Last updated: October 28, 2026
At Pipl, our mission is to provide easy access to true identity information for businesses and make sure people are who they say they are when interacting with our Customers. We do that by finding the real person behind the online identity so that trustworthy people could be trusted. In doing that, we maintain high standards of privacy, compliance and ethics.
We strive to provide you with as much visibility and control of your identity data, it starts with providing transparency around our data collection practices, sourcing our data from publicly available information and making sure that our customers use our solution for permissible purposes.
In addition, we take privacy compliance very seriously, we are certified for the EU-US Data Privacy Framework ("DPF"), UK Extension to the EU-US DPF, and Swiss-US DPF to ensure that our services support GDPR compliance and we comply with applicable laws and regulations, including the California Consumer Privacy Act (CCPA).
In this Privacy and Information Security Center you will find:
Pipl brand is owned and operated by Pipl, Inc., and Pipl’s (“Pipl”, “Pipl”, “we”, “our” or “us”) privacy policy was built with both its usefulness and your privacy in mind. This privacy policy applies when you visit or use our website and/or our Services. This privacy policy may be updated and will be posted on Pipl’s website (pipl.com/privacy-center).
“Personal Information” means any information relating to an identified or identifiable individual. We may collect the following types of Personal Information:
For the purpose of this Privacy Notice, unless otherwise specified, “Personal Information” means any information relating to an identified or identifiable individual. In connection with the provision of the Services, we obtain Personal Information relating to you in the situations described below.
Cookies: Pipl may use cookies, pixels, beacons, local storage and similar technologies (“Tracking Technologies”) in an effort to improve the quality of our Services and your interactions with our web sites. A Cookie is a small data file that is sent to your computer when you first visit a website. Cookies usually include an identification number that is unique to the computer you are using. Such identifiers can help us better understand our users and how they are using the website and the Services, and track affiliate referrals. Cookies can improve the quality of our service (e.g. recognizing a user when they visit the site, displaying the site according to the user’s chosen user settings for language, and maintaining the security of the user’s account); and help us provide relevant information and offers to our customers and prospects. If you prefer, you can reset your browser so that it refuses all cookies or notifies you when a cookie is being sent. In such a case, your browser will send us a special signal to stop tracking your activity. You can learn more and turn off certain third party targeting and advertising cookies by visiting the following third-party webpages:
Web Beacons: We may also use web beacons, small graphic images, or other web programming code which may be included in our Web pages and e-mail messages. We may use Web beacons (or similar technologies) to count visitors to our web pages, and to monitor how users navigate our web pages, among other legitimate business purposes.
Log files, IP addresses, URLs, embedded scripts, and similar data: We gather certain information automatically to administer the Services and analyze trends in the aggregate. This information may include IP addresses (or the proxy server a business Customer uses to access the Services), device and application identifiers, browser type, Internet service provider, the pages and files viewed, searches conducted, operating system and system configuration information, and date/time stamps associated with usage. Also, Pipl automatically receives the URL of the Web site from which a business Customer came. This information is used to analyze overall trends, and to provide and improve the Services. For example, Pipl collects IP addresses from Customers when they log into the Services as part of security features to confirm identity or detect compromised accounts. Pipl may also use embedded scripts, which are programming code designed to collect information about an interaction with a Web site, such as the links clicked on. The code is temporarily downloaded onto a device from our Web server or a third-party service provider, is active only while you are connected to the Web site containing the embedded script, and is deactivated or deleted thereafter.
Fraud Prevention SDKs and Device Technologies: Certain Customers may deploy third-party SDKs, device intelligence technologies, or similar embedded tools in connection with their use of the Services for fraud prevention, account security, identity verification, and abuse detection purposes. These technologies may automatically collect technical and device-related information such as device identifiers, operating system information, browser characteristics, IP address, network attributes, device telemetry, application interaction data, and indicators associated with fraudulent or automated activity. Information collected through these technologies may be shared with Pipl solely to support fraud prevention, cybersecurity, identity verification, risk mitigation, and related security functions. Such technologies are not used by Pipl for targeted advertising or unrelated consumer profiling activities.
