Pipekeep
Sign in

Privacy Policy

Last updated 12 October 2026

Pipekeep is a customer-relationship tool that businesses use to capture leads, follow up with them and see which campaigns produce revenue. It is run by the operator of Pipekeep (“we”). This page explains what personal data the service handles, why, who else processes it, how long it is kept and what rights you have, including under India’s Digital Personal Data Protection Act, 2023.

1. Two kinds of personal data, two roles

  • People who use the CRM (a business’s owners, managers and sales team). For their accounts we decide how the data is used: we are the data fiduciary.
  • Leads and customers of those businesses (people who fill in a form, book a call, send a WhatsApp message or make a payment). Each business (the workspace) decides what it collects and why: it is the data fiduciary, and we process that data on its behalf as its data processor. If you are such a lead, please contact the business you dealt with first; we will help it answer you.

2. What we collect from people who use the CRM

  • From Google sign-in: your name, email address and profile picture.
  • Your role in each workspace, and what you do in the CRM (for example, who moved a deal or logged a call), kept in an audit log.
  • If you connect them: your Google Calendar (events and busy times, to sync appointments) and, for workspace admins, the business’s WhatsApp account. Their access tokens are stored encrypted.
  • Technical data: your IP address (to limit abuse of sign-in and public forms) and the hosting provider’s standard request logs.

3. What the CRM holds about leads (on behalf of the business)

  • Contact details: name, email, phone, city, and the answers given in the business’s forms.
  • Where the lead came from: the campaign, ad set, ad and page, and the consent the form recorded.
  • The sales history: calls, notes, tasks, appointments, deal stages and payments.
  • WhatsApp conversations with the business, the person’s WhatsApp opt-in or opt-out, and email delivery events (delivered, opened, clicked, unsubscribed).

4. Why we use it

  • To provide the service the business signed up for: storing leads, routing them to the right person, reminders, automations, reports.
  • To keep it secure: sign-in, permissions, separating one business’s data from another’s, preventing abuse.
  • To send the messages the business sets up (email, WhatsApp, calendar invitations), only under the consent rules described in section 7.
  • To fix problems and to meet legal obligations.

We do not sell personal data, show advertising, or use it to train AI models. We do not use lead data for our own purposes.

5. Cookies

We use only cookies that the service needs to work: one that keeps you signed in (up to 30 days) and a short-lived one while you connect Google Calendar. There are no analytics, advertising or tracking cookies. Lead forms and booking pages set no cookies; they count page views as daily totals without identifying anyone.

6. Services that process data for us

These companies process data on our behalf, only for the purpose shown. Several are outside India; transfers follow the DPDP Act and the companies’ own data-protection terms.

  • VercelHosting: runs the applicationWhere: India (Mumbai) · Always
  • NeonDatabase: stores all CRM dataWhere: India (Mumbai) or Singapore · Always
  • Google (Firebase Authentication)Sign-in with a Google accountWhere: Global · Always
  • cron-job.orgStarts scheduled background work (receives no personal data)Where: Germany · Always
  • GitHubEncrypted nightly database backups, kept 7 daysWhere: United States · When backups are switched on
  • Meta PlatformsWhatsApp messages; Conversions API events (hashed email and phone); lead formsWhere: Global · When a workspace connects it
  • Google (Calendar API)Two-way calendar sync of appointmentsWhere: Global · When a person connects their calendar
  • ResendSending email (sequences, reminders, invitations)Where: United States · When email sending is set up
  • AnthropicAI summaries of WhatsApp conversations, and the AI setter's replies (the conversation, the lead's name, city and source, and the business's brief)Where: United States · When someone asks for a summary, or the workspace turns the AI setter on
  • Razorpay / StripeSend us payment events so payments can be matched to dealsWhere: India / Global · When a workspace connects it
  • SentryError reports (personal data and request bodies are not sent)Where: United States · When error reporting is set up

7. Messages to leads

  • Marketing emails carry a one-click unsubscribe link and are not sent to people who unsubscribed; addresses that bounce or complain are suppressed.
  • WhatsApp: free messages only within 24 hours of the person’s last message; otherwise only templates approved by Meta, and only to people who opted in. Replying STOP opts out. Contacts marked “do not contact” receive nothing.
  • Automated WhatsApp messages (not reminders or confirmations) wait until the business’s quiet hours end, and the same automated message is not sent twice within an hour. Each opt-in records which consent wording the person agreed to.
  • Businesses must collect leads lawfully and with consent; our Terms of Service require it.

8. How long we keep it

Leads, contacts, deals, notes, calls, appointments, payments, messages
Until the workspace deletes them, or the workspace is deleted
Original copy of an incoming lead (as received)
180 days, then cleared; the lead itself stays
Integration logs (requests to and from other services)
90 days
Automation run details
180 days
Read notifications
90 days
Sign-in sessions
30 days of inactivity, then deleted within 7 days
Audit log (who changed what)
2 years
AI usage records (counts and timings, never message text)
13 months
Rate-limit counters (contain IP addresses)
1 day
A deleted workspace
Kept 30 days so it can be restored, then erased
Encrypted backups
7 days

A business can erase a single lead at any time, and export its data from Settings → Data.

9. Security

Data travels encrypted (HTTPS). Each business’s data is kept apart by the database itself, not only by the application. Access inside a workspace follows the person’s role. Passwords are never stored (sign-in is through Google), and tokens for connected services and webhook secrets are encrypted. If a personal-data breach happens, we will inform the affected businesses and the Data Protection Board of India as the law requires.

10. Your rights

You may ask to see the personal data we hold about you, to correct or complete it, to erase it, and to nominate someone to act for you. You may withdraw consent at any time (this does not affect what was done before). If you are a lead of a business that uses Pipekeep, contact that business; you may also write to us and we will pass your request on and help it respond. We answer within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

11. Children

The service is for businesses and is not meant for anyone under 18. We do not knowingly process children’s data for our own purposes.

12. Changes

When this policy changes we update the date at the top and, for important changes, tell workspace owners in advance. See also our Terms of Service.

13. Contact and grievances

Questions, requests and complaints about privacy:

Operator
—
Email
Ask the person who invited you to the CRM for our contact address.