<h2>Separate databases, full encryption<a name="separate-databases-full-encryption"></a></h2>
<p style="text-align: justify">Each company’s data in Pipedrive is stored in a separate database. This avoids any risk of unwanted leaks into another company’s database.</p>
<p style="text-align: justify">The Pipedrive application employs only secure HTTPS connections, where all information is encrypted.<br></p>
<hr>
<h2 style="text-align: justify">Daily backups and backups of backups<a name="daily-backups-and-backups-of-backups"></a></h2>
<p style="text-align: justify">We store backups of your important data, so we can restore your information upon request. All backups of Pipedrive data – no matter where you are – are done through Amazon Web Services. This means your data is safely stored around the globe every day.</p>
<p style="text-align: justify">Read more about our backup systems in <a href="https://support.pipedrive.com/en/article/how-is-data-backed-up-in-pipedrive" target="_blank" rel="noreferrer noopener">this article</a>.</p>
<hr>
<h2 style="text-align: justify">World-class infrastructure<a name="world-class-infrastructure"></a></h2>
<p>We currently host our data in the following AWS regions:<br></p>
<ul><li>EU (Frankfurt)</li><li>EU (Dublin)</li><li>UK (London)</li><li>US East</li><li>US West</li></ul>
<p>For optimized performance and compliance, new sign-ups originating from specific regions will primarily be hosted in specific data centers:</p>
<ul><li>EU: for EU clients</li><li>UK: for non-EU European and EMEA clients</li><li>US: rest of the world.</li></ul>
<div class="support-note success primary"><strong>Note: </strong>Due to external conditions (e.g., IP mappings), company accounts can be hosted in different data centers. If you would like to know exactly where your company’s data is hosted, please <a href="https://support.pipedrive.com/contact-us" target="_blank" rel="noreferrer noopener">reach out to our Support team</a>.</div>
<hr>
<h2 style="text-align: justify">Perfect privacy<a name="perfect-privacy"></a></h2>
<p style="text-align: justify">Your sales data is important and should belong to you and you alone. Pipedrive will not have any knowledge or control over the categories or nature of the data you uploaded into your account. We will only process your sales data as directed by you or as outlined in our <a href="https://www.pipedrive.com/en/terms-of-service" target="_blank" rel="noreferrer noopener">Terms of Service</a>.</p>

How secure is my data in Pipedrive?