We may use your Personal Information to:
Use of Artificial Intelligence. We use artificial intelligence technologies, including large language models made available by third-party providers, to support certain features of our Services. These include: (i) an AI-powered assistant within our Services that helps our Customers’ users summarize and analyze Pipl Data presented in response to their searches; and (ii) AI-powered analysis of a Customer’s own usage data, which is aggregated and anonymized before such analysis, for presentation to that Customer. The AI assistant within our Services is not provided with Customer Data. Our AI features are assistive only. They do not make decisions about any individual, do not produce legal or similarly significant effects concerning any individual, and do not create or modify any score or signal provided by our Services. Our third-party AI providers are contractually prohibited from using the information we provide to them to train or improve their models and are subject to limits on their retention of such information. We do not use inputs to or outputs of our AI features to train our machine learning models.
AI Tools Connected by Customers. Separately from the AI features described above, Customers may connect their own third-party AI tools, such as AI assistants, to the Services through a Pipl Connector. When they do, we process the resulting queries in the same way as other queries submitted to the Services and return our response to the Customer’s AI tool at the Customer’s direction. That AI tool is selected and controlled by the Customer and operated by its provider under the Customer’s own agreements. It is not one of our AI features or one of our service providers, and Pipl Connectors cannot access our AI features.
We set out below the purposes for which we process Personal Information. We indicate the categories of Personal Information per processing purpose. We will only process your Personal Information when we have a valid legal ground for the processing in accordance with applicable law, depending on the country in which you are located. However, please note that even though the chart below may not list consent as a legal basis for each processing activity, in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries we rely on consent for all processing activities. In certain cases, this consent may be obtained on our behalf from our Customers.
|
Processing activity |
Legal Basis for Processing (where required under applicable law) |
Categories of Personal Information |
|---|---|---|
|
Provide Services to our customers for fraud and incident prevention and servicing customer accounts, including activities such as facilitate payments for the Services, communicate with our customers, connect third party services for customers, including AI tools Customers connect through Pipl Connectors, personalize the services at customers’ requests, and audit interactions with customers. |
We, and our Customers, have a legitimate interest in combatting fraud or fraudulent use of our Customers’ services. We may also rely on the “performance of a contract” legal ground when we process Personal Information to fulfill individuals’ requests e.g., to respond to individuals’ inquiries. |
Account Information Customer Data Usage Information (such as cookies and similar technologies) Billing Information Pipl Data Metadata AI Integration Information AI Integration Information |
|
Provide AI-assisted features within the Services, including summarization and analysis of Pipl Data presented to Customers. |
We, and our Customers, have a legitimate interest in providing efficient, accurate, and useful fraud prevention and identity verification services. |
Pipl Data Metadata We do not provide Customer Data to the AI assistant within our Services. |
|
Maintain the Services in good working order, and to manage cyber threats, risk exposure, and franchise quality with respect to the integrity and security of our Services and internal systems. |
We have a legitimate interest in ensuring the safety, security and performance of our Services. |
Account Information Customer Data Usage Information (such as cookies and similar technologies) Pipl Data Metadata |
|
Operate, evaluate, and improve our business (including developing new products and services). |
We have a legitimate interest in improving and developing our business, products, and services. |
Account Information Customer Data Usage Information (such as cookies and similar technologies) Billing Information Pipl Data Metadata |
|
Provide tailored business communication and marketing. |
We have a legitimate interest in promoting our business. When we send electronic direct marketing communications, or when we tailor our advertising, we will obtain individuals’ prior consent if required in accordance with applicable laws. |
General Communication Information Account Information We do not use Customer Data for marketing purposes. |
|
As may be required by applicable laws and regulations, including for compliance with Know Your Customers, Anti-Money Laundering, anti-corruption and sanctions screening requirements, or as requested by any judicial process, law enforcement, or governmental agency having or claiming jurisdiction over Pipl or Pipl’s affiliates. |
