This policy explains what personal data Pipefire collects, why, and what we do with it. Pipefire is operated by M&B Marketing SARL ("we", "us", "Pipefire").
Who we are
- Controller: M&B Marketing SARL
- Legal form: Société à responsabilité limitée (SARL)
- Registered office: 34 Avenue des Champs-Élysées, 75008 Paris, France
- Registration: RCS Paris 837 729 300, SIREN 837 729 300, VAT FR71 837 729 300
- Contact for data matters: admin@mandbmarketing.com
The three kinds of people this policy covers
We process data about three groups, and we treat them differently.
- Visitors: people who browse pipefire.ai.
- Customers: the people and teams who buy Pipefire.
- Prospects: the people our customers contact through Pipefire.
Visitors
When you visit pipefire.ai we process:
- Technical data (IP address, browser, device) needed to serve the page and keep the service secure.
- Site statistics through Fathom Analytics, which uses no cookies and does not identify you.
- Where you first came from (for example Google, ChatGPT, a link on another
site, or our email course), the first page you saw, and which free tools,
sign-up and purchase steps you then completed. We keep this against a
random identifier in one first-party cookie,
pf_ft, set on your first visit. It holds no personal data, is never shared, lasts 13 months at most and is not extended by later visits. We do not store your IP address or browser details with it. If you create an account, the identifier is linked to it so we can see which pages and tools lead to customers. - If you ask for free leads or join our email course, your email address and what you asked for (for example "web designers in Austin"), so we can send it and so each address gets one free list. We email you about Pipefire from then on; every email has an unsubscribe link. Lawful basis: your request, and legitimate interest in telling you about a related service.
- If you use a free tool, a one-way hash of your IP address for an hour, to stop abuse. The domain checker, record generators and email checker store nothing you type. The deliverability test keeps its results for 24 hours and never keeps your email.
To opt out of the pf_ft cookie, turn on Global Privacy Control or Do Not
Track in your browser: we then never set it. You can also delete it at any
time.
We do not use advertising trackers and we do not sell visitor data.
Lawful basis: legitimate interest in operating, securing and improving the site and understanding which of our pages are useful.
Customers
When you sign up and use Pipefire we process:
- Account data (name, email, team, billing details) needed to run your account and take payment.
- Configuration data (your intake answers, approved domain names, campaign content) needed to build and run your infrastructure.
- Usage data needed to operate, monitor and improve the service.
Lawful basis: performance of the contract, and legitimate interest in operating, securing and improving the service. Payment data is processed by Stripe; we do not store card numbers.
Prospects (people our customers contact)
When our customers send cold email through Pipefire, we process prospect data on their behalf: name, professional email address, job role, employer, and website. We are the processor of this data; our customer is the controller and decides what is collected and why.
Our role is limited to what the contract requires: sourcing, verifying, sending, and classifying replies. We do not use prospect data for our own marketing, and we do not sell it.
Lawful basis: our customers rely on legitimate interest (GDPR Article 6(1)(f)) for B2B outreach, which French law permits under Article L34-5 of the Postal and Electronic Communications Code when the message is relevant to the recipient's professional role, the sender is identified, and a working opt-out is provided. Our own processing is governed by the data processing agreement below and by our customers' instructions.
Contact-form outreach
For prospects who publish a contact form but no email address, the service can submit one message through that form instead. This is a distinct channel and is treated more cautiously than email:
- It is off by default and enabled only for a specific customer after they accept the additional terms in the Terms of Service.
- It is used for B2B contacts only, never consumers.
- The message identifies the sender and carries a real reply address, so the recipient can always answer.
- It is one message per business, ever, across all Pipefire customers.
- Suppression still applies: someone who opted out of email is not contacted through a form.
A contact form has no unsubscribe button and no bounce path, so these restraints are the control that replaces them.
Data retention
- Customer account data: kept while the account is active, then deleted on closure unless we must keep it to meet a legal obligation.
- Prospect data: kept for as long as the customer's contract requires, and deleted or returned when the contract ends or the customer asks.
- Logs and security data: kept for up to 12 months.
Data subjects' rights
Under the GDPR you have the right to access, correct, delete, restrict, and port your personal data, and to object to processing. To exercise any of these, email admin@mandbmarketing.com.
If you are a prospect contacted through Pipefire and you object, the fastest path is the unsubscribe link in the message. We enforce opt-outs before send rather than after.
You also have the right to complain to a supervisory authority. In France that is the CNIL (www.cnil.fr).
Security
We encrypt credentials at rest, scope access by tenant, and enforce opt-outs in the send path. Details are in our security documentation.
Changes
We may update this policy. Material changes will be posted on this page with a new date.
Contact
admin@mandbmarketing.com M&B Marketing SARL, 34 Avenue des Champs-Élysées, 75008 Paris, France