Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect:

• Your name and email address
• Your business name
• Password (stored in hashed form — we never store or see your plain-text password)

Business Data

When you use the Service, you enter business data including:

• Client names, addresses, email addresses, and phone numbers
• Quotes, invoices, and credit notes
• Product and service catalogs, including pricing
• Payment records
• Team member information (names, email addresses, roles)

This is Your Data. You own it. We process it only to provide and improve the Service.

Usage Information

We automatically collect certain technical information when you use the Service:

• IP address and approximate location (country/region level)
• Browser type and version
• Pages visited and features used within the Service
• Date and time of access
• Referring URL

Payment Information

If you subscribe to a paid plan, payment processing is handled by a PCI-compliant third-party payment processor. We do not store your full credit card number, expiration date, or CVC on our servers. We receive and store only a tokenized reference, your card's last four digits, and billing address for record-keeping purposes. Refer to our payment processor's privacy policy for how they handle your payment data.

2. How We Use Your Information

3. AI Features and Your Data

PipePilot uses AI to power features like quote generation and business briefings. When you use AI features:

• Your input (such as job descriptions) and relevant catalog data are sent to our AI processing infrastructure to generate results
• AI-generated content (quotes, briefings, suggestions) is created based on your account's data — your products, pricing, and business context
• We do not use Your Data to train AI models for other customers. Your business data stays within your account's context
• We may use anonymized, aggregated usage patterns (not your business data) to improve the overall AI features

4. Data Isolation

Each account's data is logically separated at the application level. This means:

• Users in your account cannot see data from other accounts
• Users in other accounts cannot see your data
• AI features operate within the context of your account's data only

5. Data Sharing

We do not sell your data. We do not share your personal or business data with third parties for their marketing purposes.

We share data only in these limited circumstances:

• Service providers: We use third-party services to operate the platform (hosting, payment processing, email delivery). These providers access data only as needed to perform their services and are bound by their own privacy obligations.
• Legal requirements: We may disclose data if required by law, regulation, legal process, or governmental request.
• Business transfer: If PipePilot is acquired or merged with another company, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
• With your consent: We may share data with third parties when you explicitly authorize us to do so.

6. Data Storage and Security

Your data is stored on cloud infrastructure located in North America. We implement reasonable security measures to protect your data, including:

• Encrypted connections (TLS/SSL) for all data in transit
• Encrypted data at rest
• Hashed passwords (we never store plain-text passwords)
• Session management with automatic expiry
• Rate limiting to prevent abuse

While we take reasonable precautions, no system is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain Your Data for as long as your account is active. If you cancel your subscription:

• Your data remains accessible in read-only form for 90 days
• You can export your data during this period
• After 90 days, your data is permanently deleted from our active systems
• Backups containing your data may persist for up to an additional 30 days before being purged

You can request immediate deletion of your account and all associated data at any time by contacting us.

8. Your Rights

You have the right to:

• Access your data — all Your Data is visible and accessible within the Service at all times
• Export your data — you can export your quotes, invoices, client lists, and other business data
• Correct your data — you can edit your account information and business data at any time within the Service
• Delete your data — you can request complete deletion of your account and all associated data
• Object to processing — you can contact us to object to specific data processing activities

To exercise any of these rights, contact us at privacy@pipepilot.app. We will respond within 30 days.

9. Cookies

We use cookies and similar technologies for:

• Essential cookies: Required for the Service to function — authentication, session management, and security. These cannot be disabled.
• Analytics cookies: Help us understand how the Service is used so we can improve it. These can be disabled.

We do not use advertising cookies or tracking cookies from third-party ad networks.

10. Third-Party Services

The Service uses the following third-party services that may process your data:

Each provider is bound by their own privacy and security obligations. We select providers who maintain appropriate data protection standards.

11. Children's Privacy

The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete that data promptly.

12. International Data Transfers

If you access the Service from outside Canada, your data may be transferred to and processed in Canada or other jurisdictions where our infrastructure is located. By using the Service, you consent to this transfer. We ensure that appropriate safeguards are in place for international data transfers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through the Service at least 30 days before the changes take effect. The "Last updated" date at the top reflects the most recent revision.

14. Contact

If you have questions about this Privacy Policy or how we handle your data, please contact us: