Privacy.
This notice covers Pipp's website, product accounts, customer email, AI and connected applications.
Who runs Pipp
Telesoft AG, Weisserlenweg 7, 8966 Oberwil-Lieli, Switzerland. For questions or removal requests, email hello@pipp.so.
For customer personal data processed on your business's behalf, Telesoft acts as a processor or subprocessor under the processing terms. Telesoft is separately responsible for its own account administration, security, service-management and website information described here. The actual purpose of each use determines the data-protection role.
Product accounts and customer email
When you use Pipp, we store your email address, profile name, chosen language, sign-in details and workspace memberships. If you choose Google or GitHub sign-in, we use that service to confirm your identity and may copy your profile photo. We use this information to provide your account, manage team access and send sign-in links and invitations.
Pipp stores the customer email your team forwards to it, including message content, sender and recipient details, attachments, replies, internal notes and conversation activity. Members of a workspace can access its inboxes. We use these records to provide the shared inbox and deliver your team's replies. Your browser keeps a local copy for offline use. Signing out attempts to clear the app's account cache; clearing this site's browser data also removes that local copy. An offline device may retain workspace data until it reconnects.
Pipp's operators can view account and workspace details, memberships, sender settings and usage counts to run the service. Operator page views and changes are logged. The operator admin interface does not display customer messages or AI results.
Services used by the product
Cloudflare hosts the app and its data and runs background work. Turnstile helps protect email sign-in and processes browser and network signals. Customer replies require a verified sending domain. Pipp uses AhaSend for domain provisioning and delivery, and Bunny DNS for the service records used by that setup. Email providers process message content and delivery information to receive or send email. Optional open and click tracking can be enabled for custom-domain sending.
Pipp does not promise that all processing takes place in Switzerland or the EU. The company's Swiss address is separate from where service providers process information.
Read the published data-handling information from Cloudflare, AhaSend and Bunny.
AI settings and processing
Pipp AI is off by default. A workspace Owner or Admin can turn it on or off in Settings or through an agent they connected with admin access. The workspace's account and permission history records who turned AI on or off and when, and, when AI is turned on, that they acknowledged the data-handling information shown there.
When AI is on for a workspace, Pipp sends the content each AI feature needs to Anthropic and OpenRouter. OpenRouter passes it to the company that provides the model in use. AI processing is not limited to Switzerland or the EU. Anthropic keeps this content for up to 30 days, longer only where its usage policies or the law require, and may review it for safety and security. Its commercial terms do not allow it to train models on this content.
Depending on the feature, this can include subjects, customer messages, your team's replies and unsent drafts, display names, attachment filenames, and instructions or preferences people give. Other personal information in message text can be included. Internal notes and attachment contents are not sent.
Some AI features run automatically, for example when a new message arrives. Others run only when someone asks. Owners and Admins can turn AI, or individual AI features, off in Settings, which stops new requests to AI providers. Results Pipp saves, such as summaries or translations, are stored with the workspace and deleted with the conversation they belong to.
Read Anthropic's data-processing information and OpenRouter's privacy information.
Retention and requests
Workspace conversations and their parsed message files remain until their inbox or workspace is deleted. Original raw email copies have a separate thirty-day retention policy. Removing a person's account does not remove messages or notes that belong to a shared workspace. Operator audit history is kept for about thirteen months. Workspace account and permission history is retained for security and recovery, with no automatic expiry currently. Deleted database records may remain in recovery history for up to thirty days. There is no self-service account export in this beta.
For account, privacy, access or deletion requests, contact hello@pipp.so. Workspace Owners and Admins also have the deletion controls described in the app. We do not promise an automatic export or a response deadline.
When you connect an external agent
An external agent is an application you authorize to act for your Pipp account. Pipp stores the application and connection identifiers, your account identifier and name, the connection label, selected workspaces and permissions, and creation, expiry and revocation times. We also store authorization-request details, such as the registered callback, requested permissions and sign-in session reference, and hashes of access and refresh credentials. We use these records to connect the right account, enforce permissions and prevent credential reuse.
You choose the workspaces and actions during authorization. A workspace grant covers all its current and future inboxes. The application remains limited by your current workspace role. A grant does not automatically include other workspaces you later join.
