Who we are
Pedibee (“we”, “us”) provides a sales workspace at app.pedibee.com, this website at pedibee.com, a help centre and an API. For questions about this policy, write to hello@pedibee.com.
Two kinds of data
Pedibee handles two different kinds of personal data, and they are treated differently.
- Your account data. Information about you as a person who uses Pedibee. For this we decide how it is used and we are the data controller.
- Your workspace data. The companies, contacts, emails and events you put into your workspace. You decide what goes in and who it is sent to. For this you are the controller and we process it on your instructions.
Your account data
When you sign up and use Pedibee we store:
- Your name and work email address. Only company email addresses can sign up.
- A bcrypt hash of your password, if you set one. We never store the password itself.
- If you sign in with Google, the identifier Google gives us for your account and whether Google has verified your email.
- Which workspaces you belong to and your role in each (owner, manager or member).
- Session information: when you signed in and a version number that lets us sign out every device at once.
- Counts used to limit abuse, such as failed sign-ins, kept for the few minutes they apply.
We use this to let you sign in, keep your account secure, email you about your account (confirmation, password reset, team invites) and answer your support messages.
Your workspace data
A workspace holds what you and your team add to it:
- Companies, the people at them, custom fields, tags, notes and lists.
- Templates, signatures, campaigns, sequences, automations and the emails they send, including each email’s content and the address it went to.
- The outreach history of each contact: every email sent through Pedibee and any touch you log by hand on another channel.
- Events your app, website, Stripe or Paddle send about your contacts, with the properties you choose to include.
- Email verification results: whether an address is valid, risky, unknown or invalid, and why.
- Imports you upload, which are read to create records and are not kept as files.
We process this only to run the product for you: to send what you ask us to send, to show you reports, and to keep the service working. We do not sell it, use it for advertising, or use it to train models. You are responsible for having a lawful basis to contact the people in your workspace.
Your Gmail connection
Pedibee sends every customer email from a Google Workspace account that a manager or owner connects. When you connect one, we ask Google for three things only: your email address, basic sign-in identity, and permission to send email from that account. We do not ask for, and cannot use, permission to read, search, modify or delete messages in your mailbox.
Google gives us a refresh token for sending. We store it encrypted with AES-256-GCM and use it solely to send the emails your workspace asks to send. Disconnecting the account revokes the token with Google. Every email we send appears in that account’s Sent folder like any other.
If you connect Google Postmaster Tools, we ask for read-only access to your domain’s traffic statistics and store that token the same way. We use it only to show you Google’s delivery and spam figures for your domain.
Pedibee’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Tracking data
Pedibee can record when an email you send is opened or a link in it is clicked. This only happens through a tracking domain that is a subdomain of your own domain, which you set up and can turn off at any time. Without one, your emails go out untracked.
For each open or click we record the time, the email it belongs to, which link was clicked, the mail client, and whether the hit looks automatic (for example a security scanner, or Apple Mail’s prefetch). The visitor’s IP address is used only to make that classification and is not stored. Automatic hits are kept so you can see them but are never counted as engagement.
Unsubscribe links are signed and record the address that was mailed, so an opt-out is honoured even if the contact is later deleted or re-addressed. Opening the link shows a confirmation page; only pressing the button, or a mail provider’s one-click request, opts the person out.
API keys and connected assistants
If you create an API key, we store only a hash of it, its scopes, who created it and when it was last used. If you connect an AI assistant through the MCP server, we store the connection’s scopes, the workspace it may use and hashes of its tokens. For each assistant call we log which tool ran, whether it worked and how long it took. We do not log the arguments, the results or the token.
This website
The marketing site uses Vercel Analytics and Speed Insights to count page views and measure loading speed. These collect aggregate figures and do not use cookies to identify you. The dashboard uses one cookie, the session cookie, which signs you in. We use no advertising cookies anywhere.
Who processes data for us
We use a small number of providers to run Pedibee. Each one processes data only on our instructions.
| Provider | What it does |
|---|---|
| Google Cloud | Runs the API, the sending jobs and scheduled tasks. |
| Neon | Hosts the Postgres database that holds account and workspace data. |
| Vercel | Serves the dashboard, the help centre and this website, with aggregate analytics. |
| Cloudflare | DNS, and the certificates and edge in front of your tracking domain. Only tracking paths pass through it to Pedibee. |
| Resend | Sends Pedibee’s own emails to account holders: confirmation, password reset and team invites. Never your customer emails. |
| Google (Gmail API) | Sends your emails from the account you connect, under Google’s own terms. |
Email verification runs on infrastructure we operate. It checks addresses with the receiving mail server and sends no email to them. A Redis cache holds queue jobs and sending counters only, never data that cannot be recreated.
How long we keep it
- Account and workspace data: for as long as the account or workspace exists. Deleting a workspace deletes its data; only the workspace owner can do that.
- Events sent to automations: 90 days.
- What arrived on a webhook or billing connection: the last 100 deliveries per source, for 14 days.
- An automation run’s step-by-step history and event data: 30 days after the run ends.
- Email verification results: cached for 30 days, one day for unknown answers.
- Email confirmation and password reset links: 24 hours and one hour respectively, as one-time tokens stored as hashes.
Security
Secrets are stored as hashes or encrypted, every record belongs to one workspace and every request is checked against your membership, tracking and unsubscribe links are signed, and writes from other websites are refused. The security page describes these measures in detail. If you believe you have found a vulnerability, email security@pedibee.com.
Your rights
Depending on where you live you may have the right to access, correct, export or delete personal data about you, to object to or restrict certain processing, and to complain to a supervisory authority. For your account data, email us and we will act on it. For data in a customer’s workspace, we will pass your request to that customer, who controls it, and help them respond.
Where Pedibee relies on consent, you can withdraw it at any time. Where we rely on our contract with you or our legitimate interest in running a secure service, we will explain that basis on request.
International transfers
Our providers may process data outside your country. Where that happens we rely on the safeguards each provider offers, such as standard contractual clauses, and we will give you details on request.
Children
Pedibee is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
Changes
If we change this policy we will update the date at the top. For a change that matters to how your data is handled we will also email account owners before it takes effect.
Contact
Questions about privacy: hello@pedibee.com. Help with your workspace: support@pedibee.com.