Privacy Policy
Last updated 5 November 2026
Pipeyield is designed to need as little personal data as possible. Your report is built from campaign, keyword and lead-status data, not from names or email addresses. This policy explains what we do collect, why, and your rights.
1. Who is responsible
Pipeyield is operated by an individual business owner based in the Kingdom of Saudi Arabia (email: hello@pipeyield.com). Full operator details are available on request.
- We are the controller of the personal data about our website visitors and customers' contacts, described in section 2.
- For personal data inside files you upload, we act as a processor on your behalf. Our Data Processing Addendum applies (section 4).
2. What we collect
| Data | Examples | Source |
|---|---|---|
| Account and contact details | Your name, work email, company name, country | You, at signup or checkout |
| Billing records | Plan, payment status, invoices, country for tax. Card details stay with Dodo Payments. | Dodo Payments |
| Messages | Emails you send us and our replies | You |
| Technical data | Details needed to serve pages and keep the service secure, such as IP address and browser type. Error logs can include an email address. | Your browser and our servers |
| Usage statistics | Page views, counted without cookies and without identifying you | Cookieless analytics |
| Business contacts | Name, job title, company, work email address and public profile link of people we may contact about Pipeyield | Public sources, such as LinkedIn and company websites. A work email address may be worked out from a company's public email format. |
3. Why we use it, and our legal bases
- To provide the service you subscribed to: your account, reports, billing and support. Legal basis: performance of a contract.
- To keep the service secure and working, and to fix errors. Legal basis: our legitimate interest in running a reliable, secure service.
- To tell you about important changes to the service, terms or prices. Legal basis: contract and legitimate interest.
- To send occasional product news, only if you agree or where the law allows for business customers. Every email has an unsubscribe link. Legal basis: consent or legitimate interest.
- To contact businesses that may need Pipeyield, using work details from public sources. Every first message says where we found you; reply "no" and we delete your details. Legal basis: legitimate interest.
- To meet legal obligations, such as tax and accounting records. Legal basis: legal obligation.
We don't sell personal data, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.
4. Your uploaded files
Reports are built from Google Ads keyword and search-term reports and CRM lead exports. We ask you to remove names, email addresses and phone numbers before uploading, and our export guide tells you which columns to keep. Columns the report doesn't use are removed from the lead file when it is stored.
Uploads can still contain limited personal data, such as click identifiers (GCLIDs) or free-text rejection reasons. We process that data only on your instructions, to produce your reports, as set out in our Data Processing Addendum.
Two small jobs use an AI model provider: grouping free-text rejection reasons (for example "no budget" or "student"), and labelling search terms that have too little data to judge (for example "job seeker" or "wants free"). Only the reason text and the search terms are sent, without names, contact details or spend. Search terms are what people typed into Google, which rarely includes personal data. The provider is not allowed to use any of it to train its models.
5. Who we share it with
We use these service providers to run Pipeyield. Each one receives only what it needs, under contract.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Website, app server and database: customer accounts, uploaded files and reports | Germany (Frankfurt) |
| Cloudflare, Inc. | Domain name (DNS) and cookieless website analytics | United States, global network |
| Dodo Payments | Checkout, merchant of record, invoicing, tax, refunds | See Dodo Payments' privacy policy |
| Google LLC (Google Workspace) | Business email | United States |
| Resend | Sending account and report emails | United States |
| Anthropic, PBC | Grouping rejection reasons and labelling search terms (AI model) | United States |
We may also disclose data if the law requires it, or to protect our rights. If the business is ever sold, data would transfer to the new owner under this policy.
6. International transfers
Customer data is stored in Germany. Pipeyield is operated from Saudi Arabia, and some of our providers (email, payments, AI) are in the United States or elsewhere outside the EU. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to countries without an adequacy decision, we rely on appropriate safeguards. These are the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), or a provider's certification under the EU-US Data Privacy Framework. Ask us for a copy of the safeguards that apply.
7. How long we keep it
- Raw uploaded files: deleted within 7 days of the report they were used for.
- Keyword-level totals behind your dashboard: kept while you subscribe, deleted within 30 days after your subscription ends.
- Free partner accounts: reports and keyword-level totals deleted within 30 days after the last upload.
- Database backups: kept for 7 days, so anything we delete also leaves our backups within a further 7 days.
- Account and contact details: kept while you subscribe and for up to 12 months afterwards, unless you ask us to delete them sooner.
- Billing and tax records: kept as long as tax law requires, typically up to 10 years, mostly by Dodo Payments as merchant of record.
- Server and security logs: up to 30 days.
- Business contacts who don't reply: deleted within 6 months. If you ask us not to contact you, we delete your details right away and keep only a note not to contact you again.
8. Security
Data is encrypted in transit (HTTPS) and at rest with our storage provider. Access is limited to the operator, with two-factor authentication on all admin accounts. We don't ask for, and never need, logins to your Google Ads or CRM accounts. If a breach affects your personal data, we'll tell you without undue delay and as the law requires.
9. Your rights
Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, and to restrict or object to how we use it. Where we rely on consent, you can withdraw it at any time.
- EEA, UK and Switzerland: you can also complain to your local data protection authority.
- Saudi Arabia: under the Personal Data Protection Law, you have the right to be informed, to access, to correct and to have your data destroyed.
To use any of these rights, email hello@pipeyield.com. We reply within 30 days. For data inside a customer's uploads, we'll pass your request to that customer, who controls the data.
10. Cookies and analytics
Our website uses no advertising or tracking cookies, so there is no cookie banner. Visitor statistics come from cookieless analytics that don't identify you or follow you across sites. When the customer dashboard launches, it will use a strictly necessary cookie to keep you signed in.
11. US privacy notices
- California and other US states: we don't sell or share personal information for cross-context behavioural advertising, and we don't knowingly collect data from anyone under 18.
- Do Not Track: because we don't track you across sites, we don't respond differently to Do Not Track signals.
- Changes: you can review the current version of this policy here at any time.
12. Changes and contact
If we change this policy in a meaningful way, we'll update the date above and email customers before the change takes effect. Questions or requests: hello@pipeyield.com.