Privacy Policy
Last updated: March 18, 2026
1. Introduction
This Privacy Policy describes how Reblox Solutions LLC, doing business as PipeLime ("PipeLime," "we," "us," or "our"), collects, uses, discloses, and protects information in connection with our website at https://pipelime.ai and our SaaS platform (collectively, the "Service").
PipeLime is a B2B sales intelligence and lead generation platform. We help businesses identify, enrich, and engage with potential business contacts. This Privacy Policy applies to:
- Customers — businesses and individuals who register for and use our Service
- Website visitors — individuals who visit our marketing website
- B2B contacts — business professionals whose publicly available professional information may be included in our platform
- End users of our customers' websites — individuals whose website visits may be processed through our Website Tracker feature on behalf of our customers
We are committed to protecting your privacy and handling your data responsibly. Please read this Privacy Policy carefully to understand our practices.
2. Definitions
- Platform refers to PipeLime's SaaS application, APIs, and related tools accessible at app.pipelime.ai.
- Service refers to the Platform and our marketing website collectively.
- Customer means any business or individual that creates an account to use our Platform.
- Authorized User means any individual granted access to a Customer's workspace on the Platform.
- Lead Data means business contact information — including names, job titles, business email addresses, phone numbers, LinkedIn profile URLs, and company information — that is available through or generated by the Platform.
- B2B Contact Data means professional information about business contacts sourced from publicly available sources and third-party data providers.
- Website Visitor Data means information collected through our Website Tracker feature from visitors to our Customers' websites, including IP addresses, user agents, and page URLs.
- Personal Data means any information that relates to an identified or identifiable natural person, as defined under the General Data Protection Regulation (GDPR).
- Controller means the entity that determines the purposes and means of the processing of Personal Data.
- Processor means an entity that processes Personal Data on behalf of a Controller.
3. Data We Collect
3.1 Customer Account Data
When you register for and use our Platform, we collect:
- Full name and email address
- Phone number (optional)
- Company name, industry, and size
- Payment and billing information (processed securely via Stripe — we do not store full credit card numbers)
- OAuth credentials when you connect third-party accounts (e.g., Google, Microsoft, LinkedIn)
- IP address and approximate geolocation at login (for security and fraud prevention)
- Browser type, device information, and user agent
3.2 B2B Contact Data (Lead Data)
Our Platform provides access to business contact information sourced from publicly available sources and third-party data providers. This may include:
- Full names and job titles
- Business email addresses
- Business phone numbers
- LinkedIn profile URLs
- Company name, industry, size, website, and location
- Professional biography and description
Sources of B2B Contact Data include:
- Third-party B2B data providers (such as Apollo.io)
- Publicly available professional profiles (such as LinkedIn, via authorized API integrations)
- Publicly available business information from company websites
- Business listing services (such as Google Places)
- Customer-uploaded data (CSV imports)
3.3 Website Visitor Data
When our Customers use the Website Tracker feature, a JavaScript snippet installed on their website collects the following data from their website visitors:
- IP address
- Browser user agent
- Page URL visited
- Timestamp of visit
This data is used to identify the company (not the individual person) associated with the IP address, using third-party IP-to-company resolution services. We may also derive approximate geolocation (country, region, city) from the IP address using geolocation services.
Important: For Website Tracker data, PipeLime acts as a Processor on behalf of our Customer (the Controller). Our Customers are responsible for providing appropriate notice to their website visitors and complying with applicable privacy and cookie consent laws.
3.4 Email Engagement Data
When our Customers send emails through our Platform, we collect engagement data to provide campaign analytics:
- Email open events (detected via tracking pixels/web beacons)
- Link click events (detected via redirect URLs)
- Bounce and spam reports
- IP address and user agent at the time of engagement
3.5 LinkedIn Engagement Data
When our Customers use LinkedIn automation features, we collect:
- Connection request status (sent, accepted, declined)
- Message delivery and read status
- Post engagement metrics (likes, comments, shares)
- Conversation history between Customer and their contacts
3.6 Usage Data
We automatically collect information about how you interact with our Service:
- Pages visited on our marketing website and Platform
- Features used and actions taken within the Platform
- Session duration and frequency of use
- Browser type, operating system, and device information
- Referring URLs and search terms
4. How We Use Your Data
We use the data we collect for the following purposes:
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Providing and operating the Service | Account Data, Usage Data | Contract performance |
| B2B lead generation and data enrichment | B2B Contact Data | Legitimate interest |
| Website visitor company identification | Website Visitor Data | Legitimate interest (of Customer as Controller) |
| Email campaign delivery and analytics | Email Engagement Data | Contract performance + Legitimate interest |
| LinkedIn outreach automation | LinkedIn Engagement Data | Contract performance |
| AI-powered features (lead scoring, email generation, match scoring) | B2B Contact Data, Account Data | Contract performance + Legitimate interest |
| Analytics and service improvement | Usage Data | Legitimate interest |
| Payment processing and billing | Account Data (payment info via Stripe) | Contract performance |
| Security, fraud prevention, and abuse detection | Account Data, Usage Data (IP, device info) | Legitimate interest |
| Compliance with legal obligations | All categories as required | Legal obligation |
5. Legal Bases for Processing (GDPR)
Under the General Data Protection Regulation (GDPR), we rely on the following legal bases for processing Personal Data:
5.1 Contract Performance (Article 6(1)(b))
We process Customer Account Data and related information as necessary to provide the Service under our Terms of Service. This includes account creation, authentication, payment processing, and delivering the features you subscribe to.
