Pipeline Lite Privacy Policy

1. Scope and company

This Privacy Policy explains how PIPELINE LITE LLC, a Florida limited liability company, collects, uses, discloses, retains, and protects personal information in connection with the Pipeline Lite website, OneAuth identity flow, done-for-you B2B prospecting service, customer campaigns, Sandy Beach interactions, support, billing, and related systems. “Pipeline Lite,” “we,” “us,” and “our” refer to PIPELINE LITE LLC.

Company record: Florida document number L23000343419. Principal and mailing address: 4950 Gulf Blvd, Apt 403, St. Petersburg Beach, Florida 33706.

This Policy covers direct users, buyers, administrators, support contacts, customer-supplied contacts, and business prospects. A customer’s own privacy notice may also apply when Pipeline Lite acts for that customer.

2. Our two privacy roles

Controller or business role

We determine why and how information is handled for website visitors, OneAuth users, buyers, account contacts, billing, fraud prevention, security, product analytics, legal compliance, our own marketing, Sandy Beach sessions, preferences, support, and human-follow-up requests. This role also covers Pipeline Lite-sourced, selected, enriched, assigned, licensed, or disclosed business-contact data when we determine those purposes or means.

Processor or service-provider role

We process customer-supplied business-contact and prospect data on a customer’s documented instructions when operating that customer’s campaign, connected calendar, inbox, reply workflow, qualification, and related CRM activity. Our customer agreements and applicable data-processing terms govern documented instructions, use limits, confidentiality, security, subprocessors, rights assistance, deletion or return, incident assistance, audit information, and transfers.

3. Categories of information

• Identifiers and contact details: names, email addresses, telephone numbers, postal or mailing addresses, IP address, user agent, customer/contact IDs, and session IDs.
• OneAuth identity and consent receipts: identity fields, phone verification status, OTP/session evidence, source URL, device information, consent text and status, and channel choices.
• Business and professional information: company, industry, market, segment, role, website, public professional details, sending identity, and business preferences.
• Prospect and contact information: Pipeline Lite-sourced and Customer-supplied business-contact and prospect data, including name, business email, phone, source and provenance, validation data, research snapshots, campaign assignment, and suppression status.
• Campaign and relationship information: Campaign, message, reply, calendar, and appointment data; seven-send content and status; delivery, bounce, complaint, opt-out, qualification, and booking events.
• AI, avatar, voice, and support information: prompts, messages, text transcripts, conversation history, summaries, requested human follow-up, call or session identifiers, duration, direction, and quality information.
• Billing and transaction metadata: subscription, checkout, price, status, invoice, usage, and payment-event metadata. Stripe handles payment-card processing; Pipeline Lite does not ordinarily store full payment-card numbers.
• Device, network, cookie, security, and usage information: browser storage, pages or features used, security and authentication events, server-side funnel events, provider event IDs, and logs.
• Inferences and classifications: campaign, intent, qualification, delivery, or other service classifications actually produced. Text or behavior is not treated as proof of a person’s emotion or hidden mental state.
• Support, rights-request, and legal records: correspondence, identity-verification material, requests, appeals, complaints, audit evidence, disputes, legal holds, and compliance records.

4. Sources of information

Depending on the relationship and feature, information may come from:

• you, a buyer, administrator, teammate, support contact, prospect, or other person;
• a Pipeline Lite customer, including customer-uploaded or connected CRM data;
• OneAuth and connected customer systems such as calendars, inboxes, CRM accounts, and communications systems;
• public sources and licensed data providers, business websites, professional pages, prospect-research services, segment providers, and contact-validation providers;
• payment, communications, meeting, AI, hosting, database, storage, and infrastructure providers; and
• automatically collected browser, device, network, security, server, delivery, and usage events.

We use public, licensed, customer-supplied, connected-system, research, and validation data subject to applicable law, contracts, customer instructions, and source licenses.