Compliance with legal obligations |
General Communication Information Account Information Customer Data Usage Information (such as cookies and similar technologies) Billing Information Pipl Data Metadata |
|
Protect against and prevent fraud and cyber threats, unauthorized transactions, claims and other liabilities, and manage risk exposure and franchise quality with respect to the integrity and security of our Services. |
We, or a third party, have a legitimate interest in protecting against legal claims. |
General Communication Information Account Information Customer Data Usage Information (such as cookies and similar technologies) Billing Information Pipl Data Metadata |
|
Perform due diligence reviews, accounting, auditing, billing, reconciliation and collection activities. |
We have a legitimate interest in managing our Customer, vendor and partner relationships as necessary to operate our business. |
Account Information Billing Information |
|
Protect our Customer and others against fraud, cyber incidents and strengthen the cyber resilience of our Customer’s operations. |
We, or our Customers, have a legitimate interest in combatting fraud or fraudulent use of our Customers’ services. |
Account Information Customer Data Usage Information (such as cookies and similar technologies) Pipl Data Metadata |
We may share Personal Information with:
Pipl may provide your Personal Information to the following third parties for the purposes set out below:
We may share the Personal Information we collect with our subsidiaries and affiliates that are part of the Pipl group of companies, for the purposes described in this Privacy Notice.
We may share Personal Information with our service providers who perform services on our behalf and in relation to the purposes described in this Privacy Notice. Examples of our service providers include analytics providers, data storage providers and payment processing providers. We require these service providers by contract to only process Personal Information in accordance with our instructions and as necessary to perform services on our behalf or comply with legal requirements. We also require them to have safeguards designed to protect the security and confidentiality of the Personal Information they process on our behalf. These service providers may also include device intelligence, fraud detection, cybersecurity, and SDK technology providers that support fraud prevention, identity verification, and account security functions on behalf of Pipl or its Customers. These service providers may also include providers of artificial intelligence and large language model technologies that support features of our Services, which are contractually prohibited from using Personal Information we provide to them to train or improve their models. Where we transfer personal data received under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF to a service provider acting as our agent, we remain responsible for that personal data as described in Section 8 (International Transfers).
We may share Personal Information with third-party data providers in order to supplement our database. For example, we may send an email address to a data provider to see whether and when the data provider may have seen the email address before.
In addition, we may partner with a variety of businesses to market or sell our products or services. For instance, partners may co-sponsor our events or offerings. We may share General Communication Information that Customers provide when they sign up for events or other offerings with these Partners so they can send marketing communications and other information of interest. See below for how to withdraw your consent at any time.
In response to Customers’ queries, we may provide Customers with Metadata and Personal Information regarding their customers. Where a Customer connects its own AI tool to the Services through a Pipl Connector, we provide our response to that AI tool at the Customer’s direction. The AI tool is operated by a third party the Customer chooses, and its processing is governed by the Customer’s privacy practices and its agreements with that provider.
We may disclose data about you: (i) if we are required to do so by law or legal process; (ii) in response to a request from a court, law enforcement authorities, or government officials; or (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.
We reserve the right to transfer Personal Information we have about you in the event we sell or transfer all or a portion of our business or assets. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use Personal Information you have provided to us in a manner that is consistent with this Privacy Notice.
We are committed to protecting the privacy of minors. To comply with various privacy regulations, at this time, Pipl is not directed or otherwise intended to be used by users under the age of 18. Therefore, our Services are only available to users who are at least 18 years old and should only be used by users in that condition, in accordance with our terms of service. If you are under 18, please do not use Pipl’s Service.
Furthermore, Pipl never knowingly sells or publicly discloses personal information that is associated with a minor individual.
