Privacy Policy

Last updated: 26 September 2026  |  ICO Registration: ZC164080

1. Who We Are

PipeIQ is a trading name of TradeBoost AI Ltd, a company registered in England and Wales (Company No. 17227850). This is the single Privacy Policy for every business and website run by TradeBoost AI Ltd: TradeBoost (tradeboostuk.co.uk), PipeIQ (pipeiq.co.uk), Aria (AI phone receptionist), AnnualService (gas engineer re-booking reminders) and the free Missed-Call Check. All of them are processed on the same terms described below, and this includes emails we send from any tradeboostuk.co.uk or pipeiq.co.uk address. We are registered with the Information Commissioner's Office (ICO) under registration number ZC164080.

Data controller: TradeBoost AI Ltd (Company No. 17227850). Registered office details are publicly available at Companies House. Contact: kam@pipeiq.co.uk

2. What Data We Collect

We collect and process the following categories of personal data:

• Account data: name, email address, and business name provided during signup.
• Contact lists: phone numbers and names uploaded by agencies, gas engineers, or trades businesses for SMS campaigns or re-booking reminders.
• Call data (Aria only): caller phone number, transcribed conversation content, and appointment details for calls handled by the Aria phone receptionist.
• Missed-call check: if you ask for our free missed-call check, the mobile number you give us, your business name if you supply one, your IP address, the consent wording you agreed to, and the outcome of the single test call we place to that number.
• Usage data: campaign activity, message logs, reply records, and login timestamps.
• Billing data: payment information processed via our payment provider (we do not store card details).

3. Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR:

• Contract performance — to provide the relevant service to you (PipeIQ, Aria, AnnualService or a TradeBoost service).
• Legitimate interests — to operate, improve, and secure our platform.
• Legal obligation — to comply with applicable UK law and ICO requirements.

The free missed-call check runs on your consent: we place one test call to the number you give us and text you the result, and we ask separately before sending you anything else about Aria. You can withdraw that consent at any time by replying STOP to the text. We verify the number with a one-time code first, so a check can only be run on a number you can answer.

For SMS campaigns sent to end consumers, agencies are responsible for ensuring they hold valid PECR consent from their own contacts.

4. How We Use Your Data

• To provide and maintain the PipeIQ platform.
• To send transactional emails (account notices, receipts).
• To detect and prevent fraud or misuse.
• To comply with legal obligations.

We do not sell personal data to third parties. We do not use the contact data agencies upload, or the details you type into our forms, for our own advertising. If you accept analytics and advertising cookies on our websites, Google and Meta receive browsing data about your visit (see section 8).

Business contacts we reach out to

We (under any of the names above) sometimes email businesses about our services, using addresses they publish on their own website or in public. We record: business name, the email address, the page we found it on, public Companies House details, and whether you replied or asked us to stop.

Why we can do this: our legitimate interest in telling relevant businesses about a service that may help them or their clients.

How long we keep it: up to 12 months after our last contact with you. If you tell us to stop, we keep your address on a do-not-contact list so we never email you again.

To object or ask what we hold: reply “no thanks” to any email, or write to kam@pipeiq.co.uk.

5. Data Retention

Missed-call check records are retained for 12 months, so that we can honour STOP requests and show why a number was contacted.

Contact data uploaded by agencies is retained for 12 months from the date of upload, then automatically purged. Agency account data is retained for the duration of the contract plus 12 months. Opt-out (STOP) records are retained indefinitely to honour opt-out requests. Audit logs are retained for 24 months.

