Legal
Privacy notice
Last updated October 18, 2026.
This notice explains how RK Ventures, part of the Timeless Group of companies (“Pipevoy”, “we”, “us”), established in the United Arab Emirates, processes personal data when you visit our website, request a demo, use the Pipevoy service, or are contacted by one of our customers through it.
1. Our role
- Website visitors and demo requests: we are the controller.
- Customer users (people with a Pipevoy login): we are the controller for account and billing data.
- Prospects and contacts that customers research and contact through Pipevoy: the customer is the controller and we process the data on the customer’s behalf and instructions, as set out in our terms of service. Requests from prospects are passed to the relevant customer, and we help them respond.
2. Data we process
Website and demo requests
Name, work email, phone (optional), company, company size, country, your message, and any ROI calculator inputs you choose to send. Basic request logs (IP address, user agent, timestamps) for security.
Customer accounts
Name, email, workspace membership and role, the company profile you enter, settings, billing details (card details are collected and held by Stripe, not by us), and audit logs of actions in the product.
LinkedIn data
When a customer connects a LinkedIn account, Pipevoy processes, on the customer’s instructions:
- For the connected account: invitations, conversations and messages needed to send outreach and detect replies, and limits and status information.
- For prospects: information visible to the connected account, such as name, headline, current and past roles, company, location, profile URL and recent public posts.
LinkedIn passwords are entered in a hosted sign-in run by our LinkedIn connection provider (Unipile) and are never received or stored by Pipevoy. Customers are responsible for their own LinkedIn accounts and for their use of LinkedIn complying with LinkedIn’s terms and applicable law.
Company and signal data
Public company web pages (careers, news, product pages) monitored at a customer’s request, and signals customers send us through webhooks, CSV files or integrations. Signals are stored with the evidence they were based on.
3. AI processing
Pipevoy uses large language models provided by Anthropic (Claude) through Anthropic’s commercial API to draft messages, classify replies, extract signals and score accounts. Only the data needed for the specific task is sent, for example a prospect’s profile summary, the customer’s company description and the relevant conversation. Under Anthropic’s commercial terms, API inputs and outputs are not used to train its models and are retained only for the limited period its terms allow. AI output is a draft: by default the customer reviews and approves it before anything is sent. No decision with legal or similarly significant effect is made solely by automated means.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to demo requests and enquiries | Legitimate interests; steps prior to a contract |
| Providing the service to customers, including billing | Performance of contract |
| Processing prospect data on customers’ behalf | Customer’s instructions; the customer determines its own legal basis (typically legitimate interests) |
| Security, fraud prevention, abuse detection | Legitimate interests; legal obligation |
| Anonymised, aggregated benchmarks (published only when at least three workspaces contribute) | Legitimate interests; no individual or workspace is identifiable |
5. Subprocessors
We use the following providers to run Pipevoy. Cal.com and HubSpot receive data only when a customer connects them.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel | Application hosting and delivery | Request data and logs; data in transit | Global edge network |
| Supabase | Database and authentication | All workspace data and account data | The region selected for our database provider (EU by default) |
| Anthropic | AI processing: drafting, reply classification and signal extraction | Prospect profile and company context, and the message history needed for the task | United States |
| Unipile | LinkedIn connection for the accounts customers connect | LinkedIn messages, invitations, profile and post data handled for connected accounts | France (European Union) |
| Stripe | Payments and invoicing | Billing contact, payment method (held by Stripe), invoices and subscription status | United States and other Stripe locations |
| Resend | Transactional email (sign-in links, notifications, invoices) | Recipient name and email address, email content | United States |
| Cal.com (only when a customer connects it) | Meeting booking | Booking details: name, email, meeting time | Per the customer’s Cal.com account |
| HubSpot (only when a customer connects it) | CRM sync configured by the customer | Contact, company, meeting and note data | Per the customer’s HubSpot account |
| Slack | Internal notifications to our team (for example, new sign-ups and demo requests) | Names only; no customer workspace or prospect data | United States |
We will update this list before a new subprocessor starts processing customer data and notify customers of material changes by email.
6. Cookies
We use essential cookies only: one to keep you signed in (the authentication session) and one to remember which workspace you selected. We do not use analytics or advertising cookies, and we do not track you across other websites.
7. Where data is stored
Workspace and account data is stored in the region selected for our database provider (EU by default). Some subprocessors listed above process data in other countries, including the United States. Where the law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses and the transfer mechanisms recognised under the UAE Personal Data Protection Law.
8. Retention
- Account and workspace data, including prospect and LinkedIn data: kept while the account is active and for 90 days after cancellation, then deleted.
- Backups are kept for up to 7 days.
- Demo requests that do not lead to an account: deleted within 24 months of the last contact.
- Opt-out records: kept as long as needed to honour the opt-out.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or port your data, to object to processing (including for direct marketing, at any time), and to withdraw consent. You can also complain to your data protection authority. If you were contacted through Pipevoy by one of our customers, you can reply “stop” or similar to the message, or contact us and we will pass your request to that customer and stop processing on their behalf where the law requires.
To exercise your rights, email hello@pipevoy.com. We respond within 30 days.
10. Security
Data is encrypted in transit and at rest by our hosting and database providers. Workspaces are isolated from each other, staff access follows least privilege, outbound webhooks are signed, and actions in the product are recorded in an audit log.
11. Changes and contact
We will post changes here and update the date at the top; for material changes we notify customers by email in advance. Questions about this notice or your data: RK Ventures, part of the Timeless Group of companies, hello@pipevoy.com.