5. Why information is used

Subject to our role, applicable law, and contracts, purposes may include:

• provide and operate the service, including onboarding, customer-selected outreach, reply handling, qualification, and booking;
• identity verification, fraud prevention, security, support, billing, compliance, analytics, and improvement;
• connect accounts, calendars, inboxes, CRM records, and communications;
• source, validate, research, assign, and manage business contacts under an applicable lawful basis;
• compose and deliver messages, process replies, maintain continuity, honor choices, and arrange human follow-up when requested and available;
• administer subscriptions, transactions, disputes, taxes, records, and customer service;
• detect abuse, protect systems and people, enforce terms, investigate incidents, and comply with law; and
• evaluate and improve service quality. Any new model-training or cross-customer-learning use requires a separately disclosed purpose and approval.

6. AI and automated systems

Sandy Beach is an AI assistant. Sandy may help compose outreach, respond to questions, qualify interest, maintain conversation context, support live-avatar or voice interactions, and propose next steps. A person may request human follow-up where available. Sandy may be inaccurate and is not legal, medical, financial, insurance, or other licensed professional advice.

Pipeline Lite uses third-party AI, model-gateway, research, hosting, storage, communications, live-avatar, speech, memory, and related service providers. Depending on the feature and configuration, those providers and their subprocessors may receive prompts, conversation history, messages, research, tool output, images, audio, video, transcripts, session information, and other data needed to provide the feature. Their processing locations, retention, and use are governed by their terms, our contracts and settings, and applicable law. Pipeline Lite does not promise that an AI provider never trains on or otherwise uses submitted data.

Pipeline Lite will not create voiceprints, face templates, or emotion profiles. Pipeline Lite will not intentionally collect or infer prospect health data. Free-text and customer-supplied content can still contain sensitive information and remains subject to minimization and applicable law. Sandy Beach never makes final decisions about insurance eligibility, credit, employment, housing, or other legally significant outcomes. A human remains responsible for those decisions.

7. SMS, calls, email, live avatar, and text transcripts

Different communications have different choices

Authentication and account messages are different from optional marketing. Where required, optional marketing SMS, automated or artificial-voice calls, prerecorded calls, and optional Sandy Beach channels require a separate voluntary choice. Marketing consent is not a condition of purchase or access to core service where law requires a voluntary choice.

When PIPELINE LITE LLC is the sender, we identify the company and communication purpose. Message frequency varies. Message and data rates may apply. Reply STOP to a supported marketing SMS to opt out immediately. Reply HELP for support. Email unsubscribe requests are applied immediately across Pipeline Lite-controlled campaign systems and routed to connected customer systems as appropriate. Marketing texts and calls are limited to 9:00 a.m. through 8:00 p.m. in the recipient’s local time, or a narrower period where law requires. We also honor other legally recognized reasonable revocation methods.

Phone or mobile data and SMS consent collected through a Pipeline Lite opt-in are not shared with third parties or affiliates for their own marketing or promotional purposes. Operational providers may process mobile information to deliver a requested service. This does not change separately disclosed processing of sourced or licensed business-contact data.

Email

Pipeline Lite campaigns use email as a base outreach channel. Delivery, bounce, complaint, reply, unsubscribe, open, and click events may be handled. Some campaign configurations use email open and click tracking. When tracking is enabled, Pipeline Lite provides notice, consent, and opt-out controls where legally required. Commercial email includes accurate sender information, a valid postal address, and a working unsubscribe method as required by law.

Calls, voice, avatar, and media

Calls and live-avatar sessions may use artificial or synthesized voice, an AI-generated persona, and third-party providers and subprocessors that transport and process audio, video, text, session identifiers, transcripts, logs, and related session data in real time. Providers may create or retain session artifacts under their own configurations and terms, including recordings, transcripts, logs, or related session information.

Pipeline Lite and its providers may retain text transcripts for service delivery, conversation continuity, quality review, support, security, compliance, disputes, legal obligations, or valid customer instructions. Retention varies by system and provider. Pipeline Lite addresses retention and approved deletion requests manually through existing people, inboxes, systems, and records where the applicable system permits.

