Privacy Policy
Last updated 9 November 2026
Pipeyield is designed to need as little personal data as possible. Your report is built from campaign, keyword and lead-status data, not from names or email addresses. This policy explains what we do collect, why, and your rights.
1. Who is responsible
Pipeyield is operated by an individual business owner based in the Kingdom of Saudi Arabia (email: hello@pipeyield.com). Full operator details are available on request.
- We are the controller of the personal data about our website visitors and customers' contacts, described in section 2.
- For personal data inside files you upload, we act as a processor on your behalf. Our Data Processing Addendum applies (section 4).
2. What we collect
| Data | Examples | Source |
|---|---|---|
| Account and contact details | Your name, work email, company name, country | You, at signup or checkout |
| Billing records | Plan, payment status, invoices, country for tax. Card details stay with Dodo Payments. | Dodo Payments |
| Messages | Emails you send us and our replies | You |
| Free check | Work email, date, the link's source tag (such as utm_source), and the headline numbers (monthly total, the pause and block lines, the biggest keyword). Only if you tick the box: your three files, kept to make your first full report | You, when you run a free check |
| Export steps request | Work email, date, and the link's source tag | You, when you ask us to email the export steps |
| Technical data | Details needed to serve pages and keep the service secure, such as IP address and browser type. Error logs can include an email address. | Your browser and our servers |
| Usage statistics | Page views and the referring site, counted from our server logs and with Cloudflare Web Analytics, and how many visitors start the free check form, counted per day and source. No cookies, and nothing that identifies you. | Our server logs and Cloudflare Web Analytics |
| Stop list | Your email address, the date and how you asked us to stop (the stop link, a reply, or a complaint) | You, when you ask us to stop emailing you |
| Business contacts | Name, job title, company, work email address and public profile link of people we may contact about Pipeyield | Public sources, such as LinkedIn and company websites. A work email address may be worked out from a company's public email format. |
3. Why we use it, and our legal bases
- To provide the service you subscribed to: your account, reports, billing and support. Legal basis: performance of a contract.
- To run a free check you ask for, email you the result, follow up about it, limit free checks to 3 a month per company, and check whether your company qualifies for a free first report. Legal basis: legitimate interest.
- To make your first full report, only if you tick the box on the free check form and your result is $300 or more a month: we keep your three files and build the report from them. When your first report starts, we create a Pipeyield account for your work email so you can sign in to see it. It holds no payment details. Legal basis: your request (steps taken at your request before a contract).
- After a free check we may email you up to three times about your result, and once early the next month to suggest a new check. One click stops these emails.
- To email the export steps you ask for, and up to 2 follow-ups. Replying "no" or one click stops them. Legal basis: legitimate interest.
- After a first report provided at no charge, we may email you up to three times about keeping it. A reply or one click stops these emails.
- To respect a request to stop: every marketing email from us has a one-click stop link, and we never send two within 2 days. If you ask us to stop, we keep your email address on a stop list so we never write to you again; it's kept for as long as needed for that. Sign-in links and reports you ask for still come. Legal basis: legitimate interest.
- To keep the service secure and working, and to fix errors. Legal basis: our legitimate interest in running a reliable, secure service.
- To tell you about important changes to the service, terms or prices. Legal basis: contract and legitimate interest.
- To send occasional product news, only if you agree or where the law allows for business customers. Every email has an unsubscribe link. Legal basis: consent or legitimate interest.
- To contact businesses that may need Pipeyield, using work details from public sources. Every first message says where we found you; reply "no" and we delete your details. Legal basis: legitimate interest.
- To meet legal obligations, such as tax and accounting records. Legal basis: legal obligation.
We don't sell personal data, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.
4. Your uploaded files
Reports are built from Google Ads keyword and search-term reports and CRM lead exports. We ask you to remove names, email addresses and phone numbers before uploading, and our export guide tells you which columns to keep. Columns the report doesn't use are removed from the lead file when it is stored.
Uploads can still contain limited personal data, such as click identifiers (GCLIDs) or free-text rejection reasons. We process that data only on your instructions, to produce your reports, as set out in our Data Processing Addendum.
Three small jobs use an AI model provider: grouping free-text rejection reasons (for example "no budget" or "student"), labelling search terms that have too little data to judge (for example "job seeker" or "wants free"), and, when a lead file uses unusual column names, suggesting which column is which. Only the reason text, the search terms, the column names and short status values such as "Qualified" are sent, never names, contact details or spend. Search terms are what people typed into Google, which rarely includes personal data. The provider is not allowed to use any of it to train its models.
