Privacy policy

1. Who we are

Pipeline is operated by Nimble IO Ltd, a company registered in England and Wales (company number 12045561), registered office 20-22 Wenlock Road, London, England, N1 7GU. We are registered with the UK Information Commissioner's Office (ICO).

For anything in this policy, contact privacy@pipelineapp.co.uk.

2. Our two different roles

This matters, because different rules apply to each:

• We are the controller of data about you as our customer or website visitor - your account, billing, support and marketing data. This policy explains how we handle it.
• We are the processor of the data you put into Pipeline about your own customers, leads, jobs, quotes and invoices (“Customer Data”). You remain the controller of it. We only handle it on your instructions, under our Data Processing Agreement, which forms part of our terms of service and is available on request.

3. What we collect, why, and our lawful basis

• Account data (name, email, hashed password, company details) - to create and run your account. Lawful basis: performance of our contract with you.
• Billing data (billing name and address, subscription and invoice records, the last four digits and expiry of your card) - to take payment and keep accounts. Lawful basis: contract, and legal obligation for tax records. We never see or store your full card number - card details are handled directly by Stripe.
• Customer Data - processed only as your processor, on your instructions (see section 2).
• Enquiry and marketing data (name, email and anything you tell us via our contact, demo or mailing-list forms) - to answer you and, if you have opted in, to send you Pipeline news and offers. Lawful basis: legitimate interests in responding to your enquiry; consent for marketing emails.
• Usage, device and log data (IP address, browser, pages viewed, actions in the app, error logs) - to keep the service secure, diagnose faults and improve the product. Lawful basis: legitimate interests in running a secure, working service.
• Support communications - to help you and to improve our support. Lawful basis: contract and legitimate interests.

4. Mobile app permissions

If you use the Pipeline mobile app we may ask for access to certain device features. These are optional unless you use the related feature.

• Camera - to take job photos, receipt images and other attachments you choose to upload.
• Photos - to select existing images or files on your device and attach them to records.
• Location - to record where job photos, time entries or related field activity took place, when you choose to capture location. We do not track your location continuously or in the background.
• Notifications - to send account, job, appointment, task, message and payment updates relevant to your account.

You can change these at any time in your device settings. Turning one off may stop the related feature working, but the rest of Pipeline will still work.

4a. MCP connections and AI assistants, including ChatGPT

Model Context Protocol (MCP) lets a compatible application or AI assistant access Pipeline tools on your behalf. These connections are optional and start only when you configure or authorise them. This section covers Pipeline's MCP service generally, including the Pipeline plugin for ChatGPT and other compatible MCP clients.

When you connect a client, we process your Pipeline account and workspace identity, approved permissions, and OAuth credentials to authorise access. Your chosen client uses an access credential to call the service; credentials are not included in tool results. Access is limited by the credential's scopes and your Pipeline permissions. You can revoke the connection or API token in Pipeline; revoking access does not remove information already received or stored by the client or its provider.

We receive the tool name and arguments selected for your request, which may contain search terms, record references, contact details, dates, or content you ask us to save or send. We use them to retrieve records or carry out the action within your approved permissions. Depending on the tool and request, results returned to your chosen MCP client may contain:

• Business records - customer, lead, supplier and subcontractor names; property and work descriptions; job, task and appointment titles, statuses, dates and times; tags and custom fields.
• Contact and location details, when explicitly requested - customer or business email addresses, telephone numbers, postal and service addresses, and property coordinates, for contact lookup, work location, or preparing a communication.
• Team information - staff display names and job titles to explain assignments and availability; working hours, time off and busy periods when requested. Resolving a person for a requested assignment also returns their assignment identifier. Staff contact details and account security settings are excluded.
• Commercial records - quote, invoice and expense references, line items, amounts, payment status, payment methods and references, payment claim and review details, and requested report figures.
• Content stored in your workspace - notes, messages and recipients when requested, reminders, questionnaire questions and answers, custom field values, and attachment details or links returned by the selected tool. Free text and attachments can contain personal information that you or your team have entered.
• Record references - business record identifiers needed to retrieve or act on the selected records, plus result counts and pagination. Nested related records are subject to the same response filtering.

Routine results omit contact and address fields, internal workspace identifiers, creation and modification timestamps, debug payloads, logs, authentication secrets and staff account metadata. Operational dates, such as appointment times and payment dates, remain where needed to answer the request. Error responses use fixed messages rather than passing through server exception details. Only request or share information you are authorised to use, and avoid placing sensitive personal information in free text or attachments.

Your chosen MCP client receives the tool results. If you use a hosted client or AI assistant, its provider may also receive and store them under its own terms, privacy policy and your account settings. This may involve processing outside the UK and use for model improvement, depending on the provider and settings. Review those policies, storage locations and data controls before connecting. A locally operated client may keep processing on your device, depending on how you configure it and whether it sends data to other services.

