Privacy Policy — PII Masker and CSV Import Checker
On this page
- Your spreadsheet is never uploaded
- The one request the page makes
- What the apps can see in your Pipedrive account
- What we store, exactly
- Why the refresh token is kept at all
- The one call we make to Pipedrive
- No cookies, no analytics, no tracking
- Who else is involved
- Deleting what we hold
- Your rights
- Children
- Changes
- Contact
This policy covers two Pipedrive Marketplace apps published by Yin Yang Inc. trading as ClonePartner — PII Masker and CSV Import Checker. They are separate Marketplace listings that share one origin, https://pipedrive.clonepartner.app, and this policy applies to both. Last updated 30 September 2026.
Your spreadsheet is never uploaded
Both apps work on a file you choose. That file is read inside your browser tab, processed there, and the result is handed back there. It is never sent to us, and we never see it, store it or log it. Closing the tab is all it takes to be rid of it — there is nothing on our side to delete.
This is a property of how the apps are built rather than a promise about our intentions. The browser code contains exactly one network call, it goes to our own origin, and its entire body is the signed token described below. A build-time audit fails the release if a second network call appears anywhere in the bundle, if any external address appears in it, or if browser storage is used. That audit is in scripts/build.ts.
The one request the page makes
Pipedrive opens our page inside an iframe and puts a signed token in the address. The page sends that token — and nothing else — to our server so we can check the signature and confirm the page really is being shown inside Pipedrive rather than embedded by someone else. The reply is a yes or a no. Your file is not part of this request, and neither is anything derived from it.
What the apps can see in your Pipedrive account
Nothing beyond basic information. The apps request a single permission, which Pipedrive shows on the consent screen as "Access to basic information": the authorised user's own settings and the account's currency list. They do not request access to deals, people, organizations, leads, activities, notes, products, projects, files or emails, and therefore cannot read them. The consent screen listing exactly one permission is the evidence for this, and you can see it before you install.
What we store, exactly
When you install, Pipedrive sends us a one-time code which we exchange for tokens. We keep one record, containing five things and no others:
- your Pipedrive company id — a number
- your Pipedrive user id — a number
- a refresh token issued by Pipedrive
- your account's API domain, such as
yourcompany.pipedrive.com - the date and time of the install
It is held in Cloudflare Workers KV and expires automatically after 60 days, matching the refresh token's own lifetime. No name, no email address, no CRM content, and no part of any file you processed.
Why the refresh token is kept at all
Solely so that uninstalling works properly. When you remove the app, Pipedrive notifies our server, and we use the refresh token to revoke the grant with Pipedrive and then delete the record. Without it we could delete our copy but could not tell Pipedrive the grant is finished.
We do not keep the access token, because we never call Pipedrive's data API and there is nothing for it to do between installing and uninstalling.
The one call we make to Pipedrive
Immediately after the exchange, the server makes a single request to Pipedrive's /users/me endpoint. Its only purpose is to learn the two numeric ids above, because those are what the uninstall notification will identify you by, and a record we cannot look up later is a stored credential with no way to reach it.
Pipedrive's reply to that call contains other fields, including your name and email address. The app reads the two ids and nothing else from it. The reply is not stored, not logged and not sent anywhere; it exists in memory for the duration of that one request. It is the only call either app makes to Pipedrive's data API. The only other requests we make to Pipedrive are the OAuth exchanges themselves: swapping the one-time install code for tokens, and revoking them when you uninstall.
No cookies, no analytics, no tracking
The apps set no cookies, use no local or session storage, embed no analytics, no tag manager, no advertising and no third-party fonts or scripts. There is no account to create and no password to choose, because we have no user accounts — Pipedrive's own install is the only authentication involved.
Who else is involved
Cloudflare hosts the pages and provides the storage described above, and processes the ordinary request metadata any web host sees — IP address, timestamp, the address requested — under its own terms. Pipedrive is the platform you installed from and issues the tokens. Nobody else receives anything. We do not sell, rent or share your data, and there is nothing in our possession that could be sold.
Deleting what we hold
Uninstall the app in Pipedrive. That revokes the grant and deletes the record, and the record would expire on its own within 60 days regardless. If you would rather we deleted it directly, or want to know whether a record exists, email support@clonepartner.com from an address on your Pipedrive account and we will act on it.
Your rights
Depending on where you live you may have rights to access, correct, export or erase personal data we hold about you, and to object to its processing. The practical answer here is short, because the only personal data we hold is two numeric ids, a token and a domain: write to support@clonepartner.com and we will respond within 30 days. Yin Yang Inc. is the controller for that record.
Children
These are business tools used inside a CRM and are not directed at anyone under 16.
Changes
If this policy changes materially we will update the date above and the Marketplace listing. The factual claims here are tied to specific parts of the source, so a change in behaviour requires a change to this page first.