Pipeline Lite will not create voiceprints, face templates, or emotion profiles; will not perform emotion inference; and will not intentionally infer prospect health data. Provider model training remains subject to Section 6.

8. How information may be disclosed

Information may be disclosed, with role-appropriate limits, to:

• payment processors for checkout, subscriptions, payments, disputes, and transaction administration;
• communications and infrastructure providers for email, SMS, phone, CRM, hosting, database, storage, security, analytics, live avatar, video, meetings, and service operation;
• AI, model-gateway, speech, memory, research, and enrichment providers for composition, analysis, live interaction, enrichment, and support functions;
• customers and connected customer systems for the customer’s campaign, CRM, calendar, qualification, reporting, and follow-up;
• professional advisers, authorities, and transaction successors when reasonably necessary for advice, rights protection, legal process, a business transaction, or compliance; and
• other recipients at a person’s direction or with legally sufficient consent.

Providers and subprocessors may include Vercel, Railway, Supabase, Twilio, Stripe, Firecrawl, OpenRouter, OpenAI, Anthropic, HeyGen or LiveAvatar, speech-recognition and text-to-speech providers, AudienceLab, and content-delivery providers, depending on the feature and current configuration. Providers and their subprocessors may process, route, support, or store information outside the United States under their terms, our contracts and settings, and applicable law. Where required, a person may request information about specific third parties through the privacy contacts in Section 18.

9. Sale, sharing, targeted advertising, and business-contact distribution

Pipeline Lite provides sourced or licensed business-contact data to paying customers for their own campaigns. Customers may not resell or redistribute Pipeline Lite contact data to third parties.

Under some privacy laws, licensing, assigning, or disclosing sourced business-contact data, or using targeted advertising across other companies’ sites or apps, may be treated as a sale or sharing of personal information even when no money changes hands. Pipeline Lite does not sell or share phone/mobile opt-in data or SMS consent for third-party marketing. You may use the choices in Section 13, including Global Privacy Control or Do Not Track where applicable.

Pipeline Lite offers basic access, correction, deletion, and opt-out choices nationwide, subject to legal exceptions and our role for a customer. Requests are handled manually through existing people, inboxes, systems, and records.

10. Cookies, browser storage, analytics, GPC, and Do Not Track

The Service may use browser storage, server logs, external assets or widgets, funnel events, and email telemetry. Some campaign configurations use email open and click tracking. If cookies, pixels, SDKs, or similar tools are used for targeted advertising, Pipeline Lite provides notice, consent, and opt-out controls as required by applicable law.

We recognize legally applicable Global Privacy Control (GPC) signals and treat Do Not Track (DNT) signals the same way. Because a browser signal may not reach every connected customer or provider system, you may also email either privacy contact in Section 18 so we can process the request manually.

11. Retention and deletion

We use purpose-limited retention criteria. Retention may be longer when required for a legal hold, legal obligation, dispute, security investigation, valid customer instruction, or minimal suppression record. Providers and customer systems may use different schedules.

Approved deletion requests are handled manually. Pipeline Lite’s policy is to clear active copies it controls within 45 days. Protected backups expire on their normal rotation. Provider and customer-system copies may remain under their schedules or instructions, and legally required records and minimal suppression entries may remain for their limited purposes.

12. Security

Pipeline Lite uses reasonable administrative, technical, and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, and Pipeline Lite cannot guarantee that a security incident will never occur.

13. Privacy rights and choices

Rights depend on where you live, which law applies, whether an exemption applies, and whether Pipeline Lite meets that law’s threshold. Depending on those facts, you may have a right to access or confirm processing, correct inaccurate information, delete information, receive a portable copy, obtain information about certain third parties, or opt out of sale, sharing, targeted advertising, or qualifying profiling. Sensitive-data rights and consent requirements also vary.

To make a request, email keith@ajffinancialgroup.com or sandy@pipelinelite.com. We use minimum-necessary identity verification. Authorized representatives are accepted with proof of authority and identity. If we deny a request, our response includes appeal instructions where an appeal is available. We do not unlawfully discriminate against a person for exercising a privacy right. We offer no financial incentive, reward, discount, payment, or different service level in exchange for personal data.

