Privacy Policy

Effective: October 15, 2026

Pipeflow ("Pipeflow," "we," "us") provides a customer relationship management application for real estate professionals at pipeflowhub.com (the "Service"). This policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the choices available to you.

Pipeflow is operated by Pipeflow LLC, a New York limited liability company, with a place of business at 418 Broadway, Ste N, Albany, NY 12207.

Questions about this policy or your data: support@pipeflowhub.com.

1. Who this policy covers

This policy covers two groups of people:

• Users — real estate professionals who create a Pipeflow account, and the brokerages or teams they belong to.
• Third parties — clients, counterparties, attorneys, and other individuals whose information a User enters into Pipeflow or whose correspondence appears in a mailbox a User connects. These individuals do not have Pipeflow accounts.

If you are a third party and want to know what a User has stored about you, contact that User directly. Pipeflow processes that information on the User's instruction and cannot identify or release it to you without them. You may also contact us at support@pipeflowhub.com and we will route your request.

Your use of the Service is also governed by our Terms of Service.

2. Information we collect

2.1 Information you provide

• Account information — your name, email address, and password. Your password is handled by our authentication provider (Supabase); Pipeflow never sees it in readable form.
• Profile and settings — your role, your phone number, email signature, email templates, and other preferences. Your name, role, and profile settings are visible to the other members of your brokerage.
• Organization information — the brokerage or team you belong to, your role within it, and invitations you send or accept, including the invitee's email address.
• CRM content you enter — deals, contacts, tasks, notes, calendar events, listings, map pins, photos, offers, milestones, and closing details including prices and commissions.
• Photos — when you add a photo, Pipeflow re-saves it in your browser before upload, which removes the photo's embedded metadata, including any GPS location stored in the file.

2.2 Information from a connected mailbox

Connecting a Google or Microsoft mailbox is optional. Pipeflow's other features work without it. If you connect one, Pipeflow reads your messages in order to identify referrals, contacts, and deal activity, to log messages to the right client, and — for Gmail — to send messages you compose in Pipeflow.

What we store from your mailbox:

• For each synced message: the sender's name and email address, the recipient addresses (To and Cc), the subject line, a short preview snippet, the date received, the mailbox labels or folder, the thread identifier, whether it has an attachment, which of your contacts it was matched to, and whether you marked it seen or done in Pipeflow.
• Message text attached to a suggestion. When Pipeflow proposes a record from a message (for example, a new deal from a referral), it keeps up to the first 8,000 characters of that message's text with the proposal. When the proposal comes from a PDF attachment, it keeps up to 20,000 characters of the PDF's text and up to 4,000 characters of the covering email. This text is deleted 90 days after the suggestion is created.
• Activity history. When a message is logged to a contact, your activity history keeps a line with the sender, subject, and preview.
• Messages you schedule to send later. These are stored until they are sent. The message body is deleted 7 days after the message is sent, cancelled, or fails; the recipients and subject remain in your send history.

What we do not store:

• We do not keep a copy of your mailbox. When you open a message in Pipeflow, its full body is fetched from your mail provider at that moment and is not saved. If the message has since been deleted from your mailbox, Pipeflow shows that it is no longer available.
• We do not store attachment files. Where a PDF is read, only the extracted text described above is kept.
• We do not store your mail account password. Access is by OAuth token. Tokens are kept on our servers only and are never sent to your browser. You can revoke access at any time (see Sections 4, 5 and 8).

2.3 Location

• Addresses you enter are sent to geocoding services to obtain map coordinates and, for New York City addresses, public property identifiers (see Section 7).
• Your device's location is collected only when you turn it on — by pressing "Locate me" or using Field mode on the map. Your browser asks for your permission first. Pipeflow uses the location to center the map and to look up the building you are standing at, which sends your coordinates to NYC GeoSearch. It is stored only if you place a map pin at your current location, or add a photo to a map pin while Field mode is on (the location where the photo was taken is saved with the pin). Pipeflow never collects your location in the background.

2.4 Information collected automatically

• Server logs — our hosting provider (Vercel) records requests to the Service, which can include your IP address, browser, the time of the request, your connected mailbox address, and attachment file names. They do not contain message bodies or access tokens.
• Security records — sign-ins to administrative tools, mailbox connections and disconnections, refused requests, and rate-limit events, stored as metadata (no content).
• AI usage records — for each AI request: the feature, the model, the number of tokens used, timing, and a related message identifier. They contain no prompts, no AI output, and no message content.
• Last active — the last time you used the app, for brokerage administration.

2.5 Stored in your browser

Your sign-in session, display preferences, unsent email drafts, and recently generated AI answers about your clients are stored in your browser on your device. The drafts and AI answers are cleared when you sign out. We do not use advertising cookies and we do not operate advertising trackers.