Pipl Services contain links to third party websites and embedded elements from third party web services such as Google Maps; likewise, your query information might be relayed to third party data feeds for additional results. If you use Pipl’s Services or follow a link to a third-party website, some information about you and your query will be visible to subsequent services. Even if the third-party website or service is affiliated with us, we have no control over linked sites, services or data feeds, each of which has a separate privacy and data collection practices independent of Pipl. As such, we are not responsible for, nor have any control over, the content or privacy policies of those third-party websites or services, and encourage all users to read the privacy policies of each and every website linked from or embedded in Pipl.com. In addition, Customers utilizing the Services may independently implement third-party fraud prevention or device intelligence SDKs, scripts, or embedded technologies within their own applications, websites, or services. The collection and processing of information by such Customer-authorized technologies is governed by the applicable Customer’s privacy practices and agreements, except to the extent Pipl receives or processes such information solely in support of fraud prevention, identity verification, or cybersecurity services. Similarly, Customers may access the Services through third-party AI tools, such as AI assistants, that they connect to a Pipl Connector. Information Pipl returns to those AI tools is processed under the applicable Customer’s privacy practices and the AI provider’s terms, not this Privacy Policy.
Pipl, Inc. acknowledges the rights of access afforded to EU, UK and/or Swiss individuals. If the European Union’s General Data Protection Regulation, UK Data Privacy Act, California Consumer Privacy Act, or other countries’ privacy regulation is applicable to you, you may have the following rights in respect of your personal data that we hold:
California, EU, Swiss and/or UK residents have the choice to exercise their rights under the CCPA, the GDPR, or the UK-GDPR in the following ways:
For California residents under CCPA, to “Opt-Out” of the sale or sharing of your information with third parties, visit:
DO NOT SELL OR SHARE MY PERSONAL INFORMATION LINK
For California residents, under CCPA, to make a deletion or disclosure request, visit: https://pipl.com/ccpa-disclosure-form
EU, Swiss and/or UK residents may exercise your right to access, delete, rectification, or object to processing as described above you may also submit a request to us via the following methods:
Reasonable access to your personal data will be provided at no cost. If access cannot be provided within a reasonable time frame, Pipl will provide you with a date when the information will be provided. If for some reason access is denied, Pipl will provide an explanation as to why access has been denied.
For questions or complaints about the processing of your personal data, you can email Pipl’s privacy team at privacy@pipl.com. Alternatively, if you are located in the European Union, you can also have recourse to the European Data Protection Supervisor or with your nation’s data protection authority.
Information collected by Pipl may be stored in the United States or any other country in which Pipl or its agents maintain facilities. Where Pipl receives personal data from the European Economic Area, the United Kingdom, or Switzerland, Pipl primarily relies on the Standard Contractual Clauses approved by the European Commission, together with, as applicable, the UK International Data Transfer Addendum and the adaptations required for transfers from Switzerland. Pipl also participates in the Data Privacy Framework, as described below, and complies with the DPF Principles with respect to personal data received in reliance on the DPF. You may request a copy of the relevant safeguards, which may be redacted to protect commercially sensitive information, by contacting privacy@pipl.com.Pipl, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Pipl, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Pipl, Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
Onward Transfers. Pipl, Inc. is responsible for the processing of personal data it receives under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework, and subsequently transfers to a third party acting as an agent on its behalf. Such agents include service providers that host our systems or provide technology that supports our Services, including artificial intelligence technology. When we transfer such personal data to an agent, we do so only for limited and specified purposes. We require the agent by contract to provide at least the same level of privacy protection as is required by the DPF Principles, and we take reasonable and appropriate steps to ensure that the agent processes the personal data in a manner consistent with our obligations under the DPF Principles. Upon notice, we will take reasonable and appropriate steps to stop and remediate any unauthorized processing. Pipl, Inc. remains liable under the DPF Principles if its agent processes such personal data in a manner inconsistent with the DPF Principles, unless Pipl, Inc. proves that it is not responsible for the event giving rise to the damage.
We will retain your personal information for as long as necessary to operate our website or provide services. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our policies. Retention periods shall be determined taking into account the type of information that is collected and the purpose for which it is collected for, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable time. Queries received through Pipl Connectors are retained as part of our records of Customer queries under our customer terms, subject to any Customer setting that disables detailed logging of such queries.