separate-databases-full-encryption

Separate databases, full encryption

daily-backups-and-backups-of-backups

Daily backups and backups of backups

world-class-infrastructure

World-class infrastructure

perfect-privacy

Perfect privacy

<p style="text-align: justify">25 May 2018 marks the start of enforcement of the <a href="http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679" target="_blank" rel="noreferrer noopener">European Union's General Data Protection Regulation</a>. This new legislation has significantly impacted anyone whose business involves handling personal data about EU residents or within the EU. Naturally, personal data is at the core of working in sales, so Pipedrive and our users have also been busy making sure that we are compliant.<br><br>This article provides an overview of the data-related roles and responsibilities when you’ve chosen Pipedrive as your CRM platform and will explain Pipedrive’s efforts to live up to the values and requirements of the GDPR.</p>
<hr>
<h2 style="text-align: justify">
<a name="pipedrive-as-the-data-processor"></a>Pipedrive as the data processor</h2>
<p style="text-align: justify">The people you store in Pipedrive as contacts are your data subjects, and you are considered the data controller for this personal data. In our <a href="https://www.pipedrive.com/en/terms-of-service" target="_blank" rel="noreferrer noopener">Terms of Service</a> and <a href="https://www.pipedrive.com/en/privacy" target="_blank" rel="noreferrer noopener">Privacy Policy</a>, we refer to this data as <strong>client data</strong>. <br><br>Using the Pipedrive app to manage your customers means that you have engaged Pipedrive as a data processor to carry out certain processing activities on your behalf.</p>
<p style="text-align: justify">According to article 28 of the GDPR, the relationship between the controller and the processor needs to be made in writing (electronic form is acceptable under subsection (9) of the same article). </p>
<p style="text-align: justify">This is where our <a href="https://www-cms.pipedriveassets.com/documents/Complete_with_Docusign_DPA_Pipedrive_March.pdf" target="_blank" rel="noreferrer noopener">Data Processing Addendum (DPA)</a>, <a href="https://www.pipedrive.com/en/terms-of-service" target="_blank" rel="noreferrer noopener">Terms of Service</a> and <a href="https://www.pipedrive.com/en/privacy" target="_blank" rel="noreferrer noopener">Privacy Policy</a> come in. These three documents serve as your <strong>data processing contract,</strong> setting out the instructions that you’re giving to Pipedrive about processing the personal data you control and establishing the rights and responsibilities of both parties. Pipedrive will only process your client data based on your instructions as the data controller. </p>
<p style="text-align: justify">Lastly, it is crucial to check Section 14.1 of our <a href="https://www.pipedrive.com/en/terms-of-service" target="_blank" rel="noreferrer noopener">Terms of Service</a> to see which Pipedrive entity is your contractual partner.</p>
<p style="text-align: justify">All EU customers have a contractual relationship with our EU entity, based in Estonia.<br></p>
<hr>
<h2 style="text-align: justify">
<a name="data-transfers"></a>Data transfers</h2>
<p style="text-align: justify">One topic that often comes up with customers is data transfers outside the EEA.</p>
<p style="text-align: justify">The GDPR establishes strict requirements for moving data outside its protection scope. This is only natural – otherwise, it would be impossible for the law to fulfill its purpose.<br><br>Who is responsible for meeting these data transfer requirements? As our EU customers have a legal relationship with our EU entity, this data transfer remains within the EEA. However, if Pipedrive subsequently engages sub-processors outside the EEA, it is our job to ensure that we transfer the data lawfully.<br><br>We’ll keep an up-to-date list of sub-processors in our <a href="https://www.pipedrive.com/en/subprocessors" target="_blank" rel="noreferrer noopener">Sub-processors page</a> to be fully transparent about these transfers. This list will also explain what data is involved and how we have ensured that the data is adequately protected even after it leaves the EEA.</p>
<p style="text-align: justify">We do this by ensuring that our third-party service providers have either certified under the EU-US Data Privacy Framework or signed the EU Commission’s standard contractual clauses for data transfers with us.<br></p>
<hr>
<h2 style="text-align: justify">
<a name="pipedrive-as-the-data-controller"></a>Pipedrive as the data controller</h2>
<p style="text-align: justify">Additionally, Pipedrive acts as the data controller for the personal data we collect about you, the user of our web app, mobile apps and website.</p>
<p style="text-align: justify">First and foremost, we process data that is necessary for us to perform our contract with you (GDPR Article 6(1)(b)).</p>
<p style="text-align: justify">Secondly, we process data to meet our obligations under the law (GDPR Article 6(1)(c)) – this primarily involves financial data and information that we need to meet our accountability obligations under the GDPR.</p>
<p style="text-align: justify">Thirdly, we process your personal data for our legitimate interests in line with GDPR Article 6(1)(f).<br><br>What are these “legitimate interests” we talk about?</p>
<ul>
<li>Improving the app to help you reach new levels of productivity</li>
<li>Making sure that your data and Pipedrive’s systems are safe and secure</li>
<li>Responsible marketing of our product and its features<br></li>
</ul>
<p style="text-align: justify">Hopefully, this helps you to navigate the EU’s data protection requirements better. If you have any questions concerning the above, you’re welcome to reach out to us at <a href="https://pipedrive.com" target="_blank" rel="noreferrer noopener">support@pipedrive.com</a>, and we’ll do our best to explain things further.<br></p>
<hr>
<h2 style="text-align: justify">
<a name="what-is-pipedrive-doing-for-the-gdpr"></a>What is Pipedrive doing for the GDPR?</h2>
<p style="text-align: justify">As a company with roots in Europe, Pipedrive is very much up to speed with the implications that the EU General Data Protection Regulation has for businesses.</p>
<p style="text-align: justify">We appreciate the privacy needs of Pipedrive users as well as their customers and, as such, have implemented – and will continue to improve – technical and organizational measures in line with the GDPR to safeguard the personal data processed by Pipedrive.<br></p>
<hr>
<h2 style="text-align: justify">
<a name="internal-processes-security-and-data-transfers"></a>Internal processes, security and data transfers</h2>
<p style="text-align: justify">A large part of GDPR compliance is ensuring that procedures are in place and data processes are mapped and auditable. Therefore, we have added elements to our application development cycle to build features following the principles of <strong>Privacy by Design</strong>.</p>
<p style="text-align: justify">Any access to the client data that we process on your behalf is strictly limited. Our internal procedures and logs ensure that we meet the GDPR accountability requirements in this regard.<br><br>We have established a process for onboarding third-party service providers and adopting tools that ensure that these third parties meet the high expectations that Pipedrive and its customers have regarding privacy and security.<br></p>
<hr>
<h2 style="text-align: justify">
<a name="readiness-to-comply-with-subject-access-requests"></a>Readiness to comply with subject access requests</h2>
<p style="text-align: justify">Data subjects’ ownership of their personal data is at the heart of the GDPR. We are therefore ready to respond to data subject requests to delete, modify, or transfer their data.</p>
<p style="text-align: justify">This means our customer support specialists and the engineers that assist them are well-prepared to help you in any matters involving your personal data, in addition to providing the fantastic customer support experience you’re accustomed to.<br></p>
<hr>
<h2 style="text-align: justify">
<a name="documentation"></a>Documentation</h2>
<p style="text-align: justify">Our <a href="https://www.pipedrive.com/en/terms-of-service" target="_blank" rel="noreferrer noopener">Terms of Service</a> and <a href="https://www.pipedrive.com/en/privacy" target="_blank" rel="noreferrer noopener">Privacy Policy</a> are constantly revised to increase transparency and ensure the documents meet GDPR requirements. As these are the basis for our relationship with you, we must comprehensively and openly explain our commitments and your rights in these documents.</p>
<p style="text-align: justify">Additionally, we’re constantly mapping all our data processing activities to be able to comply with the GDPR accountability requirements.<br></p>
<hr>
<h2 style="text-align: justify">
<a name="training"></a>Training</h2>
<p style="text-align: justify">All of the above is supported by extensive training efforts within the company, ensuring the GDPR-compliant processes we’ve put in place are followed. For example, data privacy and security sessions are an integral part of our onboarding process, and each department receives training tailored to their work involving personal data.<br><br><strong>Pipedrive is firmly convinced that meeting GDPR requirements is much more than just checking off boxes in a list. For us, GDPR represents a lifestyle of respect for individuals' privacy and responsibility in handling personal data.</strong></p>