2.6 Notifications

If you turn on notifications on a device, Pipeflow stores that device's push address (a web address and encryption keys issued by your browser's push service), the type of browser and device, and when it was last used, together with your notification settings (which kinds you want, quiet hours and time zone). To deliver a notification, Pipeflow sends its short text — a title and one line, which can include a client's name, the words of one of your tasks, or an email's subject, but never the body of a message, a phone number or a money amount — encrypted, through your browser vendor's push service. Pipeflow keeps a record of which notifications it sent (the kind and the time, no text) for 30 days, so that none is sent twice.

2.7 Billing

Subscriptions are billed through Stripe. When a brokerage owner subscribes, Pipeflow sends Stripe the brokerage's identifier, the owner's login email, the plan, and the number of seats; Stripe collects the payment card, billing name, address, and any tax ID directly. Pipeflow stores the Stripe customer and subscription identifiers, plan, seats, status, and Stripe's event records. Pipeflow never sees or stores card numbers.

3. How we use information

We use the information above to:

• Provide, operate, and secure the Service
• Identify referrals, contacts, and deal activity in a connected mailbox and draft records for you to confirm
• Send email you compose within Pipeflow, from your own connected Gmail account
• Produce analytics, reminders, and suggestions within your own account or organization
• Respond to support requests
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use your data for advertising, and we do not use it to determine creditworthiness or for lending purposes. We do not use your data, including mailbox data, to train machine learning models.

4. Google user data — Limited Use

Pipeflow requests the following Google API scopes:

Pipeflow's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We use Google user data only to provide and improve user-facing features that are prominent in Pipeflow's interface: reading and logging your mail, suggesting records from it, and sending mail you compose.
• We do not transfer Google user data to third parties except as necessary to provide those features (message text is processed by Anthropic to produce suggestions — see Section 6), to comply with applicable law, or as part of a merger or acquisition, and in each case subject to the Limited Use requirements.
• We do not use Google user data for serving advertising, and we do not sell it.
• We do not use Google user data to determine creditworthiness or for lending purposes.
• We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and de-identified for internal operations.
• We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.

What we store from Gmail and for how long is described in Sections 2.2 and 9. You can review and revoke Pipeflow's access at any time at myaccount.google.com/permissions, or disconnect inside Pipeflow (Section 8).

5. Microsoft user data

Where you connect a Microsoft or Outlook mailbox, Pipeflow requests read-only mail permission (Mail.Read), basic profile information (User.Read), and offline access through the Microsoft Graph API. Pipeflow cannot send mail from a Microsoft mailbox. Microsoft data is used for the same purposes, stored for the same periods, and handled on the same terms as Google data in Sections 2.2, 4, and 9: we do not sell it, do not use it for advertising, and do not use it to train machine learning models.

You can review and remove Pipeflow's access at any time at myapps.microsoft.com. Microsoft does not offer a way for Pipeflow to revoke its own access, so when you disconnect inside Pipeflow we delete the access tokens and you can remove the remaining consent at that link.

6. Automated processing and artificial intelligence

Pipeflow uses a third-party large language model provider, Anthropic PBC, to identify referrals and deal information in your mailbox, to draft messages, summaries, and listing text, to read files you import, and to power Pipeflow's in-app assistant.

What this means in practice:

• Content is transmitted to Anthropic for processing, over an encrypted connection. For mailbox features this includes message text and text extracted from PDF attachments. For the assistant and drafting features it includes the records needed to answer — for example your contacts, deals, tasks, and schedule.
• Anthropic's own commitments. Anthropic states that, by default, it does not use inputs or outputs from its commercial products, including its API, to train its models, and that it deletes API inputs and outputs within 30 days, except where it needs to keep them longer to enforce its Usage Policy or to comply with the law (Anthropic Privacy Center, privacy.claude.com, read October 12, 2026).
• Assistant conversations are not stored by Pipeflow. A conversation with the in-app assistant is held in your browser while you use it and is cleared when you sign out.
• Outputs are suggestions, not conclusions. Pipeflow may draft a deal, note, task, or message. These drafts can be wrong, incomplete, or misattributed. Nothing in the Service is a substitute for your own review, and you remain responsible for what you accept into your records and for anything you send. If your brokerage turns on automatic application of email suggestions, only new tasks and notes can be applied without your review; anything else always waits for you.

If you do not want your mailbox processed this way, do not connect a mailbox. Pipeflow's manually entered CRM features do not require it.

7. How we share information

We share information only as follows:

Within your organization. Pipeflow is designed for brokerages and teams, and what colleagues can see depends on their role:

• Contacts are private to the agent who owns them — including from the brokerage owner and team leads.
• Deals are visible to their agent, that agent's team lead, and the brokerage owner. The owner and lead see the deal's facts and the client's name and role, but not the agent's private notes, tasks, or messages on that deal.
• Listings are visible to everyone in the brokerage.
• Your synced mail and mail suggestions are visible only to you.
• Your name, role, and profile settings are visible to the members of your brokerage.