5.2 Legitimate Interest (Article 6(1)(f))
We rely on legitimate interest as our legal basis for processing publicly available B2B contact information for the purpose of business-to-business communications and sales intelligence.
We have conducted a Legitimate Interest Assessment (LIA) and determined that:
- Purpose: The processing is necessary for the legitimate purpose of facilitating B2B commerce and enabling businesses to identify and connect with potential business partners and customers.
- Necessity: There is no less intrusive way to achieve the same purpose at scale, as B2B contact information is essential for business development activities.
- Balancing test: The data processed consists of professional/business information (not sensitive personal data). Business professionals have a reasonable expectation that their publicly available professional information may be used for B2B communications. We provide clear opt-out mechanisms for any individual who does not wish their information to be processed.
You have the right to object to processing based on legitimate interest at any time. See Section 9 (Data Subject Rights) for details on how to exercise this right.
5.3 Consent (Article 6(1)(a))
Where required by applicable law, we obtain your consent before processing your Personal Data. This applies to certain cookie usage, marketing communications to you, and other processing activities where consent is the appropriate legal basis. You may withdraw your consent at any time.
5.4 Legal Obligation (Article 6(1)(c))
We process Personal Data when necessary to comply with applicable laws, regulations, court orders, or legal processes.
6. Third-Party Data Sharing
We share data with the following categories of third parties in order to provide and improve our Service:
| Category | Provider(s) | Purpose |
|---|---|---|
| B2B Data Provider | Apollo.io | Lead data sourcing and enrichment |
| LinkedIn API Provider | Unipile | LinkedIn outreach automation and messaging |
| IP-to-Company Resolution | RB2B | Identifying companies from website visitor IP addresses |
| IP Geolocation | ip-api.com | Determining approximate location from IP addresses |
| Web Data Services | Scrapfly, ScrapingBee, BrightData | Extracting publicly available company information from websites |
| Business Listings | Google Places API | Company data enrichment (reviews, ratings, location) |
| Payment Processing | Stripe | Secure payment processing and billing |
| Error Monitoring | Bugsnag | Application error tracking and debugging |
| Customer CRM Integrations | HubSpot, HeyReach (at Customer's direction) | Syncing Lead Data to Customer's CRM at their request |
We may also share data with law enforcement or regulatory authorities when required by law, or with professional advisors (lawyers, auditors) as needed.
We do not sell your Personal Data. For a complete list of our sub-processors, please refer to our Data Processing Agreement.
7. International Data Transfers
PipeLime is operated by Reblox Solutions LLC, a company incorporated in the State of Florida, United States. Your data may be transferred to and processed in the United States or other countries where our service providers operate.
When we transfer Personal Data from the European Economic Area (EEA), United Kingdom (UK), or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we implement appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) — approved by the European Commission for transfers outside the EEA
- UK International Data Transfer Addendum — for transfers from the UK
- Supplementary technical and organizational measures — including encryption in transit and at rest
For more details on our data transfer mechanisms, please refer to our Data Processing Agreement.
8. Data Retention
We retain data for different periods depending on the type and purpose:
| Data Type | Retention Period |
|---|---|
| Customer Account Data | Duration of subscription + 30 days after cancellation |
| Lead Data | Duration of subscription; soft-deleted upon Customer request, permanently purged after 90 days |
| Website Visitor Data | 12 months from collection |
| Email Engagement Data | Duration of subscription |
| Usage Data & Logs | 12 months |
Soft deletion: When data is deleted through the Platform, it is initially "soft-deleted" (marked as inactive but retained in our database). Soft-deleted data is permanently purged from our systems within 90 days. During this period, the data is not accessible through the Platform and is not used for any purpose other than backup and disaster recovery.