Pipedrive and GDPR

pipedrive-as-the-data-processor

Pipedrive as the data processor

data-transfers

Data transfers

pipedrive-as-the-data-controller

Pipedrive as the data controller

what-is-pipedrive-doing-for-the-gdpr

What is Pipedrive doing for the GDPR?

internal-processes-security-and-data-transfers

Internal processes, security and data transfers

readiness-to-comply-with-subject-access-requests

Readiness to comply with subject access requests

documentation

Documentation

training

Training

Keep your data safe after deactivating or deleting a user from your Pipedrive account.

<p dir="ltr" style="text-align: justify">In Pipedrive, there are two ways to remove active users from your company account:<br></p>
<ul><li dir="ltr"><p dir="ltr" style="text-align: justify"><strong>Deactivating</strong> a user frees up the seat, allowing you to invite a new user or remove it from the subscription. Deactivating keeps the user’s personal data (like name and email) in the company account.</p></li><li dir="ltr"><p dir="ltr" style="text-align: justify"><strong>Deletion</strong>, on the other hand, completely deletes user details (like their name and email address) from the company account. This action can only be performed after deactivating a user.</p></li></ul>
<p style="text-align: justify">Before deactivating a user, you’ll see a prompt with the data the user in question owns. We recommend reassigning the data if it’s still relevant.</p>
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Modal%20window.png" alt=""></figure>
<p style="text-align: justify">Learn how to deactivate a user in <a href="https://support.pipedrive.com/article/how-can-i-deactivate-or-reactivate-a-user" target="_blank" rel="noreferrer noopener">this article</a>.</p>
<div dir="ltr" class="support-note warning"><strong>Note:</strong> Deactivation and deletion of users are only available to users with account settings access. Before proceeding with user deactivation and deletion, note that these actions may impact created content and owned items associated with the user. We recommend reassigning the data before deactivating and deleting users.</div>
<hr>
<h2 style="text-align: justify">Deactivated users<a name="deactivated-users"></a></h2>
<p dir="ltr" style="text-align: justify">When a user is deactivated, the following changes to their data occur:<br></p>
<p style="text-align: justify"><strong>User information</strong></p>
<ul><li>The deactivated user’s name, email, and profile picture remain in your company account, and you can access the deactivated user overview by navigating to <strong><a href="https://app.pipedrive.com/settings/users" target="_blank" rel="noreferrer noopener">Manage users</a> &gt; Deactivated </strong>and<strong> (...) &gt; User overview </strong>on the right-hand side of the screen.</li></ul>
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Users%20and%20access.png" alt=""></figure>
<p style="text-align: justify"><strong>Item ownership</strong></p>
<ul><li>Leads, deals, contacts, products, activities, projects, and project tasks remain under the deactivated user’s name unless the ownership is transferred</li></ul>
<p style="text-align: justify"><strong>Notes and Files</strong></p>
<ul><li>Notes, comments and files remain under the deactivated user’s name </li></ul>
<p style="text-align: justify"><strong>Emails</strong></p>
<ul><li>Email sync is automatically discontinued</li><li>Shared email templates created by the deactivated user and emails linked to entities remain in the deactivated user’s account</li><li>Private emails linked to entities are deleted after 30 days</li></ul>
<p style="text-align: justify"><strong>Meeting scheduler</strong></p>
<ul><li>The public meeting scheduler link expires after user deactivation</li></ul>
<p style="text-align: justify"><strong>Account syncs</strong></p>
<ul><li>Email sync, contact sync, calendar sync and Google Drive sync are automatically discontinued</li></ul>
<p style="text-align: justify"><strong>Filters</strong></p>
<ul><li>Public filters created by deactivated users remain in the deactivated user’s account</li><li>Existing filter conditions with deactivated users are kept, but new ones can’t be created</li></ul>
<p style="text-align: justify"><strong>Insights</strong></p>
<ul><li>Shared dashboards are automatically transferred to the first admin of the company account</li><li>Public links to dashboards created by the deactivated user are automatically disabled</li><li>Shared reports with other users in the company become inaccessible</li><li>Deactivated users are included in reports and goals if they were initially part of them</li><li>You can create new filters in Insights that include deactivated users as filter conditions</li></ul>
<div class="support-note success primary"><strong>Note:</strong> We recommend transferring report ownership before deactivating the user.</div>
<p dir="ltr" style="text-align: justify"><strong>LeadBooster add-on</strong></p>
