Privacy Policy

This Privacy Policy explains how Pipelyn, Inc. (“Pipelyn,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information when you use our websites, web and mobile applications, the service-provider workspace, the property marketplace, and related services (collectively, the “Services”).

This policy applies to account holders (owners, property managers, brokers, lenders, and service providers), their authorized users, and individuals whose information is entered into the Services — including tenants, applicants, vendors, and job contacts. Where Pipelyn processes personal information on behalf of a customer (for example, tenant records a manager uploads), we act as a processor / service provider and handle that data according to our customer agreement and applicable law.

By using the Services, you acknowledge the practices described here. If you do not agree, please do not use the Services.

We collect information you provide directly, information generated as you use the Services, and information from third parties such as public agency records and your chosen integrations.

We use the information we collect to:

• Provide, operate, secure, and improve the Services and your account.
• Coordinate field work — dispatching jobs, sending appointment and ETA updates, and routing per-job messages between owners and service providers.
• Send notifications you or your account administrator have enabled, by text message, email, and in-app, as described in Sections 4 and 5.
• Monitor compliance deadlines and generate filings, reports, and analytics.
• Process payments, prevent fraud, and enforce our Terms.
• Respond to support requests and communicate service and security updates.
• Comply with legal obligations and protect the rights, safety, and property of Pipelyn, our customers, and the public.

We rely on the legal bases of contract performance, legitimate interests, consent (where required — including for marketing text messages), and legal obligation.

Pipelyn sends text-message (SMS/MMS) notifications through Twilio, our messaging subprocessor. Texts keep owners, managers, technicians, and job contacts informed about time-sensitive work without requiring everyone to be logged in.

Types of messages we send

• Transactional & operational: job and work-order status, dispatch and ETA alerts, appointment and visit reminders, schedule changes, estimate and invoice notices, payment confirmations, and emergency or no-heat alerts.
• Account & security: one-time passcodes, login verification, and critical account notices.
• Optional marketing: product news, tips, and offers — sent only where you have separately opted in, and never as a condition of using the Services.

Information shared with our messaging provider

To deliver these messages, the recipient’s mobile number, message content, and delivery metadata (such as timestamps and delivery status) are processed by Twilio on our behalf. Twilio acts as our subprocessor under a data-processing agreement and encrypts data in transit (TLS) and at rest. Its security certifications are listed in Section 7.

Mobile information and consent to receive text messages are never sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes. Sharing is limited to the subprocessors and purposes needed to deliver the messages you have requested, as described in this policy.

In addition to text messages, we deliver notices electronically by email and in-app — including operational alerts, compliance deadlines, document-ready notices, billing statements, receipts, and required legal and account communications. By using the Services you consent to receive these communications electronically. Your consent to receive legally required notices electronically, and how to withdraw it, is governed by the Electronic Communications & Consent section of our Terms & Conditions.

• You control most notifications. Operational and marketing email and text preferences can be managed in your account settings or via the unsubscribe link in each marketing message.
• Transactional and legal notices (security alerts, billing, and required disclosures) are part of the Services and may continue while your account is active.

We do not sell your personal information. We share it only as needed to operate the Services:

• Within your account: with the users, teammates, and counterparties you collaborate with — for example, an owner and a service provider on a shared job.
• Subprocessors: vetted vendors that host our infrastructure, store data, deliver messages, process payments, and provide analytics and support tooling — each under contract and limited to instructions from us. See Section 7.
• Integrations you authorize: accounting, identity, screening, and agency connectors you choose to enable.
• Legal & safety: to comply with law, valid legal process, or to protect rights, safety, and the integrity of the Services.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

We protect information with encryption in transit (TLS) and at rest, role-based access controls, network isolation, audit logging, least-privilege access, and routine penetration testing. No method of transmission or storage is perfectly secure, but we work to align our practices and our subprocessors with recognized industry standards.

The independent providers that operate our hosting, database, and messaging maintain the following certifications and attestations:

Certifications reflect the published compliance posture of our subprocessors and may change as their programs and our vendor set evolve. A current list of subprocessors is available on request at legal@pipelyn.com.

We retain personal information for as long as your account is active and as needed to provide the Services, then for the period required to meet legal, tax, accounting, compliance-recordkeeping, and dispute-resolution obligations. Property, lease, and compliance records are often retained longer to support regulatory requirements. When information is no longer needed, we delete or de-identify it. Customers can request export or deletion of account data as described in Section 9.

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to opt out of certain processing. These may include rights under the California Consumer Privacy Act (CCPA/CPRA), the EU/UK GDPR, and similar laws.

• Access & portability: request a copy of your personal information.
• Correction & deletion: ask us to fix or delete information, subject to legal retention.
• Communication choices: manage text and email notifications in settings, reply STOP to texts, or unsubscribe from marketing email.
• No sale / no targeted ads: we do not sell personal information or share it for cross-context behavioral advertising.

To exercise a right, email legal@pipelyn.com. We will verify your request and respond within the timeframe required by applicable law. Where Pipelyn processes data on behalf of a customer, we will refer your request to that customer. You will not be discriminated against for exercising your rights.

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Services, and understand usage so we can improve them. You can control cookies through your browser settings; disabling some may affect functionality. We use privacy-respecting analytics and do not use third-party advertising cookies for cross-site targeting. See our Cookie Policy for details.

The Services are intended for businesses and adults. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact legal@pipelyn.com and we will delete it.

Pipelyn is based in the United States and processes information there. If you access the Services from outside the U.S., your information may be transferred to and processed in the U.S. and other countries with different data-protection laws. Where required, we rely on recognized transfer mechanisms — such as the EU-U.S. Data Privacy Framework commitments of our providers and Standard Contractual Clauses — to safeguard the data.

We may update this Privacy Policy from time to time. When we make material changes, we will revise the “Last updated” date and, where appropriate, notify you by email, text, or in-app notice. Your continued use of the Services after an update means you accept the revised policy.

Questions about this policy or your information? Reach our privacy team:

This Privacy Policy is provided for general informational purposes and is a template that should be reviewed and adapted with qualified legal counsel before publication. It does not constitute legal advice.