Privacy policy

Last updated: 4 November 2026

Who we are

PipeMonday is business software for the sales teams of exporter and importer companies, available at app.pipemonday.com and pipemonday.com. It is provided by PipeMonday, [legal entity name and address to be completed]; "we" means PipeMonday. This policy explains what personal data we process, why, where it goes and what rights you have.

Scope and roles

Our customers are organizations, each with its own separate workspace. Responsibility depends on the type of data:

• Prospect data: what customers find and store about target companies and the people who work there. The customer is the data controller; PipeMonday is the data processor, acting only on the customer's instructions.
• Account, billing, support and technical data: collected to run the service itself. PipeMonday is the data controller.

What data we process

• Account data: name, email address, interface language and organization name. There are no passwords; login uses one-time codes.
• Organization and CRM data: companies, contacts, deals, activities, tasks and notes that a customer's users enter, import from Excel or collect with the tool, plus email sequences, replies and quotation requests.
• Prospect data: business contact details of people at target companies (name, job title, business email address), from the customer's records, public websites or third-party data providers.
• Contact form: name, email address, company and message sent through the form on pipemonday.com.
• Technical logs: IP address, browser type, access time, pages and features used, and error reports; needed to operate and secure the service.
• Payments: plan, invoices and payment status. Card details are entered on and stored by iyzico, our payment provider; we never store full card numbers.

Why and on what legal basis

• To provide the service and run your account (performance of a contract).
• To send login codes, notifications and replies to your messages (contract or legitimate interest).
• To invoice and collect payment for paid plans (contract and legal obligation).
• To keep the service secure, prevent abuse and fix problems (legitimate interest).
• To comply with tax, accounting and other laws (legal obligation).

Depending on where you are, Turkish Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR) apply. For prospect data, the customer decides the legal basis. For electronic marketing to recipients in Turkey, Law No. 6563 and the İYS system apply where relevant; compliance is the customer's responsibility.

Cookies

We use only these cookies:

• A session cookie that keeps you logged in.
• A theme cookie that remembers your light or dark preference.
• A language cookie that remembers your interface language.

We do not use advertising cookies, third-party analytics or tracking tools.

Sub-processors and international transfers

We use these providers, each only for the purpose listed:

• Hetzner (Germany, EU): hosting and database; your data is stored in Germany.
• Resend: transactional email (login codes, notifications, contact form delivery).
• OpenAI (API): AI text generation and scoring; the text sent to the model may include company descriptions and the customer's draft content.
• iyzico (Turkey): payments and card storage.
• UN Comtrade: the public trade statistics database used for market research (we only read public data).
• Third-party business data providers and public websites: sources of company and contact information.

Some providers are outside Turkey or the EU; for such transfers we apply the safeguards KVKK and the GDPR require.

Retention

• Account data: kept while your account exists, then deleted or anonymized on request or after closure, unless a law requires longer retention (for example invoices).
• Organization, CRM and prospect data: kept while the customer's account exists, then deleted or anonymized, or earlier at the customer's request.
• Contact form messages: kept as long as needed to handle the request.
• Technical logs: kept only as long as needed for security and troubleshooting.
• Backups: kept for 30 days; deleted data may remain in them until they expire.

Your rights

Under KVKK and the GDPR you can ask us to:

• Tell you whether we process your data and give you a copy (access).
• Correct inaccurate data (correction).
• Delete your data (deletion).
• Stop processing your data in certain cases (objection).
• Give you your data in a machine-readable format (data portability).

You can also complain to the Personal Data Protection Authority in Turkey or to your EU country's data protection authority. To exercise your rights, use the contact form on pipemonday.com; we answer within 30 days. Requests about prospect data held by a customer are forwarded to that customer.

Security

We protect data with access controls, encrypted connections, a separate workspace for each customer, logging and regular backups. There are no passwords to steal. Only people who need it can access production systems. No system is fully secure; if a breach affects your data, we inform you and the authorities as the law requires.

Changes to this policy

We may update this policy when the service or the law changes. The new version is posted here with a new date; for important changes we also notify account holders by email or in the application.

Contact

For questions or requests about this policy, use the contact form on pipemonday.com. Provider: [legal entity name and address to be completed].