<ul><li><strong>Live Chat:</strong> the deactivated user is unassigned from chats, allowing other operators to take over</li><li><strong>Chatbot</strong><strong>:</strong> in the playbook editor, another user automatically replaces the deactivated user. We recommend reviewing the email address in the playbook editor, mainly if a custom email was previously used there.</li><li><strong>Webforms:</strong> in the Webform saving preferences, another user automatically replaces the deactivated user. We recommend reviewing the email address in the saving preferences, mainly if a custom email was previously used there.</li></ul>
<p dir="ltr" style="text-align: justify"><strong>Smart Docs</strong></p>
<ul><li><strong>Documents:</strong> to view and edit a document created by deactivated users, you need to access the cloud storage folder where the document is hosted (<a href="https://support.pipedrive.com/article/where-are-my-documents-stored" target="_blank" rel="noreferrer noopener">read more</a>)</li><li><strong>Templates:</strong> to view and use Smart Docs templates created by deactivated users, the template owner must grant permission in Pipedrive before they’re deactivated. You’ll also need access to the cloud storage folder where the template is hosted.</li><li><strong>eSignatures:</strong> you can access documents sent for signing by deactivated users as long as you have permission to view the deal in which it was created</li></ul>
<p dir="ltr" style="text-align: justify"><strong>DocuSign integration</strong></p>
<ul><li>You can access the documents that were sent for signing by deactivated users</li></ul>
<p dir="ltr" style="text-align: justify"><strong>Quickbooks integration</strong></p>
<ul><li> Invoices created by deactivated users are accessible if another user connects to Quickbooks</li></ul>
<p dir="ltr" style="text-align: justify"><strong>Campaigns</strong></p>
<ul><li>Scheduled campaigns created by a deactivated user will be sent as per the original schedule</li></ul>
<div dir="ltr" class="support-note success primary"><strong>Note:</strong> We recommend reviewing all automations responsible for triggering automated campaign sending if the user who created or with whom the automation is shared becomes deactivated. Further details about the behavior of automations can be found below.</div>
<p dir="ltr" style="text-align: justify"><strong>Automations</strong></p>
<ul><li>If the owner of an automation is deactivated, the automation will be deactivated. We recommend transferring any automation ownership with the trigger setting <code>Triggered by anyone</code>.</li><li>If an automation has the trigger setting <code>Triggered by selected users</code> and a user that triggers the automation is deactivated, the automation will continue to be active and won’t impact the rest of the users.</li><li>If the automation is set to trigger based on any user and one of the users is deactivated, the automation will continue to be active and the deactivated user will automatically be excluded from the automation</li></ul>
<div><strong>Automatic assignment</strong></div>
<ul><li>If a deactivated user is part of an assignment rule, the rule will continue to run but will fail when checking the user’s status. We recommend reviewing all active automatic assignment rules that include the deactivated user (<a href="https://support.pipedrive.com/article/automatic-assignment" target="_blank" rel="noreferrer noopener">read more</a>).</li></ul>
<p dir="ltr" style="text-align: justify"><strong>Marketplace apps</strong></p>
<ul><li>Installed apps by the deactivated user are automatically uninstalled</li><li>If the deactivated user had an admin role, then all shared Marketplace apps are uninstalled</li></ul>
<p dir="ltr" style="text-align: justify"><strong>Webhooks</strong></p>
<ul><li>Webhooks created by deactivated users are automatically deactivated</li></ul>
<hr>
<h2 style="text-align: justify">Deleted users<a name="deleted-users"></a></h2>
<p style="text-align: justify">In addition to the above, when users are deleted, the following data is impacted:</p>
<p style="text-align: justify"><strong>User information</strong></p>
<ul><li>The user’s name, email and profile picture are removed from the company account. Displayed as <code>deleted user</code> or <code>deleted user, IDxxxxxxxx</code>.</li></ul>
<p style="text-align: justify"><strong>Content ownership</strong></p>
<ul><li>Leads, deals, contacts, products, activities, projects, and project tasks remain, still assigned to the deleted user unless ownership is transferred before user deletion.</li></ul>
<p style="text-align: justify"><strong>Filtering</strong></p>
<ul><li>Deleted users can’t be filtered. Ownership transfer is recommended before deletion.</li></ul>
<div class="support-note success primary"><strong>Note:</strong> Only deactivated users can be deleted from the company account.<br></div>