6. Data Sharing

We share data only with:

• Twilio Inc. — SMS delivery infrastructure (US, SCCs in place).
• aql — trading name of (AQ) Networks Limited (Co. No. 04250076) — alternative UK SMS network route, including virtual mobile and geographic reply numbers. Data processed: recipient phone number and message content (UK-based, Leeds; no international transfer).
• 3G Telecommunications Limited (hlrlookup.com) — mobile number reachability screening before dispatch, so undeliverable numbers are removed from a list. Only the phone number is transmitted — no names or other personal data (UK-based; no international transfer).
• I Want That Ltd (TPS Services) — TPS/CTPS register screening. Phone numbers are checked against the Telephone Preference Service before every campaign dispatch. Only the phone number is transmitted — no names, emails or other personal data. Signed Data Sharing Agreement in place (UK, London).
• Stripe Inc. — payment processing for subscription billing. No contact data is sent to Stripe (US, SCCs in place).
• Namecheap, Inc. (Private Email) — business email hosting. This is the service our business and outreach email is actually sent and received through, including the address you can reply to in order to object or opt out. Data processed: your email address and the content of messages to and from you (US — Phoenix, Arizona). Namecheap does not publish a customer-facing Article 28 data processing agreement; we have not executed one with them and are progressing this.
• Supabase Inc. — database hosting (EU region, contractually locked).
• Vercel Inc. — web hosting (US, SCCs in place).
• Google Cloud (GCP) — compute hosting for campaign dispatch, opt-out enforcement and voice AI (US, SCCs in place).
• GitHub, Inc. (Microsoft) — off-site disaster-recovery backup. A nightly copy of the database is held in a private repository for restore purposes only; it is not processed or disclosed onward (US, SCCs in place).
• Anthropic Inc. — AI language model (Claude) used for SMS message variant generation. Data processed: campaign name, client type, message tone parameters. No personal data of contacts is sent to Anthropic (US, SCCs in place).
• Deepgram, Inc. — speech-to-text transcription for the Aria voice-call assistant feature. Data processed: the caller's spoken words, transcribed in real time during the call (US). Deepgram offers a Data Processing Agreement with Standard Contractual Clauses on request; we have not yet executed one and are progressing this.
• Anthropic (Aria voice feature) — separately from the SMS use above, Aria's live phone conversations are processed by Anthropic's Claude model to generate the assistant's spoken replies. Data processed: the caller's spoken words (as transcribed) and conversation context. This currently runs on a standard individual-tier account rather than a dedicated commercial API agreement; we are upgrading to a commercial agreement with Article 28 terms in due course.
• Google LLC (Aria voice & calendar) — text-to-speech voice output for Aria's spoken replies is provided by Twilio's built-in voice engine under Twilio's own sub-processor terms, with no direct PipeIQ-Google relationship for this. Calendar booking of confirmed appointments (caller name, phone number and appointment details) uses a direct Google Calendar API integration, covered automatically by Google's standard API Terms of Service and Cloud Data Processing Addendum.
• Telegram — internal alert messages to our own team when a call needs human follow-up, or as a fallback if the automated line fails. Data processed: the caller's phone number and a link to the call recording. Telegram does not offer a Data Processing Agreement to any customer; used only for our own internal alerting, not for processing on the Controller's behalf.

All processors are bound by appropriate data processing agreements or equivalent terms of service, except where noted above — those entries describe the current position honestly and are kept under review.

7. Your Rights

Under UK GDPR you have the right to: access, rectify, erase, restrict, or port your personal data; object to processing; and lodge a complaint with the ICO at ico.org.uk.

To exercise any right, email kamran@tradeboostuk.co.uk. We will respond within 30 days.

8. Cookies

Our websites (pipeiq.co.uk and tradeboostuk.co.uk) use Google Analytics, Google Ads and the Meta Pixel only if you accept them in the cookie banner; they stay off otherwise, and you can change your choice at any time via "Cookie settings" at the foot of each page. The platform (app.pipeiq.co.uk) uses strictly necessary session cookies only. Full details, including each cookie and how long it lasts, are in our cookie policy.

9. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top will reflect any changes. We will notify you of material changes by email. The updated policy will apply to data processed after the effective date. If you do not accept the changes, you may close your account.

10. Contact

For any privacy-related queries: kamran@tradeboostuk.co.uk