Privacy Policy

1Two kinds of data we handle

Pipochat handles two different kinds of personal information, and our responsibilities differ for each.

• Data about our users — Information about the businesses and team members who sign up for Pipochat — account details, billing data and usage logs. For this data Pipochat is the data controller and this policy governs how we handle it.
• Data about your customers — Contacts, phone numbers, conversations and files that you upload or receive through the channels you connect. For this data you are the controller and Pipochat acts as your processor: we handle it to provide the Service and follow your instructions. Your own privacy notice governs how you collect and use it.

2Information we collect

We collect the following categories of personal information:

• Account and profile data — Name, work email address, phone number, password (stored hashed), profile picture, language preference, and your role and permissions within your workspace.
• Business data — Company name, business profile, industry, billing or tax identifiers, address, and the WhatsApp Business phone numbers and other channels you connect.
• Contact and CRM data — Names, phone numbers, email addresses, tags, custom attributes, notes, deals, pipeline stages and activities relating to the contacts you manage in Pipochat.
• Message content — Messages, attachments, images, voice notes, documents and templates sent or received through the channels you connect, along with delivery and read status metadata.
• Payment data — Subscription plan, invoices and payment status. Card details are entered directly with our payment processor; Pipochat never stores full card numbers.
• Device and usage data — IP address, device model and operating system, app version, browser type, time zone, the features you use and timestamps of the actions you take in the Service.
• Diagnostics — Crash reports, performance data and error logs, used to diagnose problems and improve reliability.
• Cookies and local storage — Session identifiers and interface preferences stored on your device, described in the cookies section below.

3How we use information

We use personal information to:

• Provide, operate and maintain the Service, including sending and receiving messages on your behalf.
• Create and administer your account, workspace, team members and permissions.
• Process subscriptions, payments, invoices and renewals.
• Send service communications such as security alerts, changes to the Service and answers to your support requests.
• Provide customer support and troubleshoot technical problems.
• Monitor usage, prevent fraud and abuse, and enforce our terms and the messaging policies of the channels you connect.
• Analyse aggregated usage to understand how the Service is used and improve it.
• Comply with legal obligations and respond to lawful requests from authorities.

We do not sell personal information. We do not use the content of your conversations to train models made available to other customers; where AI features are enabled in your workspace, message content is processed only to generate replies and suggestions for that same workspace.

4Legal bases for processing

Where the GDPR or a similar law applies, we rely on the following legal bases:

• Performance of a contract — To provide the Service you signed up for and to bill you for it.
• Legitimate interests — To keep the Service secure, prevent abuse and improve our product, balanced against your rights and freedoms.
• Consent — For optional communications such as product announcements, and where consent is required for cookies. You can withdraw consent at any time.
• Legal obligation — To meet accounting, tax and other legal requirements.

In Argentina, processing is carried out in accordance with Ley 25.326 de Protección de los Datos Personales and its implementing regulations.

5WhatsApp and other messaging channels

When you connect a WhatsApp Business account, messages are sent and received through the WhatsApp Business Platform operated by Meta Platforms, Inc. Message content, phone numbers and delivery metadata are processed by Meta under its own terms and privacy policy, in addition to this one. The same applies to any other messaging channel you choose to connect.

You are responsible for obtaining any opt-in or consent required before messaging your contacts, and for complying with the WhatsApp Business Messaging Policy and the anti-spam laws that apply to you.

6Data we receive from Meta

When you connect WhatsApp, a Facebook Page or an Instagram account, or your Meta ad account, we receive through Meta’s APIs only what is needed to provide the Service to your workspace:

• Connected accounts — The identifiers of your WhatsApp Business numbers, Pages and Instagram accounts, and the access tokens Meta issues to operate them, which we store encrypted.
• Messages — The WhatsApp, Messenger and Instagram Direct messages your customers send you and the ones you send from Pipochat.
• Ad attribution — When a customer writes to you from an ad, the ad, ad set and campaign identifiers, so you can see which ad each conversation came from.
• Ad performance — If you connect your ad account, your campaign metrics, so they can be matched against your sales.

We use this data exclusively to provide the Service to the workspace that connected it, and we comply with Meta’s Platform Terms and Developer Policies. We do not use it for advertising, we do not sell it or transfer it to data brokers, and we do not use it to build or augment advertising profiles.

When you disconnect a Meta account in Pipochat, we delete its access tokens and stop receiving its data. To request deletion of data already received, write to us at the contact address.

7Data we receive from Google

If you connect a Google account to your workspace, we access only:

• Google Calendar — The events of the calendar you choose, to create, update and read the meetings you schedule from Pipochat.
• Google Sheets — The spreadsheets you name in your automations, to append rows to them.
• Your Google address — To show which account is connected.

