Privacy Policy

Last updated: 22 June 2026  |  ICO Registration: ZC164080

1. Who We Are

PipeIQ is a trading name of TradeBoost AI Ltd, a company registered in England and Wales (Company No. 17227850). This Privacy Policy also covers TradeBoost AI Ltd's other services — Aria (AI phone receptionist) and AnnualService (gas engineer re-booking reminders) — which are processed on the same terms described below. We are registered with the Information Commissioner's Office (ICO) under registration number ZC164080.

Data controller: TradeBoost AI Ltd (Company No. 17227850). Registered office details are publicly available at Companies House. Contact: hello@pipeiq.co.uk

2. What Data We Collect

We collect and process the following categories of personal data:

• Account data: name, email address, and business name provided during signup.
• Contact lists: phone numbers and names uploaded by agencies, gas engineers, or trades businesses for SMS campaigns or re-booking reminders.
• Call data (Aria only): caller phone number, transcribed conversation content, and appointment details for calls handled by the Aria phone receptionist.
• Usage data: campaign activity, message logs, reply records, and login timestamps.
• Billing data: payment information processed via our payment provider (we do not store card details).

3. Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR:

• Contract performance — to provide the relevant service to you (PipeIQ, Aria, or AnnualService).
• Legitimate interests — to operate, improve, and secure our platform.
• Legal obligation — to comply with applicable UK law and ICO requirements.

For SMS campaigns sent to end consumers, agencies are responsible for ensuring they hold valid PECR consent from their own contacts.

4. How We Use Your Data

• To provide and maintain the PipeIQ platform.
• To send transactional emails (account notices, receipts).
• To detect and prevent fraud or misuse.
• To comply with legal obligations.

We do not sell personal data to third parties. We do not use your data for advertising.

5. Data Retention

Contact data uploaded by agencies is retained for 12 months from the date of upload, then automatically purged. Agency account data is retained for the duration of the contract plus 12 months. Opt-out (STOP) records are retained indefinitely to honour opt-out requests. Audit logs are retained for 24 months.

6. Data Sharing

We share data only with:

• Twilio Inc. — SMS delivery infrastructure (US, SCCs in place).
• aql — trading name of (AQ) Networks Limited (Co. No. 04250076) — alternative UK SMS network route, including virtual mobile and geographic reply numbers. Data processed: recipient phone number and message content (UK-based, Leeds; no international transfer).
• 3G Telecommunications Limited (hlrlookup.com) — mobile number reachability screening before dispatch, so undeliverable numbers are removed from a list. Only the phone number is transmitted — no names or other personal data (UK-based; no international transfer).
• I Want That Ltd (TPS Services) — TPS/CTPS register screening. Phone numbers are checked against the Telephone Preference Service before every campaign dispatch. Only the phone number is transmitted — no names, emails or other personal data. Signed Data Sharing Agreement in place (UK, London).
• Stripe Inc. — payment processing for subscription billing. No contact data is sent to Stripe (US, SCCs in place).
• Twilio SendGrid — transactional email (account, billing and system notifications) (US, SCCs in place).
• Supabase Inc. — database hosting (EU region, contractually locked).
• Vercel Inc. — web hosting (US, SCCs in place).
• Google Cloud (GCP) — compute hosting for campaign dispatch, opt-out enforcement and voice AI (US, SCCs in place).
• GitHub, Inc. (Microsoft) — off-site disaster-recovery backup. A nightly copy of the database is held in a private repository for restore purposes only; it is not processed or disclosed onward (US, SCCs in place).
• Anthropic Inc. — AI language model (Claude) used for SMS message variant generation. Data processed: campaign name, client type, message tone parameters. No personal data of contacts is sent to Anthropic (US, SCCs in place).
• Deepgram, Inc. — speech-to-text transcription for the Aria voice-call assistant feature. Data processed: the caller's spoken words, transcribed in real time during the call (US). Deepgram offers a Data Processing Agreement with Standard Contractual Clauses on request; we have not yet executed one and are progressing this.
• Anthropic (Aria voice feature) — separately from the SMS use above, Aria's live phone conversations are processed by Anthropic's Claude model to generate the assistant's spoken replies. Data processed: the caller's spoken words (as transcribed) and conversation context. This currently runs on a standard individual-tier account rather than a dedicated commercial API agreement; we are upgrading to a commercial agreement with Article 28 terms in due course.
• Google LLC (Aria voice & calendar) — text-to-speech voice output for Aria's spoken replies is provided by Twilio's built-in voice engine under Twilio's own sub-processor terms, with no direct PipeIQ-Google relationship for this. Calendar booking of confirmed appointments (caller name, phone number and appointment details) uses a direct Google Calendar API integration, covered automatically by Google's standard API Terms of Service and Cloud Data Processing Addendum.
• Telegram — internal alert messages to our own team when a call needs human follow-up, or as a fallback if the automated line fails. Data processed: the caller's phone number and a link to the call recording. Telegram does not offer a Data Processing Agreement to any customer; used only for our own internal alerting, not for processing on the Controller's behalf.

All processors are bound by appropriate data processing agreements or equivalent terms of service, except where noted above — those entries describe the current position honestly and are kept under review.

7. Your Rights

Under UK GDPR you have the right to: access, rectify, erase, restrict, or port your personal data; object to processing; and lodge a complaint with the ICO at ico.org.uk.

To exercise any right, email kamran@tradeboostuk.co.uk. We will respond within 30 days.

8. Cookies

Our marketing site (pipeiq.co.uk) uses no third-party tracking cookies. The platform (app.pipeiq.co.uk) uses strictly necessary session cookies only.

9. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top will reflect any changes. We will notify you of material changes by email. The updated policy will apply to data processed after the effective date. If you do not accept the changes, you may close your account.

10. Contact

For any privacy-related queries: kamran@tradeboostuk.co.uk