Privacy policy

Who we are

Pipefill is the data controller for the personal data described on this page. We are a small business and there is no separate legal entity behind the name.

The fastest way to reach us about anything on this page, including a removal request, is oussama@getpipefill.com. A person reads it.

We do not publish a postal address. If you need one for a formal data protection request, ask at the address above and we will provide it.

What personal data we process

For people we contact through outreach, we process business contact details only:

• Full name
• Business email address
• Job title
• Employer name, website and industry
• Country, region or city of the employer
• Publicly available professional information relevant to whether our service is a fit, such as whether the company takes enquiries through a form on its website
• Whether you replied, and whether you asked to be removed

We do not process special category data. We do not process personal data about consumers, and we do not knowingly process data about anyone under 18.

If you email us or book a call, we also process what you send us.

Where the data came from

We did not get it from you. Business contact details are compiled from publicly accessible professional sources: company websites, public business directories and professional networking profiles. In practice we use Apollo and Apify to assemble that information.

Email addresses are then checked with Bouncer, an email verification service, before use — so that we are not sending to addresses that no longer exist.

We do not buy consumer data and we do not scrape private or password-protected sources.

Why we are allowed to use it

Our legal basis is legitimate interests under Article 6(1)(f) of the UK and EU GDPR. Our legitimate interest is contacting businesses that may need the service we provide.

We have balanced that interest against your rights. In short: the data is business contact data, not private data; the message is relevant to your professional role; the volume you receive from us is low; every message says who is writing; and we stop at the first indication that you are not interested. If we could not honestly say all of that, we would not be sending.

You can object to this processing at any time and we will stop. See "Your rights" below. There is no test to pass and no reason required.

Some countries apply stricter rules to business-to-business email than the GDPR baseline, and require prior consent. Where we cannot satisfy the rules that apply to you, we suppress the address rather than send to it.

What we use it for

• Sending outreach email introducing our own lead-response service
• Recording whether you replied, so that you are not contacted twice about the same thing
• Recording a removal request, so that you cannot be added back to a future list
• Arranging and holding a call if you ask for one
• Meeting our own legal obligations, such as keeping proof that we honoured a removal request

We do not sell personal data. We do not share our outreach lists with anyone. We do not use your data to train machine learning models.

Who else sees it

We use a small number of service providers who process data on our instructions:

• Instantly.ai — the platform that stores our outreach lists and sends the email
• Bouncer — email address verification
• Apollo and Apify — sourcing the business contact data described above
• Google Workspace — the mailboxes the email is sent from, and where your reply arrives
• Vercel — hosting for this website. It receives the usual server request logs; it does not receive your outreach data.

Some of these providers are based outside the UK and EEA, mainly in the United States. Where that is the case, transfers are covered by the EU Standard Contractual Clauses or an equivalent safeguard.

How long we keep it

• Outreach contact data: kept for the duration of the campaign and deleted within 12 months of the last contact, unless you replied and asked us to stay in touch.
• Removal requests: your email address is kept on a suppression list indefinitely. This is deliberate. It is the only way to guarantee a future list build does not add you back. Nothing is kept alongside it except the fact that you asked to be removed and the date.
• Emails you send us and call bookings: kept for 24 months.

Cookies and tracking

This website sets no cookies. It runs no analytics, no advertising pixels, no session recording and no third-party trackers. Nothing on this page profiles you and there is nothing here to consent to.

Our outreach emails do not use tracking pixels to record whether you opened them, and they contain no tracked links. Open tracking and link tracking are switched off on every campaign we run.

If this ever changes, this section changes first.

Your rights

Under the UK and EU GDPR you can ask us to:

• Tell you what data we hold about you, and give you a copy
• Correct anything that is wrong
• Delete it
• Stop processing it, or restrict how we use it
• Object to processing based on legitimate interests — including direct marketing, where your objection is absolute and we must stop
• Provide it in a portable format

To use any of these, email oussama@getpipefill.com. We will respond within one month, and normally much faster. There is no charge.

If you are not happy with our response you can complain to your national data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU it is the supervisory authority in your country.

If you are in the United States

Our commercial email complies with the CAN-SPAM Act: the sender is identified honestly, subject lines are not misleading, headers are not falsified, every message offers a way to opt out, and opt-outs are honoured promptly and permanently.

If you are a California resident, the CCPA gives you rights to know, delete and opt out of the sale of personal information. We do not sell personal information. Use the same address above to exercise any of these rights.

Security

Data is held in access-controlled accounts with two-factor authentication, and access is limited to the people who need it. This site is served over HTTPS only.

No system is perfect. If you believe data has been exposed, tell us at the address above and we will investigate immediately.

Changes to this policy

If this policy changes we will update the date at the top. Material changes to how we use outreach data will be described here rather than made quietly.