Pipochat’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use that data for advertising, we do not sell it, we do not use it to train artificial intelligence models, and no person reads it except with your permission, for security reasons or where the law requires it.

When you disconnect Google, we revoke our access with Google and stop syncing.

8How we share information

We share personal information only in the following circumstances:

• Service providers — Cloud hosting, storage, email delivery, error monitoring and analytics providers that process data on our behalf under contract.
• Messaging platforms — Meta Platforms and other channel providers, so that the messages you send can be delivered.
• Meta, to measure your ads — If you turn on sending conversions to Meta, we send Meta the event (for example, a sale) together with the contact’s email, phone and name hashed with SHA-256 and the ad click identifier, so Meta can attribute the result to the campaign.
• Artificial intelligence providers — When AI features are enabled in your workspace, the necessary conversation content is sent to the model providers we use (OpenAI, Anthropic and Google) to generate replies, summaries and suggestions.
• Payment processors — To take payment and issue invoices for your subscription.
• Inside your workspace — Team members in your workspace can see contacts, conversations and activity according to the role and permissions you assign them.
• Legal and safety — When required by law, court order or a valid request from a public authority, or to protect the rights, property or safety of Pipochat, our users or the public.
• Business transfers — If Pipochat is involved in a merger, acquisition or sale of assets, personal information may be transferred. We will notify you before it becomes subject to a different privacy policy.

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

9International data transfers

Pipochat is operated from Argentina and uses infrastructure providers that may store or process data in other countries, including the United States and countries in the European Union. Where personal information is transferred outside your country, we rely on appropriate safeguards such as standard contractual clauses and the international transfer provisions of the applicable law.

10How long we keep information

We keep personal information for as long as your account is active and for as long as we need it to provide the Service.

• Account data — Deleted or anonymised within 90 days of account closure, unless we must keep it longer for legal reasons.
• Contacts and conversations — Kept while your workspace is active. You can delete individual contacts, messages and files at any time from within the Service.
• Billing records — Retained for the period required by tax and accounting law.
• Logs and diagnostics — Typically retained for up to 12 months.

11Security

We protect personal information with encryption in transit, encryption at rest for stored files, hashed passwords, role-based access control, audit logging and regular backups. Access to production data is limited to the personnel who need it to operate the Service, and optional two-factor authentication is available for your account.

No method of transmission or storage is completely secure. If we become aware of a personal data breach affecting you, we will notify you and the competent authority as required by law.

12Your privacy rights

Depending on where you live, you may have the following rights over your personal information:

• Access — Ask what personal information we hold about you and receive a copy of it.
• Rectification — Ask us to correct information that is inaccurate or incomplete.
• Deletion — Ask us to delete your personal information, subject to legal retention requirements.
• Restriction and objection — Ask us to limit or stop certain processing, including direct marketing.
• Portability — Receive the data you provided to us in a structured, machine-readable format.
• Withdraw consent — Withdraw your consent at any time where processing is based on it.

To exercise any of these rights, write to us at the address in the contact section below. We respond within the time limits set by the applicable law and may ask you to verify your identity first.

Argentina: the data subject has the right to obtain access to their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown (art. 14, inc. 3, Ley 25.326). The Agencia de Acceso a la Información Pública is the enforcement authority and may receive complaints about failure to comply with data protection law.

European Economic Area and United Kingdom: you may also lodge a complaint with your local supervisory authority.

California: you have the right to know, delete and correct personal information and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA and CPRA.

If you are a customer of a business that uses Pipochat and you want to exercise rights over the data that business holds about you, please contact that business directly. We will forward to the relevant workspace any request we receive.

13Mobile app permissions

The Pipochat mobile app asks for the following device permissions. Each one is optional, is used only for the feature described, and can be changed at any time in your device settings.

• Camera — To take a photo or scan a code to send in a conversation.
• Photos and media — To attach images, videos and documents to your messages.
• Microphone — To record voice notes.
• Notifications — To alert you about new messages, assignments and mentions.

The app does not collect precise location data and does not track you across apps or websites owned by other companies.

14Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember your language and interface preferences, and protect the Service against cross-site request forgery. We also use a limited set of analytics cookies to understand aggregate product usage.

You can block or delete cookies in your browser settings, but the Service will not work correctly without the strictly necessary ones.

15Deleting your account

You can delete your account at any time from your profile settings in the app, or by writing to us at the contact address below. Deleting your account removes your profile and your workspace's contacts, conversations and files from the Service, except for data we must retain for legal or accounting reasons and copies held in encrypted backups for a limited period before they are overwritten.

16Children

Pipochat is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

17Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the date at the top of this page and, where required, notify you in the app or by email. Continuing to use the Service after an update means you accept the revised policy.