PipelineHQ

Privacy Policy

Effective date: October 21, 2026 · Version 1.0

Who we are

This policy covers the PipelineHQ website and CRM service (the "Service"), operated by the PipelineHQ team. Questions about privacy can go to admin@pipelinehqcrm.com or through the request form at the bottom of this page.

Information we collect

• Account information. When you register or are invited to PipelineHQ we collect your name, email address, and password (stored only as a secure credential by our authentication provider).
• CRM data. Agencies using PipelineHQ store records about their own customers: names, contact details, addresses, policy and quote information, and documents they upload.
• Quote request information. If you submit a quote request through a public intake form, we collect your name, date of birth, email address, phone number, home address, driver's license number and issuing state, and details about vehicles and drivers you ask us to quote.
• Payment information. Purchases are processed by Base44 Payments (powered by Wix) on its checkout page. We receive your email address, plan, and subscription status; we do not receive or store your full card details.
• Communications. Records of emails, text messages, and notes related to a prospect or account, including automated follow-up messages sent at the agency's direction.
• Technical data. IP addresses are used to rate-limit public forms (spam and abuse prevention). If you allow Analytics, the Service's hosting platform (Base44) collects first-party usage analytics such as page views and in-product events.
• Privacy choices. If you make a cookie/tracking choice or submit a privacy request, we store the choice or request you submit (see "Privacy choices and requests" below).

How long we keep information

• Account information. Deleted within 72 hours of cancelling subscription
• Agency CRM data. Deleted upon cancelling subscription
• Quote request details. Deleted 12 months after quote is closed
• Communication records. Kept as long as there is an active subscription
• Privacy consent records. Kept 24 months as proof of consent
• Privacy request records. Kept 24 months after request is made
• Rate-limit IP records. 24 hours
• Backups. Rolling 30 day backup window

Sources of information

We receive information directly from you (forms, account registration, checkout), automatically from your use of the Service (technical data and, with consent, analytics), and from the payment processor (order and subscription confirmations).

How we use information

• To provide the Service: accounts, the CRM, public intake forms, and payments.
• To communicate with you: transactional and support email, and automated follow-ups your agency configures for its own prospects.
• To keep the Service secure and prevent abuse (for example, rate limiting public forms).
• To measure and improve the Service, only when you allow Analytics.
• To process privacy requests and honor privacy choices.

How we share information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We share information only with the providers that help us run the Service:

• Base44 — hosting, authentication, databases, and built-in first-party analytics for the Service.
• Base44 Payments (powered by Wix) — payment processing on its own checkout page.
• Google — sign-in with Google (if you choose it), and, when an agency connects its own account, Gmail for sending agency follow-up emails.
• Quo or Twilio — when an agency connects its own account, text messages sent at the agency's direction.

If you are a customer of an insurance agency that uses PipelineHQ, that agency controls the personal information about you that it stores in the CRM. This policy covers the PipelineHQ Service; the agency's own privacy practices are the agency's responsibility.

Sensitive personal information

Quote request forms may collect driver's license numbers and dates of birth, which are sensitive personal information under California law. We use them only to provide the quote service they were submitted for, and we do not use them to infer characteristics about you.

Cookies and tracking technologies

The Service uses browser storage (local storage and session storage) that is strictly necessary: keeping you signed in, securing your session, and remembering your privacy choices. The only optional technology is the built-in first-party analytics described above, which runs only if you allow it. PipelineHQ does not use advertising cookies, pixels, or cross-site trackers. Your choices can be reviewed anytime via Your Privacy Choices.

Global Privacy Control (GPC)

If your browser sends a Global Privacy Control signal, we treat it as a valid request to opt out of the sale or sharing of personal information. Because we do not sell or share personal information for cross-context behavioral advertising, there is no sale or sharing to opt out of; we still honor the signal by keeping optional analytics off until you explicitly enable it in your privacy preferences, and we record that the signal was received. You do not need an account for this. We do not respond to the legacy "Do Not Track" header.

Your California privacy rights

If you are a California resident, you have the right to know about and access the personal information we maintain about you, to request deletion, to request correction of inaccurate information, to opt out of the sale or sharing of personal information (we do not sell or share), to limit the use and disclosure of sensitive personal information, and to exercise these rights without unlawful discrimination.

To exercise a right, use the request form below or email admin@pipelinehqcrm.com. We may need to verify your identity (for example, by replying to the email address you provide or the email on your account) before acting on a request, and we will respond within the time required by law.

Privacy choices and requests

Choices you make in the privacy banner or preferences panel are stored in your browser and as an anonymous preference record (your choice, the categories you selected, the time, the policy version, and whether a GPC signal was present) — with no name, email, or device fingerprint.

Changes to this policy

We may update this policy as our practices change. Material changes will be reflected by a new effective date and version above.