We have implemented administrative, technical, and physical safeguards to help prevent unauthorized access, use or disclosure of your personal information.
While we seek to protect your information to ensure that it is kept confidential, we cannot guarantee the security of any information. You should be aware that there is always some risk involved in transmitting information over the internet and there is also some risk that others could find a way to thwart our security systems. As a result, while we strive to protect your personal information, we cannot ensure or warrant the security and privacy of your personal information or other content you transmit using the Services or Websites, and you do so at your own risk. Thus, we encourage you to exercise discretion regarding the personal information you choose to disclose.
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:
Annual Report on request to access, delete and opt-out for the calendar year 2025:
|
Requests |
Total Number of Requests |
Numbe of Requests Complied with in Full |
Number of Requests Complied with in Part |
Number of Requests Denied |
Mean Number of Days to Respond* |
Median Number of Days to Respond* |
|---|---|---|---|---|---|---|
|
Disclose |
7 |
7 |
0 |
0 |
0.66 |
0.67 |
|
Delete |
19,227 |
19,227 |
0 |
0 |
0.5 |
0.54 |
|
Opt-Out |
507 |
507 |
0 |
0 |
0.66 |
0.5 |
If you have any questions, concerns or complaints, or would like to exercise your rights, please contact us at:
In compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), Pipl, Inc. commits to resolve complaints about our collection or use of your personal information transferred to the U.S. pursuant to the EU-U.S. DPF, the UK extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. EU, UK, and Swiss individuals with inquiries or complaints should first contact Pipl, Inc. at privacy@Pipl.com.
Pipl has further committed to refer unresolved DPF Principles-related complaints to a U.S.-based independent dispute resolution mechanism, BBB NATIONAL PROGRAMS. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbbprograms.org/dpf-complaints for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction
The Federal Trade Commission has investigatory and enforcement authority regarding Pipl’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and SW-US DPF.
How Pipl Secures Your Data
Data protection is paramount, especially when it comes to private data. We safeguard data with multiple layers of security, including strict access controls, encryption, network security and other technical, administrative and operational procedures and policies.
Continue for more information on many of the security measures we have put in place.
Pipl is SOC 2 Type II compliant. We are audited annually. Please speak to your account representative to learn more and receive the full certification report.
Pipl production services are hosted in SOC 2, ISO 27001 and GDPR compliant data centers. We receive and review our providers’ reports and certifications annually.
Pipl handles personal information that may be used to identify individuals. Protecting this information is critical and we invest heavily to control access to it. Only authorized and trained staff have access to our data. We follow the “least privilege” principle: access to specific types of data is restricted based on business need, requires formal approval by the data owner (not to be confused with data subject), and is continuously logged and monitored. We require employees to complete multi-factor authentication (MFA) wherever possible.
As a cloud-based, identity trust company, we are acutely aware of the risks of operating on the internet. Thus, our network security is state-of-the-art and deliberately designed based on the zero trust concept. We monitor ingress and egress traffic, frequently test security measures and continuously improve our architecture to ensure that our networks are as secure as possible.
As a vendor for some of the largest companies in the world, our security measures are frequently assessed, and we do the same for our vendors. Our expectation is that our vendors will align with our security posture. If they have access to our data, we also expect them to comply with our privacy policy. This includes providers of artificial intelligence technologies that support features of our Services, which we also contractually prohibit from using data we provide to them to train or improve their models.
Pipl holds large volumes of data, most of which is personally-identifiable information (PII), by the definition of our services. We use industry-standard encryption for data in-transit and at-rest. Any type of data we don’t need is either deleted or hashed, based on business needs and our data retention policy.
Pipl is a software development company. We develop the applications to handle our data and deliver our services. If our applications are at risk, our service and business continuity are at risk.
We base our application designs and development practices on security and privacy principles from the ground up. Our developers follow secure development practices, such as OWASP Top 10. Our DevOps team continuously ensures that our environments are configured based on practices such as CIS (aka Center of Internet Security).
