PipeLime

GDPR overview

GDPR implementation is concrete and documented. The privacy policy, last updated 8 July 2026, sets out the Article 6 legal bases — contract performance, legitimate interest backed by a documented Legitimate Interest Assessment, consent and legal obligation — and lists the eight data-subject rights of Articles 15 to 22, exercisable at privacy@pipelime.ai with a 30-day response window. A separate Data Processing Agreement dated 18 March 2026 is published under Article 28, incorporating the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, Article 32 security measures, 72-hour breach notification and audit rights, and it names nine sub-processors with their countries. Two gaps stand out: no Article 27 EU representative and no data protection officer is named anywhere, and the terms place the burden of lawful basis, notices, consents and rights requests entirely on the customer.

Who owns the data?

Under the terms of service you keep ownership of everything you upload — CSV files, email templates, branding — and grant PipeLime only a limited licence to use, process and store it in order to run the service. The platform itself, its software, design and intellectual property remain the exclusive property of Reblox Solutions LLC, and you receive a limited, non-exclusive, non-transferable and revocable licence for internal business use during your subscription. The Data Processing Agreement splits the roles: PipeLime acts as a processor for data it handles on your behalf, such as email sending, LinkedIn outreach and website tracking, and as an independent controller for its own purposes, including account management, billing and curating its own B2B contact database.

Reuse rights

Lead Data may be used only for your own internal B2B sales and marketing. The acceptable-use policy forbids reselling, sublicensing or redistributing it to third parties, and forbids using it to build, train or improve a competing product. It also rules out purposes covered by the Fair Credit Reporting Act — credit decisions, employment screening, insurance underwriting — and the processing of sensitive categories such as health, financial, ethnic, political, religious, genetic or biometric data. Reuse therefore does not require permission within those boundaries, but stepping outside them is a breach of contract. You also remain responsible for determining your own lawful basis, issuing privacy notices, collecting consents and honouring data-subject requests: PipeLime states plainly that it does none of this on your behalf. Content you upload stays yours, and PipeLime processes it only to deliver the service.

Data retention & training

Hosting summary

PipeLime is operated by Reblox Solutions LLC, a company incorporated in the State of Florida, and the Data Processing Agreement states plainly that PipeLime is located in the United States. The privacy policy adds that data may be transferred to and processed in the United States or in other countries where its service providers operate. No cloud provider and no hosting region are ever named: the security section says only that the platform runs on secure cloud infrastructure, with encryption in transit and at rest, role-based access control and multi-factor authentication for administrative access. Transfers out of the EEA, the United Kingdom or Switzerland rely on the European Commission's Standard Contractual Clauses (Module Two), the UK International Data Transfer Addendum and the applicable Swiss mechanisms, alongside supplementary technical and organisational measures. The nine named sub-processors sit in the United States, France and Germany, with the web-data providers listed simply as Various. Note that the site's own IP address resolves to a Cloudflare anycast node, which says nothing about where customer data actually rests.