Data returned to the agent's host
Depending on the permissions you grant and the operations requested, Pipp can return your name and email, workspace settings and membership details, customer names and email addresses, message content and headers, attachments and original email, internal notes, conversation activity, saved AI summaries, and your own private reply and note drafts. Administration permissions can expose private forwarding and domain settings. Other people's private drafts are not included.
The application and the service running it, such as ChatGPT when you use that host, receive the information returned to them. They handle it under their own policies and your account's privacy, retention, training and sharing settings. Check those before connecting. Revoking Pipp access does not delete information the host already received.
External-agent access is separate from Pipp's own AI processing. Its data access can include internal notes and attachment contents. The exclusions and address redaction described for Pipp's own AI requests do not filter an authorized agent's reads. Connecting an agent does not enable Pipp AI.
Activity and operation records
Pipp records the person, client, connection and operation involved in external writes. Reply and note records can also identify who prepared the text. Workspace members can see the attribution on sent replies and posted notes in the conversation. You can see your connections and recent operations in Connected agents. Owners and Admins can also see connections and operations concerning their workspace.
Operation receipts let Pipp recognize a retried request and report its earlier outcome. They contain request identifiers, a hash of the submitted operation, its target, timestamps, status and result information. Results can include settings or resource details such as names and email addresses. Message and note text still belongs to the conversation once sent or posted. Historical attribution remains with the record even if you rename your account or disconnect the application.
How long these records remain
A connection currently expires thirty days after its credentials were last issued or refreshed; each refresh moves that date. Authorization-request records become eligible for cleanup one day after their request expires. Expired access-credential hashes are eligible for cleanup at expiry. Refresh-credential hashes remain to detect reuse and become eligible for cleanup thirty days after the credential's own expiry, or thirty days after the connection expires if that is earlier.
Workspace operation receipts become eligible for cleanup after thirty days. Directory operation receipts require both thirty days of age and an expired connection. Connection and grant records become eligible thirty days after connection expiry, once linked requests and operation receipts have been removed. Revocation blocks access but does not bring those expiry dates forward. Cleanup runs periodically, so eligibility is not a guaranteed deletion time.
Registered application metadata currently has no automatic expiry. Attribution kept with a conversation follows that conversation's retention. Workspace account and permission audit history currently has no automatic expiry. Deleted database records can remain in recovery history for up to thirty days. The host's copies follow the host's own retention rules.
Private drafts and removing access
An authorized agent uses the same private reply or note draft as you use in Pipp. Teammates can see that you have a reply draft, but cannot read its unsent text. Revoking the agent's access leaves the saved draft with you. The draft has no automatic expiry. It remains until it is replaced, discarded, consumed by a send or note, or removed with its inbox or workspace. Removing workspace membership ends access but does not automatically delete ordinary reply and note drafts. Draft changes become eligible for synchronization-history cleanup after thirty days. Browser copies and database recovery follow the existing product retention described in this notice.
You can narrow or revoke your own connection in Connected agents. Owners and Admins can remove its access to their workspace. Membership removal ends the affected workspace grant; rejoining needs fresh authorization. An operator restore invalidates affected agent credentials. New calls under an ended grant are refused, but committed work may finish. Pending agent replies can be held for human review or cancelled when permission is lost. Mail already accepted by a provider cannot be recalled through revocation.
For access, privacy or deletion requests, contact hello@pipp.so. Pipp's Swiss company address does not mean the host processes information in Switzerland or the EU.
Website services
Cloudflare serves this website. The product uses Turnstile to protect email sign-in.
Future feature interest
Website analytics
We use Google Analytics 4 to understand visits to this website. It collects pages visited, session activity, approximate location, and browser and device information. Google Analytics uses a first-party cookie to distinguish visitors and sessions. Google receives IP addresses during collection but says it does not log or store them in Google Analytics.
You can block or clear analytics cookies in your browser, or use the Google Analytics opt-out browser add-on. Read Google's privacy policy for how Google handles data.
Language preference
When you choose a language in the footer, we remember it in your browser's local storage. You can remove that preference by clearing this site's stored data. Without a saved choice, the website uses your browser's preferred language.
Notice version
2026-10-22-ai-settings