What happens with the data when a user is deactivated or deleted?

deactivated-users

Deactivated users

deleted-users

Deleted users

<div class="support-note primary">
<strong>Note:</strong> Each user can have up to three devices logged into the same account.</div>
<p style="text-align: justify">Pipedrive accounts contain valuable information, so Pipedrive automatically logs you out after a certain period of inactivity.</p>
<p>To remain logged in for a longer period of time, check the <strong>“</strong><strong>Remember me</strong><strong>”</strong> option when you log in.</p>
<p>Pipedrive login sessions last for thirty days if: </p>
<ul><li><strong>”Remember me“</strong> is checked when you log in</li><li>You use Google to remember your login</li><li>You use an <a href="https://support.pipedrive.com/article/single-sign-on" target="_blank" rel="noreferrer noopener">SSO</a> tool</li></ul>
<p style="text-align: justify">Otherwise, login sessions last for twelve hours. </p>
<p style="text-align: justify">However, you don‘t need to worry about being logged out in the middle of your work. Pipedrive keeps you logged in and extends your session if you’re active on the account. </p>
<div class="support-note primary">
<strong>Note:</strong> To help maintain the overall security of your Pipedrive account, check your <a href="https://support.pipedrive.com/en/article/how-can-i-log-myself-out-of-pipedrive-on-my-connected-devices" target="_blank" rel="noreferrer noopener">active device login sessions</a> and <a href="https://support.pipedrive.com/en/article/how-can-i-see-which-devices-i-have-used-to-access-pipedrive" target="_blank" rel="noreferrer noopener">device login history</a> for unusual activity.</div>

Why does Pipedrive log me out?

