Privacy Policy

Effective 19 October 2026. Service owner: Nadav Landesman (PipeIO), Israel. Contact: landsmanadav@gmail.com

What PipeIO does

PipeIO is a pipe between WhatsApp and a business. A business connects a WhatsApp number to the service; its customers write to that number. Each message is forwarded to the business's own system (its API) or to PipeIO's agent, and the reply is sent back to the customer on WhatsApp. The service runs on Meta's WhatsApp Business Platform.

Data that passes through the service

• Message content (text, images, files, locations, button taps) passes through in real time and is not stored by PipeIO. It stays with the business (in its system) and with the customer (in their WhatsApp).
• The sender's phone number and the time of each message are stored to route the message to the right business, to prevent duplicates, and to show the business traffic counts (how many messages in and out, and when). No content is stored.
• Business details and its people: the business name, its API address, and the phone numbers and names of the people the business allows to answer through it. The business enters and manages these itself in its portal.
• Portal login codes: a business owner logs in with a code sent from their own WhatsApp. The code, phone number and a browser fingerprint are kept for ten minutes.
• The form on this site sends nothing to PipeIO. It opens a WhatsApp chat with PipeIO's number; the name and business you typed appear in the first message you send.

PipeIO's agent and AI

When a business chooses the agent track, its customers' messages are processed by a language model to draft a reply. For that, message content is sent to the model provider (Anthropic) and is not used to train the model. On the pipe track (the business answers from its own system) PipeIO runs no AI.

Processors

• Meta Platforms (WhatsApp Business Platform), under the WhatsApp Business Terms.
• Supabase: the service database (phone numbers, counts, business details).
• Hetzner (European Union): the servers that run the service.
• Cloudflare: this website and the protective network.
• Anthropic: the language model, agent track only.

Retention

• Routing records (number, time, delivery state): up to 12 months, then deleted.
• Login codes: ten minutes.
• Business details and its people: while the business uses the service, and up to 30 days after it asks to close its account.
• Message content: not stored.

Your rights

You can ask what is stored about you, have it corrected, or have it deleted. Email landsmanadav@gmail.com with the phone number you used. Full instructions on the data deletion page. We answer within 30 days.

Security

All traffic is encrypted (HTTPS). Every call to a business's API is signed with a key the business issues and rotates itself. Database access is split by role: a business's portal sees only that business.

Children

The service is for businesses and their customers and is not directed at children under 13.

Changes

If this policy changes, the date at the top changes with it. A material change is sent to connected businesses.