We may retain certain data for longer periods where required by applicable laws (e.g., tax and accounting records).
9. Your Rights (GDPR & Applicable Laws)
If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, or if applicable laws in your jurisdiction grant you similar rights, you have the following rights regarding your Personal Data:
- Right of Access (Article 15) — You have the right to request a copy of the Personal Data we hold about you.
- Right to Rectification (Article 16) — You have the right to request correction of inaccurate Personal Data.
- Right to Erasure (Article 17) — You have the right to request deletion of your Personal Data ("right to be forgotten"), subject to certain legal exceptions.
- Right to Restriction (Article 18) — You have the right to request that we restrict the processing of your Personal Data in certain circumstances.
- Right to Data Portability (Article 20) — You have the right to receive your Personal Data in a structured, commonly used, machine-readable format.
- Right to Object (Article 21) — You have the right to object to processing based on legitimate interest. This is particularly relevant if you are a B2B contact whose professional information appears in our platform and you wish to be removed.
- Rights Related to Automated Decision-Making (Article 22) — You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
- Right to Withdraw Consent — Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
How to Exercise Your Rights
To exercise any of these rights, please contact us at [email protected].
We will respond to your request within 30 days. If we need additional time (up to 60 additional days for complex requests), we will notify you of the extension and the reasons for it.
We may need to verify your identity before processing your request. We will not charge a fee for processing your request unless it is manifestly unfounded or excessive.
Right to lodge a complaint: You also have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu.
10. Automated Decision-Making and AI
PipeLime uses artificial intelligence and automated processing in several areas of our Service:
- Lead Scoring: AI algorithms analyze B2B Contact Data to generate match scores and relevance ratings, helping Customers prioritize potential leads.
- Content Generation: AI generates suggested email copy, LinkedIn messages, and other outreach content based on lead profiles and Customer-defined parameters.
- Company Analysis: AI analyzes publicly available company information to generate summaries and match assessments.
- Sales Agents: AI-powered agents can autonomously execute outreach sequences based on Customer-defined rules and parameters.
Important: No fully automated decisions with legal or similarly significant effects are made about individuals through our Platform. AI-generated outputs are provided as suggestions and tools for our Customers, who retain full control over how and whether to use them. Human oversight is maintained throughout the process.
If you believe that automated processing has adversely affected you, you may contact us to request human review.
11. Cookies and Tracking Technologies
We use cookies and similar technologies to operate our Service, analyze usage, and improve your experience.
Essential Cookies
Required for the Service to function. These include authentication tokens, session management, and security cookies. These cookies cannot be disabled.
Functional Cookies
Used to remember your preferences, such as language selection and display settings. These cookies enhance your experience but are not strictly necessary.
Analytics Cookies
Help us understand how visitors interact with our website by collecting information anonymously. We use this data to improve our Service.
You can manage your cookie preferences through our cookie consent banner, which appears when you first visit our website. You can also update your preferences at any time through your browser settings.
Web Beacons: Our marketing emails may contain small electronic images (web beacons) that allow us to track email opens and engagement for campaign analytics purposes.
12. Google Workspace API Data Usage and AI/ML Practices
This section outlines our specific policies regarding the handling of data obtained through Google Workspace APIs:
- We hereby affirm that we do not utilize any data obtained through Google Workspace APIs for the development, improvement, or training of generalized artificial intelligence (AI) and/or machine learning (ML) models.
- Any data collected through Google Workspace APIs is strictly limited to providing essential service functionality and is not employed in any capacity for the training or enhancement of AI/ML models.
- We maintain a strict policy against transferring Google Workspace API data to any third-party AI tools or services for the purpose of training or improving AI/ML models.
- Any artificial intelligence or machine learning features implemented within our service are exclusively powered by pre-trained models and do not incorporate or utilize Google Workspace API data for training or improvement purposes.
13. Children's Privacy
Our Service is designed for business use and is not directed at individuals under the age of 16. We do not knowingly collect Personal Data from children under 16. If we become aware that we have inadvertently collected Personal Data from a child under 16, we will take steps to delete such information promptly. If you believe that we may have collected information from a child under 16, please contact us at [email protected].
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify registered Customers via email or through a prominent notice on our Platform
- Where required by applicable law, obtain your consent to material changes
We encourage you to review this Privacy Policy periodically.
15. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have concerns about our data practices, please contact us:
- Privacy inquiries: [email protected]
- General inquiries: [email protected]
- Mailing address: Reblox Solutions LLC, 2222 Quail Roost Drive, Florida, United States
For matters related to data processing on behalf of one of our Customers (e.g., Website Tracker data or email campaigns), please contact the Customer directly, as they are the Controller of that data.