Privacy notice

Who we are

PipelineMap is operated by Seeded Health Ltd (“we”, “us”). We are the controller of the personal data described in this notice. Contact us at hello@pipelinemap.co.uk.

What we collect and why

• Opportunity Scanner. The domain you enter and the report we generate from that website's public pages. We use this to show you the report and to understand which kinds of sites use the scanner. Lawful basis: legitimate interests.
• Follow-up requests and pilot applications. Your email address, name, role, company size, website and any message you send. We use this to reply to you and assess whether PipelineMap is a fit. Lawful basis: legitimate interests, or steps prior to entering a contract.
• Marketing emails. Only if you tick the consent box and then confirm using the link we email you. Up to three emails about your report, commercial search and PipelineMap. Lawful basis: consent, which you can withdraw at any time using the unsubscribe link.
• Accounts. Your name, email address, company name and a securely hashed password (we never store your password itself). Lawful basis: contract.
• Search Console data. If you connect Google Search Console or upload an export, we store search performance data (queries, pages, clicks, impressions, positions) for the properties you choose, plus an encrypted access token. We use it only to provide PipelineMap to you. Lawful basis: contract.
• Payments. Payments are processed by Stripe. We receive confirmation of payment and the amount, but never your card details.
• Usage analytics. We record page views and key product events (such as a scan being completed) using a daily-rotating, one-way identifier derived from your IP address and browser. We don't set analytics cookies, don't store your IP address and can't link visits across days. Lawful basis: legitimate interests.

Cookies

We use one strictly necessary cookie to keep you signed in, and a short-lived cookie to protect the Google connection process. We don't use advertising or analytics cookies.

Google user data

PipelineMap requests read-only access to Google Search Console (webmasters.readonly) and your Google account email address. We use this data solely to analyse search performance for sites you add to PipelineMap. We don't sell it, use it for advertising, or transfer it to others except the infrastructure providers needed to run the service. Humans at PipelineMap only view it when you ask for support or it is necessary for security or legal reasons. You can disconnect at any time from the Data sources page, or revoke access in your Google account settings.

Sharing

We use service providers for hosting, database storage, email delivery and payment processing. They process data on our instructions. We don't sell personal data.

Retention

• Scanner reports: up to 12 months.
• Follow-up requests and pilot applications from people who don't become customers: up to 24 months after you submit them, unless you ask us to delete them sooner. Customers' records are kept while they are customers.
• Copies of emails we send: up to 6 months; unsent queued emails are removed after 3 months.
• Usage analytics events (pseudonymous, no IP addresses): up to 24 months.
• Account and Search Console data: for as long as your account is active. Deleting your account (Account settings) removes it immediately; backups held by our infrastructure providers expire on their own schedules.
• Unsubscribe records: kept so we can continue to honour your choice.

Security

Passwords are hashed with scrypt, session tokens and reset tokens are stored only as hashes, and Search Console tokens are encrypted at rest with AES-256-GCM. Access to production data is restricted.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict processing, and withdraw consent. Email hello@pipelinemap.co.uk. If you're in the UK you can also complain to the Information Commissioner's Office (ico.org.uk).