← PipeIQ

Privacy Policy

1. Who We Are

PipeIQ is operated by TradeBoost AI Ltd ("we", "us"), a company based in London, UK. We act as a data processor on behalf of our agency clients (who are the data controllers) for contact data uploaded to the platform. We act as a data controller for agency account data.

ICO Registration: TradeBoost AI Ltd is registered with the Information Commissioner's Office (ICO). ICO Registration Number: ZC164080 (registered 02 June 2026, expires 01 June 2027).

Company Number: 17227850  |  For data protection enquiries: support@pipeiq.co.uk

2. Data We Collect

Agency account data (we are controller):

• Name, email address, company name
• Hashed password (bcrypt, cost factor 10 — we cannot recover your plain-text password)
• Login timestamps and IP addresses (security audit log)
• Billing and subscription status

Contact data uploaded by agencies (we are processor):

• Phone numbers, first/last names, postcodes
• SMS reply content and opt-out status
• Campaign delivery timestamps

2b. Cold Email Recipients — Where We Got Your Data

If you received an email from us and followed the link to this page, your contact details (name, business email address, company name) were sourced from publicly available sources — including Companies House, company websites, and professional directories. We did not obtain your data from a data broker or list provider.

We process this data on the basis of legitimate interests (Art. 6(1)(f) UK GDPR) to contact businesses we believe may benefit from our services. We have assessed that this interest is not overridden by your rights and freedoms as a business professional.

We retain prospecting contact data for a maximum of 12 months from first contact, or until you opt out — whichever comes first. To opt out immediately, reply "unsubscribe" to any email from us or email support@pipeiq.co.uk. We will remove you within 5 working days and will not contact you again.

This notice is provided under Article 14 UK GDPR — information to be provided where personal data have not been obtained from the data subject.

3. Legal Basis for Processing

• Agency accounts: Contract (Art. 6(1)(b) UK GDPR) — necessary to provide the service
• Security audit logs: Legitimate interests (Art. 6(1)(f)) — fraud prevention and platform security
• Contact data: We process this on behalf of our agency clients under their instructions. The legal basis is the agency's responsibility to establish and document

4. How We Use Data

• To deliver SMS campaigns via Twilio (our sub-processor)
• To authenticate users and maintain account security
• To detect and prevent fraudulent or abusive use
• To provide usage reporting to agencies
• We do not sell, rent, or share personal data with third parties for marketing

5. Sub-processors

• Twilio Inc — SMS delivery infrastructure (US, SCCs in place)
• aql — trading name of (AQ) Networks Limited (Co. No. 04250076) — alternative UK SMS network route, including virtual mobile and geographic reply numbers. Data processed: recipient phone number and message content (UK-based, Leeds; no international transfer)
• 3G Telecommunications Limited (hlrlookup.com) — mobile number reachability screening before dispatch, so undeliverable numbers are removed from a list. Only the phone number is transmitted — no names or other personal data (UK-based; no international transfer)
• Stripe Inc — payment processing for subscription billing. No contact data is sent to Stripe (US, SCCs in place)
• Twilio SendGrid — transactional email (account, billing and system notifications) (US, SCCs in place)
• Supabase Inc — Database hosting (EU region)
• Vercel Inc — Application hosting (US, SCCs in place)
• Google Cloud Platform — Compute hosting for campaign dispatch, opt-out enforcement and voice AI services (US, SCCs in place)
• GitHub, Inc (Microsoft) — Off-site disaster-recovery backup. A nightly copy of the database is stored in a private repository for restore purposes only; it is not processed, analysed, or disclosed onward. (US, SCCs in place)
• Anthropic Inc — AI language model (Claude) used for SMS message variant generation. Data processed: campaign name, client type, message tone parameters. No personal data of contacts is sent to Anthropic. (US, SCCs in place)
• I Want That Ltd (TPS Services) — TPS/CTPS register screening. Phone numbers are submitted for screening before campaign dispatch. No names or personal data sent. UK-based. Data NDA in place.
• Deepgram, Inc — speech-to-text transcription for the Aria voice-call assistant feature. Data processed: the caller's spoken words, transcribed in real time during the call (US). Deepgram offers a Data Processing Agreement with Standard Contractual Clauses on request; we have not yet executed one and are progressing this while continuing to operate the service
• Anthropic (Aria voice feature) — separately from the SMS use above, Aria's live phone conversations are processed by Anthropic's Claude model to generate the assistant's spoken replies. Data processed: the caller's spoken words (as transcribed) and conversation context. This currently runs on a standard individual-tier account rather than a dedicated commercial API agreement; we are upgrading to a commercial agreement with Article 28 terms in due course
• Google LLC (Aria voice & calendar) — text-to-speech voice output for Aria's spoken replies is provided by Twilio's built-in voice engine under Twilio's own sub-processor terms, with no direct PipeIQ-Google relationship for this. Calendar booking of confirmed appointments (caller name, phone number and appointment details) uses a direct Google Calendar API integration, covered automatically by Google's standard API Terms of Service and Cloud Data Processing Addendum
• Telegram — internal alert messages to our own team when a call needs human follow-up, or as a fallback if the automated line fails. Data processed: the caller's phone number and a link to the call recording. Telegram does not offer a Data Processing Agreement to any customer; used only for our own internal alerting, not for processing on the Controller's behalf

All processors are bound by appropriate data processing agreements or equivalent terms of service, except where noted above — those entries describe the current position honestly and are kept under review.

6. Data Retention

• Agency account data: retained for the duration of the contract plus 12 months
• Contact/campaign data: retained for 365 days after the last campaign dispatch, or 365 days after upload if no campaign was ever sent, then automatically purged
• Audit logs: retained for 24 months for security and compliance purposes
• Opt-out (STOP) records: retained indefinitely to honour opt-out requests

7. Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of all your data ("Right to be Forgotten") — contact us at support@pipeiq.co.uk
• Portability — receive your data in a structured, machine-readable format
• Restriction — request that we restrict processing of your data
• Object — object to processing based on legitimate interests

To exercise your rights, visit our data subject request form or email support@pipeiq.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. TradeBoost AI Ltd ICO Registration Number: ZC164080.

8. Security

We implement appropriate technical and organisational measures including: TLS encryption in transit, hashed password storage, IP-based rate limiting, per-agency data isolation, and audit logging of all access events.

9. Cookies

PipeIQ uses a single session cookie for authentication. No tracking or advertising cookies are used.

10. Changes

We will notify users of material changes to this policy by email and by updating the date above.

---

TradeBoost AI Ltd  |  London, UK  |  support@pipeiq.co.uk  |  Terms of Service  |  Acceptable Use Policy