We continuously verify that we have successfully followed these measures with application and infrastructure penetration tests. We also monitor all systems using next generation technologies and a 24/7 team of Security Analysts.
Pipl invests heavily in securing the data we manage, whether owned by us or our customers. As data can reside in endpoints, we take great care to secure those endpoints.
All of our host servers, whether they are physically owned by us or belong to a third party such as a cloud provider, are protected by strict cryptographic controls. We follow the least privilege principle: access to our host servers is restricted based on business needs, and must be authorized prior to granting access.
The same is true of our employee endpoints (eg. laptops). They are all configured with full disk encryption, strong password policies and other mechanisms, to ensure they are kept safe and secure through their lifecycle. This includes deletion of the data when they are no longer in use, crypto shredding of encryption keys, etc.
All our hosts are centrally managed, continuously patched, and closely monitored for suspicious activities by either humans or automated processes. All activities are logged and monitored 24/7.
The Pipl Operations team has designed systems to keep our services running even if the underlying infrastructure experiences an outage or other significant issue. Every critical Pipl service has a secondary, redundant service running simultaneously, with mirrored data in a different data center than the primary server. Furthermore, each database server is continuously replicated in a third data center.
Our backup policy and operational process ensures that we can recover even if both of our primary data facilities become unavailable. We regularly create and store encrypted backups of our data at multiple offsite locations, further ensuring that we can recover in the event of a disaster that disrupts our service. Encrypted backups can only be decrypted by members of the Pipl operations team who have received training and have been authorized to decrypt the backups.
We constantly create live duplicates of our live database, and full product snapshots every 24 hours.
All backups are retained at the following locations:
Only authorized members of the Pipl operations team have access to the backup locations, so that they are able to monitor the performance of the backup processes, and take action in the very unlikely event that a restore becomes necessary.
Pipl’s employees also sign a confidentiality agreement when their employment begins. During their first couple of days of working for the company, they take part in our information security awareness training.
All of our employees and freelancers complete awareness training once a year, and periodically during company meetings.
We also perform drills from time to time, to test our staff awareness and alertness.
Pipl takes preventive and detective measures to physically secure our office facilities, and to keep our staff aware of the importance of physical security controls when working outside our premises.
Because Pipl uses cloud services, and those providers are responsible for their data center’s physical security, we take proper measures to ensure their level of security is aligned with ours. This is done by choosing the right vendors and also by annually re-assessing those vendors.
Pipl enables compliance with the GDPR when we process personal data on behalf of our customers.
The data protection framework in the European Union (EU) maintains the important distinction between controllers of personal data, and third parties that process personal data on behalf of controllers.
In delivering our services, Pipl is a processor, processing personal data (provided by our customers) on their behalf. The GDPR required us, and our EU customers as controllers or processors, to ensure compliance mechanisms and data protection measures.
If you are required to comply with the EU GDPR, please click here to review the Data Protection Addendum. If you have any questions regarding GDPR compliance or the Data Protection Addendum please contact us using this form.
Last updated: May 26, 2026
The California Consumer Privacy Act (CCPA) creates new consumer rights relating to the access to, deletion of, and sharing of personal information that is collected by businesses.
Pipl complies with the CCPA. If you are a California resident please read below for our California Privacy Notice, if you are a business customer with questions regarding CCPA compliance please contact us using this form.
Click here for the CCPA opt-out form
This California Privacy Notice supplements the information contained in the Privacy Policy of Pipl, Inc. (“Pipl,” “we,” “us,” or “our”) and applies solely to visitors, users, and others who reside in the State of California (“Consumer(s), ” as defined in the California Consumer Privacy Act of 2018, or “you”). We have adopted this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and the related regulations and other applicable California privacy laws. Any capitalized terms in the CCPA have the same meaning when used in this notice.
To learn about our commitment to privacy, please visit our privacy center.
When referring to Personal information Pipl collects about you, it is important to distinguish between two classes of information:
“Public Data” is publicly available Personal Information we collect about you from (a) the Internet (for example, news articles and blog posts) or (b) other publicly available sources, such as phone books, public records, business contact, and other professional listings.
