Data Confidentiality

You are being asked to connect your inbox and your client book to software you did not write. That is a reasonable thing to hesitate over. This page explains, in plain language, what Pipeflow can see, what it does with it, and what it will never do.

This page is a summary written for clarity. The Privacy Policy is the binding document, and if the two ever appear to disagree, the Privacy Policy governs.

The short version

• We never sell your data. Not to data brokers, not to advertisers, not to anyone.
• We never use your data to train AI models. Our AI provider, Anthropic, states that it does not train on API data by default.
• We do not read your mail. Access is automated. A human at Pipeflow does not browse your inbox.
• Your data is walled off from other brokerages. When you use the app, the database itself enforces it with row-level security.
• You can disconnect at any time, inside Pipeflow or directly with Google or Microsoft. Disconnecting inside Pipeflow also deletes the mail data we hold from that inbox, and you can delete your whole account yourself in Settings.

What Pipeflow actually sees

Connecting a mailbox is optional. Everything else in Pipeflow works without it.

If you do connect one, here is precisely what is kept:

Stored in your account:

• Who a message is from and who it was sent to, its subject line, and a short preview
• When it arrived, and which mailbox folder or label it is in
• Whether it has an attachment
• Which of your contacts it matched
• When Pipeflow proposes a record from a message, up to the first 8,000 characters of its text (or 20,000 characters of a PDF attachment's text), deleted after 90 days

Not stored:

• Your mailbox. When you open a message in Pipeflow, it is fetched from Google or Microsoft at that moment and is not kept afterward.
• Attachment files. Where a PDF is read, only the extracted text described above is kept. The file itself is never stored on our servers.
• Your email password. We never see it. Access is by a token you grant and can revoke. The token stays on our servers and never reaches your browser.

How the AI part works

Pipeflow reads mail to find referrals you would otherwise lose. That reading is done by a large language model provided by Anthropic.

What that means concretely:

• Message text is sent to Anthropic over an encrypted connection, processed, and a result comes back.
• Anthropic states that, by default, it does not use API inputs or outputs to train its models, and that it deletes them within 30 days unless it must keep them longer to enforce its Usage Policy or to comply with the law.
• What comes back is a draft for you to confirm, not a fact. It can be wrong. You review before it becomes a record.

If you would rather no mail be processed this way, do not connect a mailbox.

Who can see your data

Nobody at another brokerage. When you use the app, organization separation is enforced by row-level security in the database: a request that is not entitled to a row does not receive it. Pipeflow's background mail synchronization runs on our servers and is separately limited to your own organization.

Inside your own organization, visibility follows your role. Your contacts are yours alone — not even the owner or your team lead sees them. The owner and your team lead see the facts of your deals and your client's name and role, not your private notes. Listings are shared with the brokerage. Your mail is visible only to you.

At Pipeflow, access to production data is restricted to what is required to operate and secure the Service — investigating an error you report, responding to a security incident, or complying with a legal obligation. We do not browse customer data, and we do not read your mail for product research.

Where your data lives

The full list of service providers, and what each one receives, is in the Privacy Policy. All connections use TLS encryption. Mail credentials are held server-side and are never exposed to a browser or to another user.

What we ask of you

Pipeflow holds information about your clients — people who never signed up for anything. That responsibility is shared:

• Only connect a mailbox you are entitled to connect. If your brokerage provides it, make sure their policy permits it.
• Only enter client information you are permitted to store in third-party software under your brokerage's policy, your MLS rules, and any confidentiality obligations you carry.
• Review what Pipeflow drafts before you accept it. The AI can misattribute a person or misread a number.

Turning it off

• Disconnect a mailbox in Settings › Email. Pipeflow revokes its Google access, deletes the tokens, and deletes that inbox's synced messages and stored text. You can also revoke access directly at Google or Microsoft.
• Delete records individually from within the app.
• Delete your account in Settings › Profile, or — if you own the brokerage — delete the brokerage in Settings › Brokerage. See the Privacy Policy for exactly what is deleted and when.

Honest limitations

We would rather tell you these than have you discover them:

• No system is perfectly secure. We use encryption in transit, database-level isolation, and least-privilege access, and we still cannot promise absolute security. Nobody can.
• AI output can be wrong. Suggestions are drafts. Review them.
• We depend on other companies. Google, Microsoft, Supabase, Vercel, Anthropic, and Stripe each have their own security posture and their own outages.
• Pipeflow is not your compliance system of record. Keep whatever records your license and your brokerage require.

Questions

Anything about how your data is handled: support@pipeflowhub.com. We will answer.