5. Who we share it with
We use these service providers to run Pipeyield. Each one receives only what it needs, under contract.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Website, app server and database: customer accounts, uploaded files and reports | Germany (Frankfurt) |
| Cloudflare, Inc. | Domain name (DNS); the robot check on the free-check form (Turnstile), which receives your IP address and technical details from your browser; and page-view statistics on pipeyield.com (Web Analytics, no cookies) | United States, global network |
| Dodo Payments | Checkout, merchant of record, invoicing, tax, refunds | See Dodo Payments' privacy policy |
| Google LLC (Google Workspace) | Business email | United States |
| Resend | Sending account and report emails | United States |
| Anthropic, PBC | Grouping rejection reasons, labelling search terms and suggesting column names (AI model) | United States |
We may also disclose data if the law requires it, or to protect our rights. If the business is ever sold, data would transfer to the new owner under this policy.
6. International transfers
Customer data is stored in Germany. Pipeyield is operated from Saudi Arabia, and some of our providers (email, payments, AI) are in the United States or elsewhere outside the EU. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to countries without an adequacy decision, we rely on appropriate safeguards. These are the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), or a provider's certification under the EU-US Data Privacy Framework. Ask us for a copy of the safeguards that apply.
7. How long we keep it
- Raw uploaded files: deleted within 7 days of the report they were used for.
- Keyword-level totals behind your dashboard: kept while you subscribe, deleted within 30 days after your subscription ends.
- Free accounts (partner accounts, and accounts whose first report was provided at no charge): reports and keyword-level totals deleted within 30 days after the last upload.
- Free check files: deleted right after the check, unless you tick the box to keep them for your first full report; then they're deleted within 7 days. Free check records and export steps requests: deleted after 12 months.
- We keep anonymous facts about each report and free check, such as file types, column names and counts, to improve the product. They contain no names, email addresses, keywords or amounts, and are deleted after 12 months.
- Database backups: kept for 7 days, so anything we delete also leaves our backups within a further 7 days.
- Account and contact details: kept while you subscribe and for up to 12 months afterwards, unless you ask us to delete them sooner.
- Billing and tax records: kept as long as tax law requires, typically up to 10 years, mostly by Dodo Payments as merchant of record.
- Server and security logs: up to 30 days.
- Stop list: your email address, kept for as long as needed so we never write to you again.
- Business contacts who don't reply: deleted within 6 months. If you ask us not to contact you, we delete your details right away and keep only a note not to contact you again.
8. Security
Data is encrypted in transit (HTTPS) and at rest with our storage provider. Access is limited to the operator, with two-factor authentication on all admin accounts. We don't ask for, and never need, logins to your Google Ads or CRM accounts. If a breach affects your personal data, we'll tell you without undue delay and as the law requires.
9. Your rights
Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, and to restrict or object to how we use it. Where we rely on consent, you can withdraw it at any time.
- EEA, UK and Switzerland: you can also complain to your local data protection authority.
- Saudi Arabia: under the Personal Data Protection Law, you have the right to be informed, to access, to correct and to have your data destroyed.
To use any of these rights, email hello@pipeyield.com. We reply within 30 days. For data inside a customer's uploads, we'll pass your request to that customer, who controls the data.
10. Cookies and page views
Our website sets no cookies, so there is no cookie banner. Page views and the referring site are counted from our server logs and with Cloudflare Web Analytics, which uses no cookies. Neither identifies you or follows you across sites. The customer dashboard uses one strictly necessary cookie to keep you signed in. The free-check form runs Cloudflare Turnstile, a robot check that reads technical details from your browser, and may store a small value in it, only to tell people from automated abuse. It isn't used for advertising or to follow you across sites. See Cloudflare's Turnstile privacy addendum.
11. US privacy notices
- California and other US states: we don't sell or share personal information for cross-context behavioural advertising, and we don't knowingly collect data from anyone under 18.
- Do Not Track: because we don't track you across sites, we don't respond differently to Do Not Track signals.
- Changes: you can review the current version of this policy here at any time.
12. Changes and contact
If we change this policy in a meaningful way, we'll update the date above and email customers before the change takes effect. Questions or requests: hello@pipeyield.com.