“Private Data” is Personal Information you provided to us or we collected in our internal systems as part of providing you with our services (for example, your account email and name, billing information, or customer support records).
The categories of public and private data collected are set forth below.
We obtain the categories of personal information listed above from the following categories of sources:
We obtain the categories of personal information listed above from the following categories of sources:
Public Data
Private Data
Directly and indirectly from activity on our website or other systems. For example, from submissions through our website (such as prospective customers seeking information or help) or website usage details automatically collected.
We may use or disclose Personal Information we collect for one or more of the following business purposes:
Public Data
We provide or sell Public Data to the users of our Services. For example, when our Customer uses one of our services to validate identity information, we provide publicly available personal information on that individual.
Our services are used primarily for identity verification, compliance, fraud prevention, contact enrichment, and investigations. This may include the processing of device intelligence information, SDK-generated technical signals, and related telemetry associated with fraud prevention, cybersecurity, abuse detection, and account protection activities.
Private Data
We use this data to provide our Services to our Customers, or improve our services, or provide relevant information and offers to our customers and prospects. For example, when you use our website or any of our services, we collect information about how often and what function you are using so that we can improve the quality of our service.
We never knowingly sell or publicly disclose Personal Information that is associated with a minor individual.
Please read our Privacy Policy to learn more.
The CCPA provides Consumers who are California residents with certain rights regarding their Personal Information. This section describes your CCPA rights. The following sections explain how to exercise those rights.
Right to Know/Disclosure
You have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past 12 months. You may request either information about the categories of Personal Information that we collect about you and/or specific pieces of Personal Information. Once we receive your request and confirm your identity, we will disclose to you, in accordance with your request:
Deletion Request Rights
You have the right to request that we delete any of your Private Data that we have collected and retained, subject to certain exceptions. Once we receive and confirm your request and verify your identity, we will delete (and direct our service providers to delete) your Private Data from our records, unless one of the exceptions below applies.
We may deny your request to delete if retaining the information is necessary for us or our service providers to:
1. Complete the transaction for which we collected the Personal Information, provided a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech ensures the right of another consumer to exercise their free speech rights or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code Sec. 1546 et seq.).
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
8. Comply with a legal obligation.
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
Opt-Out Rights
You have the right to request that we not sell your Personal Information. While we are not required to verify your identity, we may deny a request if we have a good-faith, reasonable, and documented belief that the request is fraudulent.
NOTE: While we make a good faith effort to accommodate opt-out requests about Personal Information, due to the nature of Pipl’s technology and the ever-changing nature of the internet, opting-out of certain information does not guarantee that similar information will not appear in another form, at a different source or in a new record. In collecting publicly available information, Pipl is essentially acting as a search engine, very much like Google or Bing, constantly scanning publicly available sources for identity information then providing identity solutions to customers based on that information. When you exercise your right to opt-out, your request covers removing Personal Information that is currently on our systems. At present, we do not have an effective way to apply your request to any Personal Information that we may discover or receive in the future, as new information about you becomes available you may submit a new opt-out request.
To exercise your right to know, delete or opt-out as described above, you may submit a request to us via the following methods:
Only you or a person that you have authorized to act on your behalf may make a verifiable Consumer request related to your Personal Information on your behalf. You may also make verifiable Consumer requirements on behalf of your minor child.
You may only make a verifiable Consumer request for access or data portability twice within a 12-month period. The verifiable Consumer request must:
We cannot respond to your request to delete or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you or to the person that you are representing (if you are an authorized representative). We will try to use the information we have about you to verify your identity, if additional verification is required, we may ask you for additional proof of identity such as a copy of your picture ID.
Making a Consumer request does not require you to create an account with us. We will only use Personal Information provided in your request and any information provided to verify your identity in connection with the request, solely to process the request, keeping audit records, verify the requestor’s identity and/or authority to make the request, and for no other purpose.