We generally respond to verified requests within 45 days and use only legally permitted extensions. Rights remain subject to applicable law, exemptions, and whether we act for a customer. When we act for a customer, we follow the customer’s instructions and route the request to that customer when appropriate. A human reviews every final privacy response or data change.

Privacy rights-request routing appendix

Requests are fulfilled manually through existing people, inboxes, systems, and records. Intake identifies the request type and Pipeline Lite’s role using minimum-necessary identity verification. The manual process applies relevant scope, exemptions, timing, appeal, and denial rules and addresses applicable providers and customer systems.

Pipeline Lite does not claim an automated deletion, privacy, or case-management system; lack of automation does not limit rights available under applicable law. We keep appropriate records of verification, routing, decisions, completion, appeals, and legally required notices.

14. California notice at collection

For California residents, and only when California law applies, Sections 3 through 5 describe the categories of personal information, sources, and business or commercial purposes for which information may be collected or used. Relevant categories may include identifiers; customer-record information; commercial and transaction information; internet or electronic-network activity; professional or employment-related information; electronic interaction and text-transcript information; sensitive personal information when actually provided; and service-related inferences.

Sections 8 and 9 describe recipient categories and transfers that may constitute sale or sharing under applicable law. Pipeline Lite provides legally required notices and opt-out methods and honors applicable GPC requests. Retention criteria are in Section 11. California residents may have the rights in Section 13, including authorized-agent and nondiscrimination protections, subject to scope and exemptions. This summary does not replace any just-in-time notice required for a particular collection or sensitive-data use.

15. Nationwide U.S. state privacy supplement

Baseline date: September 1, 2026.

As of September 2, 2026, this summary identifies 20 effective comprehensive state privacy laws. Each law has thresholds, exemptions, and scope rules involving entity type, revenue, number of people or households, business-to-business or employment data, nonprofits, financial or health regulation, and other facts. The listing below does not declare that Pipeline Lite is covered by every law or that every listed right applies.

Enacted future-effective laws

These enacted laws have future effective dates and do not grant currently effective rights before those dates:

• Oklahoma — effective January 1, 2027
• Louisiana — effective January 1, 2027
• Alabama — effective May 1, 2027
• Vermont — effective January 1, 2028

Processor obligations may also apply through customer contracts. We apply legally required purpose limitation, minimization, retention, request and appeal handling, GPC treatment, sensitive-data consent, processor terms, assessments, and accessible notices when applicable.

16. Below-threshold and subject-specific overlays

Privacy, consumer-health, biometric, AI/chatbot, voice/likeness, telemarketing, email, recording, insurance, financial-services, and other sector-specific laws may apply even when a comprehensive state privacy law does not.

A transcript can become sensitive or consumer-health data when a person includes health, financial, precise-location, credential, minor, or other protected information. The Service is for adults and business users age 18 or older and is not directed to children. Minor issues are handled manually as required by law; Pipeline Lite does not claim an automated age-verification system. Do not provide sensitive information that is not needed for an interaction.

17. International access and transfers

Pipeline Lite is based in the United States. Information submitted from outside the United States may be transferred to and processed in the United States and other countries where Pipeline Lite, its service providers, or their subprocessors operate. Privacy protections may differ among jurisdictions.

Where applicable law requires a transfer mechanism, notice, consent, or other safeguard, Pipeline Lite and the applicable customer will use the required protection or will not accept the affected personal information.

18. Changes, version history, and contact

This Policy is effective September 2, 2026 and is version pipeline-lite-privacy-2026-09-02. We may update it as the Service or law changes. We will provide notice of material changes and obtain renewed consent where required.

PIPELINE LITE LLC
4950 Gulf Blvd, Apt 403
St. Petersburg Beach, Florida 33706
Primary privacy contact: keith@ajffinancialgroup.com
Customer support and backup privacy contact: sandy@pipelinelite.com