Legal · Privacy
Privacy Policy
Last updated 28 September 2026
How Pipr handles personal data for the brands that use it, and for the shoppers those brands talk to. The short version: we use your data only to run Pipr for you, we never sell it, and we never use it to train AI models.
Who we are and whose data this covers
This policy explains how Fliqmedia Tech Private Limited (CIN U62090PB2024PTC061247), 15951-D, Street No. 9, Guru Gobind Singh Nagar, Bathinda, Punjab 151001, India (“Pipr”, “we”, “us”) handles personal data when you use heypipr.com and the Pipr platform. Pipr was formerly offered as LinkFliQ.
We handle two kinds of personal data, and our role differs for each:
| Whose data | Examples | Our role |
|---|---|---|
| Merchants: brands that use Pipr, their team members, and website visitors or waitlist sign-ups | Name, work email, phone, company, billing details, dashboard activity | Data fiduciary (controller). This policy applies directly. |
| Shoppers: customers of brands that use Pipr | Messages to a brand on Instagram, Facebook, WhatsApp or website chat; phone number used for store login; orders and carts | Data processor for the brand. The brand decides how this data is used; its own privacy policy applies. |
If you are a shopper and want to access or delete data a brand holds about you, contact that brand first. We will help the brand respond, and you can also write to us at privacy@heypipr.com.
What we collect and why
From merchants and visitors
| What | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Account details: name, email, phone, company, role, password | Create and secure your account, let you invite team members | Contract |
| Billing details: billing name and address, tax ID, payment status (card details are held by our payment partners, not us) | Charge for plans, credits and wallet top-ups, issue invoices | Contract, legal obligation |
| Questions and instructions you give Pipr, and dashboard activity | Run the AI agent, keep your conversation history, support you | Contract |
| Waitlist and contact form entries | Tell you about launch, founding pricing and updates | Consent (withdraw anytime) |
| Device, browser, IP address, pages visited, cookies | Keep the site secure, fix bugs, understand usage | Legitimate interests, consent where required |
| Support emails and calls | Answer you and improve our help | Contract, legitimate interests |
From connected accounts (on the brand’s behalf)
When a brand connects its accounts, we process the data needed to run Pipr for that brand:
- Shopify: products, prices, inventory, orders, carts, discounts and customer records (name, email, phone, address, order history).
- Meta (Instagram, Facebook, WhatsApp): messages and comments sent to the brand, sender name and profile ID or phone number, media shared in conversations, and message status. We do not access personal messages that are not sent to the brand’s business account.
- Meta Ads and Google: campaign, ad and performance data, and search and listing performance.
- Store login: when a shopper logs in on the brand’s store with a phone number and one-time password, we link that phone number to their conversations and orders so the brand can serve them consistently across channels.
We use this data only to provide Pipr to that brand: answering and selling to shoppers, sending campaigns the brand approves, creating listings and insights, and keeping the brand’s records. We never sell it, and we never use one brand’s shopper data for another brand.
AI, sharing and international transfers
How AI is used
Pipr sends the minimum data needed for each task to large language model providers, currently Anthropic and OpenAI, through their business APIs. Under their API terms, these providers do not use that data to train their models. We do not use merchant or shopper data to train any AI model. We may use aggregated statistics that identify no brand or person to run and improve Pipr.
Shoppers talking to a brand on Pipr may be talking to an AI agent. Brands can tell shoppers this, and can hand any conversation to a person.
Who we share data with
We share personal data only with:
| Recipient | Purpose |
|---|---|
| AI model providers (Anthropic, OpenAI; or the provider an Enterprise customer connects) | Generate replies, analysis and content |
| Cloud hosting and database providers | Store and run the Service |
| Meta, Shopify, Google and other platforms the brand connects | Send messages, publish listings, read and update the brand’s accounts, as the brand instructs |
| Payment partners | Process payments and prevent fraud |
| Email, analytics and support tools | Send service and waitlist emails, understand site usage, answer support requests |
| Professional advisers, authorities, courts | When required by law, to protect rights and safety, or to enforce our terms |
| A buyer or successor | If Pipr is involved in a merger, acquisition or sale of assets, under this policy’s protections |
Our service providers may use the data only to provide their service to us, under written contracts with confidentiality and security obligations. A current list of sub-processors is available on request at privacy@heypipr.com.