<div style="text-align: justify" class="support-note success primary"><strong>Note:</strong> If you delete a trial account, it can be recovered for up to 60 days after deletion. For paid accounts, the recovery window is 30 days. </div>
<p style="text-align: justify">How is the data in Pipedrive stored? How reliable are the backups of users’ data? </p>
<ul>
<li>
<strong>Pipedrive has database replicas that sync the databases in real time</strong>. This means that, if something should happen to one of the main database machines, the backup can be switched to quickly ensure continuity of service and no loss of data.</li>
<li>
<strong>Pipedrive conducts nightly complete backups of all the database machines</strong>. These backups can be used to recover data in the event of data corruption. This is used in the event that the database machines are intact, but the data has somehow been corrupted in both the main machines and the replicas.</li>
<li>
<strong>Pipedrive also creates nightly backup files of all the customer databases, encrypts them and stores them securely off-site</strong>.<br>
</li>
</ul>
<p style="text-align: justify">To create a local Pipedrive data backup, simply go to <strong>Tools and apps</strong><strong> &gt;</strong><strong> <a href="https://app.pipedrive.com/settings/export" target="_blank" rel="noreferrer noopener">Export data</a></strong> from the left sidebar menu. From there, generate a spreadsheet of the information you wish to export and then download it to your computer.<br></p>

How is data backed up in Pipedrive?