Service providers (sub-processors). We use the following vendors, each of which processes data to provide services to us:

If you dictate to the assistant or into a map pin, your browser's built-in speech recognition is used, which may send the audio to your browser's vendor (for example Google, in Chrome).

Legal and safety. We may disclose information where required by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud or abuse.

Business transfer. If Pipeflow is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to the commitments in this policy and, for Google user data, to the Limited Use requirements.

We do not share your information with data brokers, advertisers, or analytics networks.

8. Your choices and controls

• Disconnect a mailbox. In Settings › Email. When you disconnect Gmail, Pipeflow revokes its access at Google, deletes the access tokens, and deletes that mailbox's synced messages, the message text stored with suggestions from it, and suggestions still waiting for your review. When you disconnect Outlook, Pipeflow deletes the access tokens and the same data. Records you created from your mail — a contact, a task, a line in your activity history — remain until you delete them. You can also revoke access directly with Google or Microsoft (Sections 4 and 5); that stops synchronization, and you can then delete the stored data by disconnecting inside Pipeflow or deleting your account.
• Edit or delete records. You can edit or delete deals, contacts, tasks, notes, and other records from within the Service. Activity history lines cannot be deleted one by one; they are deleted with your account or your brokerage.
• Export your data. Settings › Import & export › Export everything downloads your records as one file. Owners can also export a member's work records (deal facts, calendar events, and map pins); a member's contacts and private deal notes stay theirs.
• Delete your account. Agents and team leads can delete their own account in Settings › Profile › Delete my account. Pipeflow offers an export first, asks you to type DELETE, and then immediately deletes your login, profile and settings, your connected mailboxes' data (revoking Google access first), and your AI usage records' link to you. Your deals, contacts, and listings are deleted too if you choose; otherwise you are asked to export them and have your brokerage owner reassign your listings first, so nothing is left without an owner. A brokerage owner cannot delete their own account while they own the brokerage: they transfer ownership to another member first, or delete the brokerage.
• Delete your brokerage. The owner can delete the brokerage in Settings › Brokerage, after typing its name. The brokerage is locked for everyone immediately and permanently deleted 7 days later; the owner can cancel during those 7 days. On deletion, Pipeflow deletes every member's account and all of the brokerage's records, photos, and connected-mailbox data (revoking Google access first), and cancels the subscription immediately with no refund. Stripe keeps its invoice records for tax and legal purposes.
• Requests. You can also email support@pipeflowhub.com to request access to, a copy of, or deletion of your personal information.

9. Retention

Deletion happens on these timelines: deleting your account takes effect immediately; deleting your brokerage takes effect 7 days after the owner requests it; disconnecting a mailbox takes effect immediately.

Backups. Pipeflow takes administrative backups of its database before maintenance. They are stored on an encrypted device controlled by Pipeflow. Data you delete may remain in these backups until they are deleted, and is never restored into the live Service except for disaster recovery.

We may retain records where required to comply with a legal obligation, resolve disputes, or enforce our agreements.

10. Security

We protect information with measures including:

• Encryption in transit (TLS) for all connections to the Service
• Access controls per brokerage: when you read or change records in the app, our database's row-level security returns them only to the account and organization entitled to them; server processes that run without your session, such as mail synchronization, are separately limited to your own organization
• Mail access tokens kept on our servers only, never sent to your browser or to other users
• Least-privilege OAuth scopes, limits on request rates, and security logging

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law.

11. International users

Pipeflow is operated from the United States, and our database is located in the United States. Some service providers may process information in other countries (for example, the Photon geocoding service is hosted in Germany). If you access the Service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

12. Your rights

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect, use, and disclose; to request deletion; to request correction; and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined. We will not discriminate against you for exercising these rights. To make a request, contact support@pipeflowhub.com.

If you are in the European Economic Area or the United Kingdom, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. Where Pipeflow processes personal data on behalf of a User, that User is the controller and Pipeflow is the processor; direct your request to them, or to us and we will route it. Our lawful bases for processing are performance of a contract, our legitimate interests in operating and securing the Service, and your consent where you connect a mailbox.

Other US states. Residents of states with comprehensive privacy laws may have comparable rights. Contact us and we will honor requests to the extent the applicable law requires.

13. Children

Pipeflow is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

14. Changes to this policy

We may update this policy. When we do, we will update the effective date above and, where the change materially affects how we handle your data, provide notice within the Service before it takes effect. Material changes affecting Google user data will not be applied retroactively without your consent where consent is required.

15. Contact

Pipeflow LLC 418 Broadway, Ste N, Albany, NY 12207 support@pipeflowhub.com