Privacy Policy

This policy explains how Scale Up Digital handles personal data in PipelinePilot. It covers two distinct things, and they are kept separate throughout because the rules that apply to them differ:

• Your data — the account and usage data of the person using the Service. Here we are the data controller.
• Prospect data — the business contact details the Service collects from public websites on your instruction. Here you are the controller and we act as your processor.

Part 1 — Data about you, our customer

What we collect

• Account: email address and authentication data. Passwords are hashed by our authentication provider and are never visible to us.
• Profile and settings: the service you offer, your ideal customer and target profile, and outreach preferences — because the product uses them to score prospects and draft copy.
• Usage: searches run, prospects consumed, credits used, and error logs.
• Billing: your plan, credit balance and transaction history. We never see or store your card details — Paddle collects and processes payment information directly.
• Integration credentials: if you connect your own email or an outreach tool, those credentials are stored encrypted and used only to carry out the actions you ask for.

Why we use it

To provide the Service and your account (performance of our contract with you); to take payment and prevent fraud (contract and legal obligation); to keep the Service secure, debug faults and improve it (our legitimate interests); and to send service messages such as sign-in and password reset emails (contract).

How long we keep it

For as long as your account is open. If you delete your account we delete or anonymise your personal data within 90 days, except records we must keep for tax and accounting purposes, which are retained for the period required by law.

Part 2 — Prospect data collected by the Service

When you run a search, the Service visits publicly accessible pages on business websites and extracts contact details published there — typically a business email address, phone number, social profile and, where a site names one, an owner or contact name. Under data protection law a business email like jane@example-plumbing.com can still be personal data, so it is treated as such here.

Our role, and yours

You decide what to search for and what to do with the results, so you are the controller of that data and we process it on your instructions. That means the obligations in this Part largely fall on you, and the Acceptable Use section of the Terms of Service sets out what you must do before contacting anyone.

Source and scope

• Data comes only from publicly accessible pages on business websites. The Service does not log in, bypass paywalls, or defeat access controls or anti-bot measures, and it skips pages that present one.
• It is aimed at businesses, not private individuals, and it does not collect special category data.
• Extracted page content is truncated and retained only as far as needed to score and display the prospect.

If you are a business we contacted

If you received an email because your details were collected through PipelinePilot, the sender is our customer, not us — they chose to contact you and they control that data. Ask them to stop and to erase your details, and they are obliged to comply.

You can also write to support@pipelinepilot.app and we will remove your details from our systems and add the domain to a suppression list so it is not collected again. Include the website domain and the address concerned. We will respond within 30 days.

Who we share data with

We do not sell personal data. We share it only with the providers below, each of which processes it on our behalf under contract:

Content sent to our AI provider for scoring and drafting is not used to train their models. We may also disclose data where legally required, or as part of a merger or acquisition, in which case we will notify you.

International transfers

Our providers operate in the United States and the European Union, so data may be transferred outside your country. Where data leaves the EEA or the UK, transfers rely on the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

Security

Data is encrypted in transit and at rest. Access is restricted per account at the database level so one customer cannot read another’s data. Integration credentials are encrypted at the field level. No system is perfectly secure, but we will notify you and any relevant regulator of a breach affecting your personal data as required by law.

Your rights

Depending on where you live you may have the right to access, correct, delete, port, restrict or object to our use of your personal data, and to withdraw consent. If you are in California, we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights.

Exercise any of these by emailing support@pipelinepilot.app. You may also complain to your local data protection authority.

Cookies

We use cookies and equivalent local storage that are strictly necessary to run the Service — keeping you signed in and remembering interface preferences. We do not use advertising or cross-site tracking cookies. Paddle sets its own cookies during checkout, governed by Paddle’s privacy policy.

Children

The Service is for business use and is not directed at anyone under 18. We do not knowingly collect data from children.

Changes

We will post updates here and, if a change is material, notify you by email or in-app.

Contact

Scale Up Digital.
support@pipelinepilot.app