Privacy Policy

This Privacy Policy explains what data PipeDrop ("PipeDrop", "we", "us", or "our") collects, how we use it, and the choices you have. PipeDrop imports contacts from spreadsheets you upload into your Bonzo CRM pipeline. By using PipeDrop you agree to this policy.

1. Data we collect

• Account information — your name, email address, password (stored only as a salted hash), and the organization you belong to.
• Your Bonzo API key — provided by you to connect your Bonzo account. It is stored encrypted at rest using AES-256-GCM and is used only to perform the imports and exports you request.
• Uploaded contact information — the contact data in the files you upload, which may include names, phone numbers, email addresses, and physical addresses. This data is processed so it can be created as contacts in your Bonzo pipeline.
• Usage and billing data — import history, pass and usage data, and access-pass status. Payments are handled by Stripe; we receive billing metadata (such as the pass purchased, payment status, and the last four digits of a card) but never the full card number.

2. How we use your data

• to provide the service — mapping, importing, scheduling, and exporting your contacts to and from Bonzo;
• to authenticate you and secure your account and organization;
• to operate billing, enforce access-pass limits, and prevent abuse;
• to send transactional email (such as sign-in, invites, and account notices);
• to maintain, troubleshoot, and improve the service.

We do not sell your data, and we do not use the contact information you upload for advertising.

3. Subprocessors

We rely on a small number of trusted providers to run PipeDrop. Each processes data only as needed to provide its part of the service:

• Bonzo — the CRM that your contact data is sent to and imported into, at your direction.
• Stripe — payment processing for one-time access passes. Card details are entered on Stripe-hosted pages; we never handle full card numbers.
• Railway — cloud hosting for the application and its database.
• Anthropic — the optional AI column analysis. When you upload a spreadsheet, the column headings we did not recognise, together with up to five example values from each of those columns, are sent once per file so they can be classified (contact field, loan detail, note, or tracking noise). Rows are never sent one by one, and the analysis is skipped entirely when the feature is switched off.
• Resend — delivery of transactional email.

4. Data security

We take reasonable measures to protect your data. Your Bonzo API key is encrypted at rest with AES-256-GCM. The service is served over HTTPS. We never handle full card data in the app — payment card information is collected and stored by Stripe on Stripe-hosted pages. No method of transmission or storage is perfectly secure, but we work to protect your information and limit access to it.

5. Data retention and deletion

We retain your account data and import history for as long as your account is active. You can delete uploaded data and your account at any time. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain certain records to comply with legal, tax, or accounting obligations. To request deletion, email info@ethanwood.org.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at info@ethanwood.org. Because PipeDrop imports data on your behalf, requests from the individuals whose contact data you uploaded should generally be directed to you as the controller of that data; we will assist you as your processor where required.

7. Cookies and local storage

PipeDrop keeps its cookie and tracking footprint minimal. We do not use third-party advertising or analytics cookies. To keep you signed in, the app stores your authentication token in your browser's localStorage. Clearing your browser storage will sign you out.

8. Children

PipeDrop is a business tool not intended for children. It is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of PipeDrop after changes take effect constitutes acceptance of the revised policy.

10. Contact

Questions about privacy or your data? Email us at info@ethanwood.org.