Privacy Policy
1. Overview
PipeFloww is a Shopify app developed by RippleStep that automatically syncs your Shopify customers and orders into Pipedrive CRM as contacts and deals — without manual data entry.
2. Who We Are
Organisation: RippleStep
Product: PipeFloww (a Shopify app by RippleStep)
Data Controller: RippleStep, as the company responsible for how
PipeFloww collects and processes data.
Questions about this policy? Contact us at support@ripplestep.com.
3. Data We Collect
We collect the minimum data required to operate the sync between Shopify and Pipedrive.
3.1 From Shopify Merchants
| Data | Why we collect it | Stored? |
|---|---|---|
| Shop domain | Identify your store, associate all data with it | Yes |
| Shopify session token | Authenticate API requests to Shopify on your behalf | Yes (encrypted) |
| Pipedrive OAuth tokens | Make authenticated calls to your Pipedrive account | Yes (AES-256) |
| Sync configuration (pipeline, stage IDs, toggles) | Know which Pipedrive pipeline and stages to use | Yes |
| Shopify Customer ID ↔ Pipedrive Person ID | Avoid duplicate contacts on re-sync | Yes |
| Shopify Order ID ↔ Pipedrive Deal ID | Avoid duplicate deals on re-sync | Yes |
| Sync logs (per-record: type, action, Shopify ID, Pipedrive ID, status, error) | Show sync history and diagnose issues | Yes |
| Bulk import job status (counts, errors) | Track progress of bulk customer/order imports | Yes |
| Merchant account name & email (from Shopify session) | Stored as part of the Shopify OAuth session | Yes |
3.2 From Your Shopify Customers
The only customer-related data we store:
- Shopify Customer ID (numeric identifier, not personal data)
- Corresponding Pipedrive Person ID
3.3 What We Do Not Collect
4. How We Use Data
RippleStep uses data collected through PipeFloww exclusively to:
- Authenticate with Shopify and Pipedrive on your behalf
- Sync customers from Shopify to Pipedrive as contacts
- Sync orders from Shopify to Pipedrive as deals
- Display sync history and status within the app
- Prevent duplicate records by maintaining ID mappings
- Diagnose errors and improve reliability
We do not use your data for advertising, profiling, or any purpose unrelated to PipeFloww.
5. Data Sharing & Third Parties
RippleStep shares data only with services required to operate PipeFloww:
| Service | Purpose | Data shared |
|---|---|---|
| Shopify | Source of customer and order data | Read via Shopify Admin API |
| Pipedrive | Destination CRM | Customer name, email, phone, address; order value, title, stage; Shopify admin links (as notes) |
| Fly.io | Cloud hosting & database | Hosts our application server and encrypted database |
RippleStep does not sell, rent, or share your data with any other third parties, advertising networks, or data brokers.
6. Data Storage & Security
- All data is stored on Fly.io infrastructure (EU/US regions).
- Pipedrive OAuth tokens are encrypted at rest using AES-256-GCM before being written to the database.
- All data in transit is protected by TLS 1.2+.
- Database access is restricted to the application server only.
- No sensitive credentials are stored in source code or logs.
7. Data Retention
We retain your data for as long as PipeFloww is installed on your store.
- On uninstall: When PipeFloww is uninstalled, we immediately delete your session, tokens, sync config, sync logs, ID mappings, bulk import jobs, and OAuth state on receipt of the
app/uninstalledwebhook. - Shop erasure: Shopify sends a
shop/redactwebhook approximately 48 hours after uninstall. We permanently delete any remaining shop data at that point as a safeguard. - Customer erasure requests: On
customers/redact, we immediately delete that customer's ID mapping and sync log entries.
9. International Data Transfers
PipeFloww is hosted on Fly.io, which operates infrastructure in the United States and European Union. If you are in the EEA, UK, or Switzerland, your data may be transferred to the United States.
Transfers are protected by:
- Fly.io — Data Processing Agreement incorporating EU Standard Contractual Clauses (SCCs).
- Pipedrive — certified under applicable data transfer frameworks with its own DPA.
10. CCPA – California Residents
Under the CCPA and CPRA, California residents have the right to:
- Know — request disclosure of categories and pieces of personal information collected.
- Delete — request deletion of personal information, subject to exceptions.
- Correct — request correction of inaccurate personal information.
- Opt-Out of Sale — we do not sell or share personal information. No opt-out needed.
- Non-Discrimination — we will not discriminate for exercising CCPA rights.
Categories collected
| Category (CCPA) | Examples | Collected? |
|---|---|---|
| Identifiers | Shop domain, Shopify/Pipedrive IDs | Yes |
| Commercial information | Order IDs (no order content stored) | Yes (IDs only) |
| Internet / network activity | Browsing history, interaction data | No |
| Geolocation data | Precise location | No |
| Sensitive personal information | Financial data, health data, SSN | No |
To submit a CCPA request, email support@ripplestep.com with subject "CCPA Request". We respond within 45 days.
11. GDPR & Your Rights
If you are in the EEA, UK, or Switzerland, you have the following rights under GDPR:
- Right of access — request a copy of data we hold about you
- Right to rectification — request correction of inaccurate data
- Right to erasure — request deletion of your data
- Right to restrict processing — limit how we use your data
- Right to data portability — receive your data in a portable format
- Right to object — object to processing based on legitimate interests
Contact us at support@ripplestep.com to exercise these rights. We respond within 30 days.
Legal basis for processing
Merchant data is processed on the basis of contract. End-customer ID mappings are processed on the basis of legitimate interest in preventing duplicate records.
12. Shopify Merchants
As a merchant using PipeFloww, you are responsible for ensuring your use of the app complies with applicable privacy laws and your own privacy policy, particularly regarding how your customers' data is shared with Pipedrive.
PipeFloww is built in accordance with Shopify's API Terms of Service and the Partner Program Agreement.
13. Children's Privacy
PipeFloww is a business-to-business service intended for Shopify merchants. We do not knowingly collect any data from or about children under the age of 13.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we update the "Last updated" date at the top of this page. For significant changes, we notify merchants via the PipeFloww app interface. Continued use constitutes acceptance of the updated policy.
15. Contact Us
For questions, concerns, or requests regarding this Privacy Policy:
- Email: support@ripplestep.com
- Website: ripplestep.com
We aim to respond within 5 business days.