Privacy Policy
Version 2026-10-16. Effective 16 October 2026.
This policy explains how PipeKeel handles personal information. The PipeKeel company responsible depends on your organization's home region: Sangita Enterprise (India) or Mukherjee Technology Solutions Ltd. (United States, Canada) — see the Terms.
Two roles
- Controller — for information about the people who use PipeKeel: their accounts, sign-ins and how they use the app. This policy covers that.
- Processor — for personal data inside the data your organization's pipelines process. Your organization decides what that is and why; we process it only on its instructions, under the Data Processing Agreement. Questions about it go to your organization.
What we collect
| Information | Examples | Why |
|---|---|---|
| Account | name, email, password (stored only as an Argon2id hash), organization, region, time zone | create and secure your account |
| Security | two-factor settings (the secret is encrypted), sign-in history, IP address, browser / device type | protect accounts, detect abuse, the audit log |
| Use of the app | pages and actions, pipelines and runs you create, errors | provide and improve the Service, support |
| Audit log | who changed what and when, with IP address | your organization's security and compliance |
| Billing | billing contact, plan, invoices. Card / UPI details go to Stripe or Razorpay, never to us | charge for paid plans, taxes |
| Communications | emails with us, support requests | answer you |
Cookies: only what the app needs to work — a session cookie and a security (CSRF) token, both set by our API. Preferences (such as the theme) are kept in your browser's local storage. No advertising or cross-site tracking cookies.
How we use it
To provide, secure and support the Service; send service emails (verification, security alerts such as a sign-in from a new device, billing, alerts you configure); meet legal obligations (tax, fraud, security); and, in aggregate, understand how the Service is used. We don't sell personal information or use it for advertising. Legal bases, where they apply: performing our contract with your organization, our legitimate interest in a secure and working service, legal obligations, and your consent (where we ask for it).
Who we share it with
Service providers that help run PipeKeel (sub-processors — the current list is in the DPA, Annex 2): cloud hosting, email delivery, payments, edge security. They may use the information only to provide their service to us. We also disclose information when the law requires it, to protect rights and safety, or in a merger or acquisition (with notice).
Where it is stored
Account, configuration and audit information is stored in the United States (Oracle Cloud, Phoenix, Arizona; and Google Cloud). Express pipelines' data is processed and stored in your organization's home region (real-time Kafka streams pass through the United States in memory); Sovereign pipelines' data stays in your own Google Cloud project. Where information is transferred across borders, we protect it as described here and as the law of your country requires.
How long we keep it
While your account exists, then: sign-in records and logs 13 months; audit log as your plan says (at least 1 year); billing records as tax law requires (in India and Canada, typically 6–8 years); after an organization is closed, its data is deleted within 30 days (backups within 35 days).
Security
Encryption in transit and at rest, two-factor authentication, strict separation between organizations, least-privilege access, an append-only audit log, and regular security testing — see the DPA's security annex.
Your rights
Depending on where you live, you can ask to access, correct, delete or get a copy of your personal information, withdraw consent, or object to some uses:
- India (DPDP Act 2023): access, correction, completion, erasure, grievance redressal and nominating someone to exercise your rights. Grievance Officer: Subhadip Mukherjee, [email protected]. If you're not satisfied, you may complain to the Data Protection Board of India.
- Canada (PIPEDA; Quebec Law 25): access and correction; you may complain to the Office of the Privacy Commissioner of Canada (or the Commission d'accès à l'information in Quebec).
- United States: rights under your state's privacy law (for example California's CCPA / CPRA), including to know, delete and correct. We don't sell or share personal information for cross-context advertising.
Write to [email protected]. We'll verify your identity and answer within the time the law sets. If your information is in your organization's pipeline data, we'll pass the request to your organization.
Children
PipeKeel is for businesses and isn't directed to children under 18.
Changes
We'll post changes here and, for material ones, email account owners in advance.
Contact: [email protected] · Sangita Enterprise, Sukanta Palli, Bansberia, Hooghly 712502, West Bengal, India · Mukherjee Technology Solutions Ltd., Unit 3107, 50 Town Centre Court, Scarborough, Ontario M1P 0A9, Canada.