We do not sell personal data and do not share it for cross-context behavioural advertising.
International transfers
We are based in India, and our providers may process data in India, the United States, the EU and other countries. Where GDPR or UK law applies, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism. We will not transfer data to any country the Government of India restricts under the DPDP Act.
How long we keep data, deletion and security
| Data | How long |
|---|---|
| Merchant account and brand data | While the account is active, then deleted within 30 days of closure (after the 30-day export window) |
| Shopper conversations and records | As long as the brand keeps its account and its retention settings allow; deleted when the brand deletes them or closes its account |
| Invoices and tax records | 8 years, as required by Indian tax and company law |
| Waitlist entries | Until launch plus 12 months, or until you unsubscribe |
| Security and access logs | Up to 12 months |
| Backups | Overwritten within 35 days of deletion from live systems |
Disconnecting a platform
When a brand disconnects Shopify, Meta or another integration, we stop collecting data from it immediately and delete tokens and platform data we no longer need.
Meta data deletion
To delete data Pipr received through Meta (Instagram, Facebook or WhatsApp), email privacy@heypipr.com with the subject “Data deletion” and the account or phone number involved, or remove the Pipr app from your Facebook or Instagram settings. We confirm and complete deletion within 30 days, unless the law requires us to keep something.
Security
We encrypt data in transit (TLS) and at rest, restrict access to staff who need it, store platform access tokens encrypted, keep audit logs and review our providers’ security. No system is perfectly secure. If a breach affects your personal data, we will notify you, the brands concerned and the Data Protection Board of India or other regulators as the law requires.
Your rights
You can exercise these rights by emailing privacy@heypipr.com. We may need to verify your identity. We respond within 30 days, or sooner where the law requires. There is no charge.
Everyone
- Access the personal data we hold about you and get a summary of how we use it
- Correct or update inaccurate or incomplete data
- Delete your data, where we no longer need it or you withdraw consent
- Withdraw consent at any time, for example to waitlist or marketing emails (it does not affect processing already done)
- Opt out of marketing emails using the unsubscribe link
India (Digital Personal Data Protection Act, 2023)
- Grievance redressal through our Grievance Officer (section 6), who will respond within the time the law sets
- Nominate another person to exercise your rights if you die or become incapable
- Complain to the Data Protection Board of India if your grievance is not resolved
EU, EEA and UK (GDPR)
- Restrict or object to processing based on our legitimate interests
- Data portability: receive your data in a machine-readable format
- Complain to your local data protection authority
United States (including California under the CCPA/CPRA)
- Know what personal information we collect, use and disclose
- Delete and correct personal information
- Opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of
- Not be discriminated against for exercising these rights
If you are a shopper and the data came from a brand’s conversations or store, we will pass your request to that brand, which decides how to respond, and help it do so.
Cookies, children, changes and contact
Cookies
heypipr.com uses essential cookies to keep you signed in and secure, and analytics cookies to understand how the site is used. Where the law requires consent, we ask before setting non-essential cookies, and you can change your choice at any time. Pipr does not place advertising cookies on brands’ stores.
Children
Pipr is a business service and is not meant for anyone under 18. We do not knowingly collect children’s data for our own purposes or use it for tracking, behavioural monitoring or targeted advertising. Brands must not use Pipr to process children’s data in breach of the DPDP Act or other laws. If you believe a child’s data has reached us, contact us and we will delete it.
Changes
We will post any update here with a new “Last updated” date. For material changes, we will also notify merchants by email or in the dashboard at least 15 days before they apply.
Grievance Officer and contact
Grievance Officer: Akshay Kheveria, Director
Fliqmedia Tech Private Limited
15951-D, Street No. 9, Guru Gobind Singh Nagar
Bathinda, Punjab 151001, India
Email: privacy@heypipr.com
We acknowledge grievances within 48 hours and aim to resolve them within 30 days.