Privacy Policy

Last updated: 10 August 2026

Pipecraft AI Assistant ("the extension") is a browser extension that adds AI features and reporting to the Pipedrive web app. This policy explains what data it handles.

In short: the extension is a "bring your own key" tool. Your Pipedrive API token and AI provider keys are stored locally in your browser and are sent only to the services you choose (Pipedrive and your selected AI provider). We run no analytics, do not track you, and do not sell or share your data.

What is stored, and where

Locally, in chrome.storage.local (your browser only): your Pipedrive company domain and personal API token, your AI provider API key(s), feature toggles, editable prompts, language and voice settings, and short-lived caches of generated results. This data never leaves your device except as described below and is removed when you uninstall the extension.

What is sent, to whom, and why

Pipedrive (*.pipedrive.com): the extension calls the Pipedrive API with your token to read and write your own CRM records (deals, persons, organizations, notes, activities, users) to render overviews, reports, Capture notes/tasks and Smart Filter results.
Your chosen AI provider (Google Gemini, OpenAI, Anthropic, OpenRouter, Perplexity, or Groq): when you use an AI feature, the relevant text — which may include CRM content or a dictated note — is sent to the provider you configured, using your own key. That data is handled under that provider's privacy policy. We are not an intermediary.
Voice dictation: transcription uses your browser's built-in Web Speech API (in Chrome, audio is processed by Google's speech service). If "AI copywriting" or "Translate" is enabled, the transcribed note text is sent to your chosen AI provider for clean-up or translation.

Optional Activity-history server (`api.pipecraft.xyz`)

Activity history is off by default and only runs if you explicitly enable it. When enabled:

Once a day, an aggregate activity snapshot (per-user counts such as tasks done, notes created, stale/no-task deal counts) is stored on our server so the extension can chart trends over time.
To prove you own the workspace, your Pipedrive token is transmitted encrypted (RSA-OAEP) for a one-time ownership check. The server verifies ownership, then discards the token and keeps only a one-way hash of it. The plaintext token is never stored.
You can stop this at any time by turning the setting off.

What we do NOT do

No advertising, analytics, fingerprinting, or behavioral tracking.
No selling, renting, or sharing of your data with third parties.
No use of your data for anything beyond the features you invoke.

Data retention & deletion

Local data lives in your browser until you clear it or uninstall.
Activity snapshots (if you opted in) are retained to build your history; contact us to have your workspace's snapshots deleted.

Security

All network requests use HTTPS/TLS. The optional ownership check uses public-key encryption so the token is never transmitted in plaintext.

Promotion of our other products

Pipecraft may promote its own other products and projects within this website and inside the extension. Any such promotion is our own and does not share your data.

Contact

Questions or deletion requests: privacy@pipecraft.xyz

Not affiliated with or endorsed by Pipedrive. "Pipedrive" is a trademark of Pipedrive OÜ.