<p style="text-align: justify">When using Pipedrive lead generation features like <a href="https://support.pipedrive.com/article/chatbot" target="_blank" rel="noreferrer noopener">Chatbot</a> and <a href="https://support.pipedrive.com/article/web-forms" target="_blank" rel="noreferrer noopener">Web Forms</a> and our paid add-on <a href="https://support.pipedrive.com/article/web-visitors-feature" target="_blank" rel="noreferrer noopener">Web Visitors</a>, certain cookies are used to provide the best experience for you and your customers.</p>
<p style="text-align: justify">These cookies are <strong>essential</strong> and can’t be omitted.</p>
<p style="text-align: justify">Furthermore, in order to provide you with the engagement statistics on the dashboard and allow troubleshooting on our end, we track certain events for Chatbot and Web Forms via a <strong>tracking script</strong>.</p>
<hr>
<h2 style="text-align: justify">What cookies are used when using our lead generation features?<a name="what-cookies-are-used-when-using-our-lead-generation-features"></a></h2>
<h3 style="text-align: justify">Chatbot and Web Forms protection<a name="chatbot-and-web-forms-protection"></a></h3>
<p style="text-align: justify">Both Chatbot and embedded Web Forms load a single Cloudflare cookie <code>__cf_bm</code>. This helps to identify and mitigate automated traffic and protect our infrastructure.</p>
<p style="text-align: justify">This cookie is attached to Pipedrive’s domain.<br></p>
<table><tbody><tr><td><div style="text-align: justify"><strong>Service creating the cookie</strong></div></td><td><div style="text-align: justify">Chatbot and Web Forms</div></td></tr><tr><td><div style="text-align: justify"><strong>Cookie name</strong></div></td><td><div style="text-align: justify"><code>__cf_bm</code></div></td></tr><tr><td><div style="text-align: justify"><strong>Cookie type</strong></div></td><td><div style="text-align: justify">Third-party</div></td></tr><tr><td><div style="text-align: justify"><strong>Expiration</strong></div></td><td><div style="text-align: justify">1 hour</div></td></tr><tr><td><div style="text-align: justify"><strong>Purpose</strong></div></td><td><div style="text-align: justify">Set by Cloudflare – bot protection</div></td></tr></tbody></table>
<div class="support-note success primary"><strong>Note:</strong> You can find more information about <code>__cf_bm</code> cookie in Cloudflare documentation <a href="https://developers.cloudflare.com/fundamentals/get-started/cloudflare-cookies/" target="_blank" rel="noreferrer noopener">here</a>.</div>
<h3 style="text-align: justify">Web Forms reCAPTCHA<br><a name="web-forms-re-captcha"></a></h3>
<p style="text-align: justify">When creating new Web Forms or editing the existing ones, you can choose whether the form is spam-protected or not.</p>
<p style="text-align: justify">When Spam Protection is enabled for Web Forms, we use Google reCAPTCHA, which adds a <code>_GRECAPTCHA</code> cookie to provide risk analysis.<br></p>
<table><tbody><tr><td><div style="text-align: justify"><strong>Service creating the cookie</strong></div></td><td><div style="text-align: justify">Web Forms</div></td></tr><tr><td><div style="text-align: justify"><strong>Cookie name</strong></div></td><td><div style="text-align: justify"><code>_GRECAPTCHA</code></div></td></tr><tr><td><div style="text-align: justify"><strong>Cookie type</strong></div></td><td><div style="text-align: justify">Third-party</div></td></tr><tr><td><div style="text-align: justify"><strong>Expiration</strong></div></td><td><div style="text-align: justify">179 days</div></td></tr><tr><td><div style="text-align: justify"><strong>Purpose</strong></div></td><td><div style="text-align: justify">Sent by Google reCAPTCHA when Web Forms spam protection is enabled. When spam protection is not enabled, the cookie won’t be loaded.</div></td></tr></tbody></table>
<div class="support-note success primary"><strong>Note:</strong> You can find more information about <code>_GRECAPTCHA</code> cookie in Google’s FAQ <a href="https://developers.google.com/recaptcha/docs/faq#does-recaptcha-use-cookies" target="_blank" rel="noreferrer noopener">here</a>.</div>
<h3 style="text-align: justify">Web Visitors<br><a name="web-visitors"></a></h3>
<p style="text-align: justify">When adding a tracking script to your website to collect visitor information, Dealfront sets <code>_lfa</code> and <code>_lfa_expiry</code> cookie to track all website visits. In addition, if the Pipedrive/Dealfront customer has configured the consent manager it will create the <code>_lfa_consent</code> cookie to keep track of what the visitor has answered to the consent dialog.</p>
<p style="text-align: justify">The visitor might also see traces of the <code>_lfa_test_cookie_stored</code> as it’s used to check if cookies are enabled or not.<br></p>
<table><tbody><tr><td><div style="text-align: justify"><strong>Service creating the cookie</strong></div></td><td><div style="text-align: justify">Web Forms</div></td></tr><tr><td><div style="text-align: justify"><strong>Cookie name</strong></div></td><td><div style="text-align: justify"><code>_lfa</code></div></td></tr><tr><td><div style="text-align: justify"><strong>Cookie type</strong></div></td><td><div style="text-align: justify">First-party</div></td></tr><tr><td><div style="text-align: justify"><strong>Expiration</strong></div></td><td><div style="text-align: justify">1 year</div></td></tr><tr><td><div style="text-align: justify"><strong>Purpose</strong></div></td><td><div style="text-align: justify">Set by Dealfront script to track website visits</div></td></tr></tbody></table>
<p style="text-align: justify"></p>
<table><tbody><tr><td><div style="text-align: justify"><strong>Cookie name</strong></div></td><td><div style="text-align: justify"><code>_lfa_expiry</code></div></td></tr><tr><td><div style="text-align: justify"><strong>Cookie type</strong></div></td><td><div style="text-align: justify">First-party</div></td></tr><tr><td><div style="text-align: justify"><strong>Purpose</strong></div></td><td><div style="text-align: justify">Set by Dealfront script to track website visits. A local storage variable to store the duration for the Dealfront <code>clientID</code> stored in browser <code>LocalStorage</code></div></td></tr></tbody></table>
<div class="support-note success primary"><strong>Note:</strong> You can find more information about these cookies on Dealfront’s page <a href="https://help.dealfront.com/en/articles/3700007-what-is-the-leadfeeder-tracker" target="_blank" rel="noreferrer noopener">here</a>. According to Dealfront, customers who will have their existing Dealfront accounts connected have the ability to configure cookies on their settings page inside Dealfront.<br></div>
<hr>
<h2>Chatbot and Web Forms event tracking<a name="chatbot-and-web-forms-event-tracking"></a></h2>
<p style="text-align: justify">In order to provide you with the engagement statistics for Chatbot and Web Forms on the feature dashboard and to allow troubleshooting from our end, certain events and end users’ engagement with those features are tracked via a <strong>tracking script</strong>.</p>
<p style="text-align: justify">When doing so, the <strong>tracking script</strong> collects the following information: <code>webformId</code>, <code>embedded (true/false)</code>, <code>URL</code> and <code>type of interaction (viewed/interacted)</code>.</p>
<p style="text-align: justify"><strong>No information about the end user or their device is collected</strong>, except for <code>User Agent</code> which is, however, not used by us in any way, whether to identify end users or otherwise.</p>
<p style="text-align: justify">We also use the features’ engagement information for our own analytical purposes. Nonetheless, we do so only in aggregate form and not in a manner that would identify any end users.</p>
<p style="text-align: justify">The tracking script is always used with the Chatbot and Web Form features.</p>
<p style="text-align: justify">End users can block Java Script and tracking in most browsers. That said, the Chatbot and Web Form features can’t be used in such cases.</p>

Knowledge Base

Data security in Pipedrive

Got any questions?