Skip to content

Privacy policy

Last updated:

This policy explains what personal data Pipeproposal collects, why, where it is stored, how long it is kept and which service providers process it. Pipeproposal is operated by [Legal entity name], [Registered address] ("we").

Who is responsible for the data

We are the controller of the data about our users: the people who create an account, connect Pipedrive and send proposals ("sellers").

For the data about a seller's own customers (the people who receive, accept, sign or pay a proposal), the seller is the controller and we process that data on the seller's behalf, only to provide the service.

What we collect

  • Account: name, email address, profile picture, a hashed password, and session records with IP address and browser type.
  • Pipedrive connection: company ID, name and domain, the ID, name and email of the Pipedrive user who authorised the app, and the access tokens Pipedrive issues to the app.
  • Data read from Pipedrive when you create a proposal: the deal (title, value, currency, pipeline and stage), its products, and the contact person and organisation (name and email).
  • Seller profile: legal name, address, company and VAT numbers, VAT rate, bank details (account holder, bank name, IBAN), logo, brand colour and the email addresses used for order notifications.
  • Proposals: order lines and amounts, the customer's name, email and language, status history, and when the customer accepts: the date, IP address and browser type.
  • Electronic signatures: the signed document, the signature image and the signing audit trail.
  • Payments: Stripe identifiers for the checkout session, payment and invoice. Card details are entered on Stripe and never reach our servers.

Why we use it

  • To provide the service: create proposals from Pipedrive deals, send them by email, collect acceptance, signatures and payments, and move the deal in Pipedrive. Legal basis: performance of our contract with the seller.
  • To keep the service secure and prevent abuse, using session and acceptance records. Legal basis: our legitimate interest.
  • To keep records required by law, such as accepted orders and invoices. Legal basis: legal obligation.

We do not sell personal data, use it for advertising, or use it to train AI models.

Service providers

  • Vercel Inc. (United States): application hosting.
  • [Database host and region]: database hosting.
  • Cloudflare, Inc. (R2 storage): logos, profile pictures and signed documents.
  • Stripe: card payments and invoices, through the seller's own Stripe account (Stripe Connect).
  • DocuSeal: electronic signatures, on a server we operate ([DocuSeal server host and region]).
  • Resend: sending emails.
  • Pipedrive: the CRM the app connects to, under your own agreement with Pipedrive.

We use the following providers to run the service. Each one only receives the data it needs.

Transfers outside the European Union

Some providers are based in or access data from the United States. These transfers are covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

How long we keep data

  • Account and seller profile: while the account is active. Ask us to delete it at any time.
  • Pipedrive access tokens: erased as soon as the app is uninstalled or disconnected.
  • Proposals, acceptance records, signed documents and invoices: as long as the law requires for commercial and accounting records (in France, up to 10 years), then deleted.
  • Session records: until the session expires or you log out.

Cookies

We only use cookies that the service needs to work: a session cookie that keeps you logged in, a cookie that remembers your language, and short-lived cookies that protect the Pipedrive connection flow. We use no analytics or advertising cookies, so no consent banner is needed.

Your rights

You can ask to access, correct, delete or export your data, or object to or restrict its use, by writing to [privacy@your-domain]. We answer within one month. If you are the customer of one of our sellers, you can also contact that seller directly.

If you think we have not respected your rights, you can complain to your data protection authority. In France, that is the CNIL (www.cnil.fr).

Security

Data travels over HTTPS. Access to each workspace is limited to its members, documents are stored in private storage and shared through short-lived links, and Pipedrive requests to the app are verified with signed tokens.

Changes

If we change this policy, we update the date at the top of this page. For significant changes we also inform account owners by email.