← PipeIQ

Privacy Policy

1. Who We Are

PipeIQ is operated by TradeBoost AI Ltd ("we", "us"), a company based in London, UK. We act as a data processor on behalf of our agency clients (who are the data controllers) for contact data uploaded to the platform. We act as a data controller for agency account data.

ICO Registration: TradeBoost AI Ltd is registered with the Information Commissioner's Office (ICO). ICO Registration Number: ZC164080 (registered 02 June 2026, expires 01 June 2027).

Company Number: 17227850  |  For data protection enquiries: support@pipeiq.co.uk

2. Data We Collect

Agency account data (we are controller):

• Name, email address, company name
• Hashed password (bcrypt, cost factor 10 — we cannot recover your plain-text password)
• Login timestamps and IP addresses (security audit log)
• Billing and subscription status

Contact data uploaded by agencies (we are processor):

• Phone numbers, first/last names, postcodes
• SMS reply content and opt-out status
• Campaign delivery timestamps

2b. Cold Email Recipients — Where We Got Your Data

If you received an email from us and followed the link to this page, your contact details (name, business email address, company name) were sourced from publicly available sources — including Companies House, company websites, and professional directories. We did not obtain your data from a data broker or list provider.

We process this data on the basis of legitimate interests (Art. 6(1)(f) UK GDPR) to contact businesses we believe may benefit from our services. We have assessed that this interest is not overridden by your rights and freedoms as a business professional.

We retain prospecting contact data for a maximum of 12 months from first contact, or until you opt out — whichever comes first. To opt out immediately, reply "unsubscribe" to any email from us or email support@pipeiq.co.uk. We will remove you within 5 working days and will not contact you again.

This notice is provided under Article 14 UK GDPR — information to be provided where personal data have not been obtained from the data subject.

3. Legal Basis for Processing

• Agency accounts: Contract (Art. 6(1)(b) UK GDPR) — necessary to provide the service
• Security audit logs: Legitimate interests (Art. 6(1)(f)) — fraud prevention and platform security
• Contact data: We process this on behalf of our agency clients under their instructions. The legal basis is the agency's responsibility to establish and document

4. How We Use Data

• To deliver SMS campaigns via Twilio (our sub-processor)
• To authenticate users and maintain account security
• To detect and prevent fraudulent or abusive use
• To provide usage reporting to agencies
• We do not sell, rent, or share personal data with third parties for marketing

5. Sub-processors

• Twilio Inc — SMS delivery infrastructure (US, SCCs in place)
• Supabase Inc — Database hosting (EU region)
• Vercel Inc — Application hosting (US, SCCs in place)
• Google Cloud Platform — Compute hosting for campaign dispatch, opt-out enforcement and voice AI services (US, SCCs in place)
• GitHub, Inc (Microsoft) — Off-site disaster-recovery backup. A nightly copy of the database is stored in a private repository for restore purposes only; it is not processed, analysed, or disclosed onward. (US, SCCs in place)
• Anthropic Inc — AI language model (Claude) used for SMS message variant generation. Data processed: campaign name, client type, message tone parameters. No personal data of contacts is sent to Anthropic. (US, SCCs in place)
• I Want That Ltd (TPS Services) — TPS/CTPS register screening. Phone numbers are submitted for screening before campaign dispatch. No names or personal data sent. UK-based. Data NDA in place.

6. Data Retention

• Agency account data: retained for the duration of the contract plus 12 months
• Contact/campaign data: retained for 365 days after the last campaign dispatch, or 365 days after upload if no campaign was ever sent, then automatically purged
• Audit logs: retained for 24 months for security and compliance purposes
• Opt-out (STOP) records: retained indefinitely to honour opt-out requests

7. Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of all your data ("Right to be Forgotten") — contact us at support@pipeiq.co.uk
• Portability — receive your data in a structured, machine-readable format
• Restriction — request that we restrict processing of your data
• Object — object to processing based on legitimate interests

To exercise your rights, visit our data subject request form or email support@pipeiq.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. TradeBoost AI Ltd ICO Registration Number: ZC164080.

8. Security

We implement appropriate technical and organisational measures including: TLS encryption in transit, hashed password storage, IP-based rate limiting, per-agency data isolation, and audit logging of all access events.

9. Cookies

PipeIQ uses a single session cookie for authentication. No tracking or advertising cookies are used.

10. Changes

We will notify users of material changes to this policy by email and by updating the date above.

---

TradeBoost AI Ltd  |  London, UK  |  support@pipeiq.co.uk  |  Terms of Service  |  Acceptable Use Policy