If a Consumer uses an authorized agent to submit a request, we may require the following: 1) that the Consumer provide the authorized agent written permission to do so and verify the Consumer's identity directly with Pipl or 2) a power of attorney authoring the authorized agent to act on behalf of the Consumer that is (a) either witnessed by two parties or duly notarized and (b) otherwise complies with the requirements of the California Probate Code, Sections 4000-4465.
Confirmation of Request:
Upon receiving a request for disclosure or deletion, we shall confirm receipt thereof within 10 days. Except in instances where we deny the request, confirmation will include information about how we will process the request, including our verification process and the timeline on which the Consumer should expect a response.
Response Timing and Format:
We endeavor to respond to a verifiable Consumer request within 45 of its receipt. We are permitted up to 90 days to respond if we notify you of the extension within 45 days of our receipt of your request. If we require an extension, we will inform you of the reason and the extension period in writing. You are not required to have an account with us to make a verifiable request. We will deliver our written response by mail or electronically at your option. Any disclosure we provide will cover the 12-month period preceding receipt of the verifiable Consumer request. If we cannot comply with your request, the response we provide will also explain the reasons. For disclosing the data itself, we will provide your Personal Information in a format that is readily available and portable.
We do not charge a fee to process or respond to your verifiable Consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
We will not discriminate against you for exercising any or your CCPA rights. Unless permitted by the CCPA, we will not:
|
Requests |
Total Number of Requests |
Number of Requests Complied with in Full |
Number of Requests Complied with in Part |
Number of Requests Denied |
Mean Number of Days to Respond* |
Median Number of Days to Respond* |
|---|---|---|---|---|---|---|
|
Disclose |
7 |
7 |
0 |
0 |
0.66 |
0.67 |
|
Delete |
19,227 |
19,227 |
0 |
0 |
0.5 |
0.54 |
|
Opt-Out |
507 |
507 |
0 |
0 |
0.66 |
0.5 |
*"Respond" means providing a substantive response. It doesn’t include extension notices or other administrative notices.
We reserve the right to amend this California Privacy Notice and our Privacy Policy at our discretion and at any time without notice. Please check back from time-to-time.
Compliance Resources
Pipl operates as an identity resolution engine, so we collect multiple pieces of personal information from a large variety of sources that are already publicly available and make them available to our customers.
One way of collecting public information is scanning and indexing web pages, our deep search robot continuously crawls the web and extracts names, locations, age, facts and other relevant information from general web documents, personal profiles, public records, phone directories, blogs, news articles, scientific publications and many other types of pages - this data is then processed and indexed so it can be searched only by vetted business customers that have identified themselves and agreed to use such data solely for a legitimate, permissible purpose that Pipl has reviewed and approved before granting access.
Other ways of collecting information is licensing publicly available information such as phone directories, professional listings or scanning old public archives.
We always maintain high standards of ethics and compliance to ensure we follow every applicable law and regulation; regardless of the data sourcing method we use, we maintain a clear audit log for any data added to our service to ensure we can keep track of data source quality, licensing and regulatory changes.
If you have any additional questions or comments please contact us using this form.
At Pipl, our mission is to provide easy access to true identity information so that trustworthy people can be trusted. We do that by helping our customers find the real person behind an identity fragment so that trustworthy people can be trusted. In doing that, we maintain high standards of privacy, compliance, and ethics.
The following outlines our policy for the permissible use of our services by our customers. Every customer who wishes to access Pipl services must identify themselves and the purpose for using our services and we take pride in vetting every single customer to ensure our identity solutions are used for a permissible purpose in accordance with the applicable law, as well as Pipl’s internal policies and ethics. We also adopt additional legal measures in the preparation and performance of contracts to ensure that our customers are bound by specific purpose limitation obligations that prevent them from using personal data in ways that may be deemed unlawful under the legislation in force.
The requirement(s) for purpose are based on both legal & ethical principles, especially those relating to the protection of personal data. Below are some of the restrictions we put in place to ensure the lawful and ethical use of our services:
If you have any questions regarding our permissible use policy please contact us using this form.
