record that the key was used. We store keys in a form that lets us recognize them. Treat a key as a secret.

Payments. Stripe processes cards. We store a customer reference, the last four digits and brand when Stripe provides them, the plan, invoices, and wallet balance and ledger. We do not store full card numbers.

Product telemetry. Sign-in times, IP address, browser type, pages and features used, and audit events such as an export, a stage change, or a failed sign-in. Five failed sign-ins lock the attempt counter.

Google. If you connect Google Calendar, we receive the events and account identifiers needed to create, update, and display those events. If you use a Google sign-in, we receive the basic profile Google shares for that sign-in. Pipecove's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Where it is stored

The Service runs on infrastructure we administer. The database is PostgreSQL. We do not park the CRM inside another vendor's CRM.

If a contract needs the hosting region, email privacy@pipecove.com before you subscribe and we will tell you the current region in writing.

We take backups so we can restore the service. Backups are kept only as long as needed for that purpose and are then overwritten or deleted.

4. Why we use it

• To provide the CRM you chose: records, search, inbox, calendar, automations, documents, forms, billing, and support.
• To send messages and place calls you or your workflow initiate, and to buy or release numbers you request.
• To apply a carrier's identity requirements before a number is sold.
• To show and send Facebook, Instagram, LinkedIn, and WhatsApp activity you connect.
• To create and sync ads and audiences you ask for, and to draft campaigns when you use AI Ads Manager.
• To generate AI replies and summaries from instructions you saved, and to bill tokens.
• To sync a calendar you connect.
• To secure the Service, prevent abuse, and keep deliverability. Five failed passwords lock sign-in.
• To pay partners the commission the partner terms describe.
• To meet law, tax, and a valid legal request.

We do not use contact lists to market Pipecove to your customers. We do not train public foundation models on your Customer Data. A model provider processes a prompt to produce the reply you asked for, under the terms in the DPA and the AI Use Policy.

5. Cookies

The public site and the app use cookies as the Cookie Policy describes. The marketing site does not run third-party advertising cookies.

6. How long we keep it

We keep account and Customer Data while the workspace is open. After cancellation we retain Customer Data for 60 days so you can reactivate, then we delete or anonymize it, including backups on their normal overwrite cycle. We keep invoices, wallet ledger entries, and carrier records for as long as tax, accounting, or a carrier rule requires, and only for that purpose.

You can delete a contact, a document, or a channel in the product. Disconnecting Facebook, Instagram, LinkedIn, WhatsApp, or Google removes that connection's tokens. Stored threads follow the schedule above unless you ask us to delete sooner.

AI logs are kept so you can see what was sent and so the wallet ledger makes sense. You may ask privacy@pipecove.com to delete instruction text and logs that the law does not require us to keep.

7. Who we share it with

We share personal information with:

• Stripe, for payments.
• Carriers that deliver SMS, voice, WhatsApp, and numbers, including the identity details a number purchase requires.
• Meta, when you connect Messenger, Instagram, or ads, and only for that connection.
• LinkedIn, when you connect it for the social planner.
• Google, when you connect Calendar or use Google sign-in.
• A model provider, when you use AI Sales Manager or AI Ads Manager, limited to the prompt needed for that request.
• The infrastructure host of the servers we run.
• Authorities, when the law requires it.

We do not sell personal information. A workspace's own decision to sync a contact to a Meta audience is the workspace's instruction, not a sale by us.

Agents inside your workspace see what their role allows. Email and phone on a deal stay hidden unless that person also has Contacts.

8. International transfers

Customer Data may be stored or processed in a country that is not yours or the contact's. Where a transfer law requires a mechanism, we use an approved one. Ask privacy@pipecove.com if you need the current hosting country for your own record of processing.

9. Your choices

Workspace admins can export and delete contacts with the tools the plan includes, close the workspace, disconnect a channel, and turn AI off per conversation or for the workspace. Contacts who want access or deletion should ask the business that holds their record. If you email privacy@pipecove.com, we will either point you to that business or help them answer, unless the law requires us to answer directly.

You may object to marketing from Pipecove. Account and service mail about billing and security is not optional while the account is open.

10. Security

We use the measures described on the security page and in the DPA: access control, hashed passwords, two-factor, TLS, restricted database access, and backups. No method of storage is perfect. Please use a unique password and turn on two-factor.

11. Controller and processor

For Customer Data, you are the controller and we are the processor. The Data Processing Addendum is the contract for that role. For our own account data — your login, your invoices, this website — we are the controller.

12. Children

The Service is for businesses. We do not knowingly collect personal information from children. Do not load a child's personal information into a workspace unless you have a lawful reason and your own policy covers it.

13. Changes

We will update this page when the facts change. The date at the top is the date of the last change. A material change is also notified by email or in the product.

14. Contact

privacy@pipecove.com support@pipecove.com