For the ChatGPT plugin specifically, OpenAI receives tool results as part of your ChatGPT conversation. OpenAI's terms, privacy policy and your ChatGPT data controls govern its processing and retention. Pipeline does not control copies held by OpenAI or another MCP provider. The fact that Pipeline does not use Customer Data to train models does not change your chosen provider's policies.

We retain Pipeline records under section 8; connection credentials are retained until they expire or are revoked. Security and audit records may include the acting user, action, affected record and outcome so we can protect the service and investigate changes; these logs are not returned as tool results.

5. What we never do

We never sell or rent your personal data. We never use your Customer Data to train AI models. We never use your Customer Data for any purpose other than delivering the service you signed up for and as permitted by our Data Processing Agreement.

6. Who we share data with

We use a small number of carefully chosen suppliers (sub-processors) to run Pipeline. They may process personal data on our behalf, under contract, and only for the purpose we engage them for:

• 20i - cloud hosting for the Pipeline platform and database (UK data centres).
• Wasabi - encrypted file and attachment storage (UK data centres).
• Stripe - card payments and subscription billing.
• Mailgun - sending transactional email such as verification codes, notifications and invoices.
• Mailchimp - sending marketing email to people who have opted in.
• Google Fonts - serving the typeface on our website, which means Google receives your IP address when a page loads.
• Google Analytics - aggregated website usage statistics, loaded only if you allow analytics cookies.

When you authorise an MCP connection, we also return the requested data to your chosen client, which may share it with its provider as explained in section 4a. These user-selected clients and providers are separate from the suppliers listed above.

A current list of sub-processors is available from privacy@pipelineapp.co.uk. We will give customers reasonable notice before adding a sub-processor that handles Customer Data.

We may also disclose data where we are legally required to (for example a court order), or to establish, exercise or defend legal claims. If our business is sold or reorganised, data may transfer to the buyer, who must continue to protect it under this policy.

7. Where your data is stored, and international transfers

Your Customer Data and file attachments are stored in UK data centres - the platform and database on 20i cloud infrastructure, and files on Wasabi.

Some of our other suppliers are based outside the UK, so limited personal data (for example billing data shared with Stripe, or email addresses shared with Mailgun and Mailchimp) may be transferred internationally. Where that happens we rely on an appropriate safeguard under UK GDPR - normally the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

8. How long we keep it

• Account and Customer Data - for the life of your subscription and 30 days after cancellation, then deleted. You can ask us to delete sooner.
• Backups - taken once every 24 hours and kept on a rolling 28-day basis, after which they are overwritten.
• Financial and tax records - six years from the end of the relevant accounting period, because UK law requires it. This applies even if you ask us to delete your account.
• Marketing contacts - until you unsubscribe, plus a suppression record so we do not email you again by mistake.

9. How we protect it

We encrypt data in transit (TLS) and at rest, hash passwords, restrict staff access to what is needed to do the job, log administrative actions, and keep encrypted backups taken once every 24 hours. Those backups are there so we can restore the service after a failure on our side - they are not a substitute for keeping your own records, and the limits on our responsibility for data loss are set out in our terms of service. No system is perfectly secure, but if a breach affects your personal data we will notify the ICO within 72 hours where required, and tell you without undue delay where the risk to you is high.

10. Your rights

Under UK GDPR you can ask us to:

• give you a copy of your personal data, or port it to another provider;
• correct it if it is wrong, or delete it;
• restrict or object to how we use it, including profiling;
• stop sending you marketing - you can withdraw consent at any time, using the unsubscribe link in any marketing email.

Email privacy@pipelineapp.co.uk and we will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. If you are asking about data held by one of our customers in their Pipeline account, we will point you to that customer, as they control it.

If you are unhappy with how we have handled your data you can complain to the ICO at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.

11. Cookies

We use essential cookies and local storage to make the site and app work, plus optional analytics you can decline. We do not use advertising cookies or track you across other websites. See our cookie policy for detail and to change your preferences.

12. Children

Pipeline is a business tool. It is not intended for children and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, tell us and we will delete it.

13. Changes to this policy

We may update this policy as our service, data practices or legal requirements change. Minor corrections and clarifications that do not materially change how we handle personal data may take effect when published. The date at the top shows when this policy was last updated.

If a change materially affects how we use your personal data, we will email account holders at least 30 days before it takes effect and use other appropriate notices to inform affected individuals where required. If a legal requirement or urgent security issue makes that notice period impracticable, we will give as much notice as reasonably possible, subject to any existing notice commitments and applicable law.

Before using personal data for a new purpose, we will provide the required information to affected individuals and establish an appropriate lawful basis, including obtaining consent where required. Updating this policy or your continued use of Pipeline does not itself give us consent for a new use of personal data. Changes to this update process do not retrospectively remove notice commitments already made to you.