Privacy Policy — Pipely

Last updated: October 2026 · Operated by Ofek Badigital (Israeli business no. 207053760) · Contact: ofek4business@gmail.com

1. About Pipely

Pipely (www.pipely.co.il) is a CRM for marketing agencies, advertisers and businesses. Leads from Facebook and Instagram lead forms, websites, webhooks, phone calls and WhatsApp arrive in one board; the team follows up, books meetings, and closed deals are reported back to the advertising platforms so campaigns optimize for real customers. This policy explains what data we collect, how we use it and how we protect it.

2. Data we collect and connected platforms

Users can connect advertising and messaging platforms, including Meta (Facebook/Instagram), Google Ads, TikTok and WhatsApp. When connected, we request permission to read campaign data, receive leads and send conversion events. Lead data may include name, phone number, email address and any other details the lead entered in the user's forms.

3. How we use data

• To show leads and campaign data in the dashboard of the user the data belongs to.
• To send conversion events (for example, a closed deal) back to the user's own advertising accounts, so their campaigns can optimize.

We act as a data processor only. The user (the agency or business) owns their lead data. We never sell, rent or share lead data or access tokens with third parties, and never use them for our own marketing.

4. Google user data

Google Ads (scope: adwords): used to list the ad accounts the user can access, to upload offline conversions for leads that became customers (with the click id, and email and phone hashed with SHA-256), to read calls from ads, and to show ad spend. Data is used only inside the connected user's own Pipely account.

Google Calendar (scope: calendar.events): used to create, update and remove events for meetings booked in Pipely in the user's primary calendar; to pick up changes the user makes to those events in Google (moved or deleted); and to show the user's other events inside the Pipely calendar so they can avoid double booking. Other events are displayed only and are not stored. Pipely stores only the connection tokens and the ids of the events it created. Disconnecting removes Pipely's upcoming events from Google, revokes access and deletes the stored tokens.

Google user data is not used for advertising, is not sold, is not transferred to others except as needed to provide these features, and is not used to train AI models. Pipely's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share, transfer or disclose Google user data to

Data received from Google APIs (Google Ads and Google Calendar) is shared only with the following, and only as needed to provide the features the user asked for:

• Google itself: conversions for leads that became customers are uploaded to the user's own Google Ads account (click id, and email and phone hashed with SHA-256), and meetings booked in Pipely are created, updated and removed in the user's own Google Calendar.
• Our infrastructure provider, Supabase: hosts our database and servers and stores, on our behalf, the connection tokens, the ids of the calendar events Pipely created, and Google Ads spend and call data. It acts as a data processor for us under its Data Processing Addendum, which forms part of its Terms of Service: it processes this data only to provide its service to us and does not use it for any other purpose.
• People the user has authorized in their own Pipely account: the user's team members and, when the business is managed in Pipely by a marketing agency, that agency's staff. They can see the Google Ads data and the meetings inside that account.
• Anthropic, only if the Claude connection is enabled: when an agency has turned on the Claude connection and a user asks a question about ad performance, Google Ads campaign names and spend amounts may be sent to Anthropic to answer that question only. Google Calendar data is not sent through this connection.
• When required by law: to comply with a law, court order or lawful request from an authority, or as part of a merger or sale of the business, in which case users will be notified in advance.

We do not share Google user data with anyone else: we do not sell it, do not transfer it to data brokers or advertisers, do not use it for advertising, and do not use it to train AI models.

5. Security

Data is stored on secure cloud infrastructure (Supabase). Access is restricted so that each user can see and manage only the data that belongs to their account. Connection tokens are stored server-side and are never shown in the browser after connecting.

6. Other connected services

WhatsApp: messages sent to or received from leads are kept on the lead's card so the user can manage the conversation; files are kept in private storage and deleted according to the retention policy. Access to the WhatsApp Business account: when a user connects their number through Meta's official connection flow (Embedded Signup), they grant the Pipely CRM app, and the business that operates it as a Meta Tech Provider, access to their WhatsApp Business account. Meta's connection window shows our business portfolio name, "אופק כהן קידום בדיגיטל". This access is used only to run the service for the user: sending and receiving messages from within Pipely (including automations and bots the user set up), managing message templates and receiving status updates. The account and the number remain owned by the user. We do not send messages on our own initiative, do not use the account for any other purpose and do not pass the access to third parties. The user can disconnect at any time from Pipely's settings, or remove the access in their Meta business settings; after that, messages can no longer be sent or received on that number through Pipely. Phone calls: when a phone system is connected we receive call details (caller number, duration, recording link, and sometimes a summary or transcript made by that system); we do not record calls ourselves; recording links and transcripts are deleted after 90 days. Claude: an agency that enables the Claude connection lets its users ask questions about their lead data; data is sent to Anthropic only when a user asks, only as needed for the answer; contacts can be masked and the connection can be turned off at any time.

7. Your rights and data deletion

Any user may ask to delete their account or specific lead data at any time, including disconnecting Meta, Google or TikTok and deleting all lead history, by writing to ofek4business@gmail.com. We delete the requested data within 7 business days. Users can also disconnect Google Ads or Google Calendar themselves from inside Pipely at any time, and revoke access from their Google Account settings.