Privacy policy: Orbifetch Tech Stack

This policy covers the Orbifetch Tech Stack app for Pipedrive (“the app”) and its service at crm.orbifetch.com, operated by Orbifetch (“we”). Our general website policy is at orbifetch.com/privacy.

In short

• The app reads organization records only: the record ID and the website. It never reads persons, deals, leads, activities, emails, notes, files or users’ personal details.
• It writes only to the ten “Tech:” organization fields it creates.
• OAuth tokens are encrypted. We delete them as soon as you uninstall.
• We don’t sell or share your data, and we use no trackers or advertising. The orbifetch.com website keeps only cookieless daily visit totals (page, referring site, country, device type).

Data we access in Pipedrive

• Organizations: ID and website field (or the custom website field you choose), to know which website to analyze; the “Tech: Detected at” value, to avoid re-enriching fresh records; and the Tech fields we write.
• Organization fields: the list of field names and keys, to create our ten fields once and find the website field.
• Your user and company ID: read once at install (/users/me) to link the installation to your Pipedrive company. We keep the numeric IDs only, not names or emails.
• Webhooks: the app registers webhooks for organization create/change events. Pipedrive’s webhook body contains the whole organization; we use only its ID and website and do not log or store the rest.

Requested scopes: base, contacts:full (read and update organizations; the scope also covers persons, but the app never calls person endpoints), contact-fields:full (create the Tech fields) and webhooks:full (automatic enrichment).

Data we store

• Installation: Pipedrive company ID, installing user’s numeric ID, your Pipedrive API domain, OAuth access and refresh tokens and a webhook password (encrypted with AES-256-GCM), the keys of our fields and your app settings.
• Usage: the company website domains enriched for your account each month, used to count your monthly quota and to settle billing questions.
• Website analysis cache: for each analyzed domain, the technologies detected and when. This describes public websites of organizations, not people, and is shared across customers.
• Billing: your plan, Freemius license ID, install ID, expiry date and the license key (encrypted).
• Bulk runs: progress counters of “Enrich all” runs (numbers only).

We never store names, email addresses or phone numbers of people from your CRM.

How websites are analyzed

Most websites are matched against our monthly crawl of the public homepages of the top websites. Other websites are analyzed live: one request to the public homepage (following robots.txt, User-Agent OrbifetchBot/1.0) and public DNS records. We never log in, fill forms or bypass bot protection.

Retention and deletion

• Uninstall: when you uninstall, Pipedrive notifies us and we delete the installation (tokens, webhook password, settings) and pending bulk runs at once. The Tech fields and their values stay in your Pipedrive until you delete them.
• Usage records: kept for 13 months, then deleted.
• Website analysis cache: refreshed or expired after 30 days (failed analyses after 7 days).
• Billing records are kept while you have a license and as required for tax and accounting.
• To delete everything about your account sooner, email support@orbifetch.com from an address at your company. We do it within 30 days and confirm.

Payments

Paid plans are sold by Freemius (Freemius, Inc.), our merchant of record. Freemius processes your name, email, billing address and payment details under its own privacy policy and sends us your license and order details so we can activate your plan and support you. We never see your card details. When you activate a license key, the app sends the key and a random-looking installation ID derived from your Pipedrive company ID to Freemius, and re-checks it once a day.

Sub-processors

• Cloudflare, Inc.: hosting of the app (Workers, D1 database), worldwide network.
• Freemius, Inc.: billing and licensing, merchant of record.
• Pipedrive OÜ: your CRM, which sends us the data described above.

Security

All traffic uses HTTPS. OAuth tokens and license keys are encrypted at rest; webhooks are authenticated with a per-install password; the Pipedrive panel is verified with Pipedrive’s signed token; settings links are signed and expire. Access to production systems is limited to the operator.

Your rights

You can ask for a copy, correction or deletion of the data we hold about your account, and object to processing, by emailing support@orbifetch.com. For data in your CRM we act as a processor on your behalf; you remain the controller of your Pipedrive data.

Changes and contact

We will post changes here and update the date below. Questions: support@orbifetch.com.

Last updated 1 October 2026.