Privacy policy

This policy explains how Softpiper Solutions LLP (“Softpiper”, “we”, “us”), a limited liability partnership registered in India (LLPIN ACD-7384), handles personal data when you use softpipersolutions.com, talk to Pip, contact us or receive email from us.

We are the controller (under the GDPR and UK GDPR) and the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) for the personal data described here. Our registered office is 139 New Mohan Puri, Victoria Park, Meerut 250001, Uttar Pradesh, India.

For any privacy question, request or complaint, email info@softpipersolutions.com with “Privacy” in the subject line, or write to the address above. A designated partner of the LLP handles every request.

We collect only what we need for the things you choose to do on the site, plus basic technical data.

Conversations with Pip

When you chat with Pip we store the messages you send and Pip's replies (including any cards it shows), the page you were on, a random conversation ID, your browser's user-agent string and your approximate country, which our hosting provider derives from your IP address. A copy of the conversation is also kept in your browser's local storage so it survives a page reload; starting a new chat clears it.

Enquiries and briefs

If you use the contact form, or ask Pip to pass your details to the team, we collect your name, email address and anything else you choose to give us: company, phone or WhatsApp number, project type, budget range, timeline and your message. We also record whether you agreed to personal follow-up emails, the page you sent it from and your approximate country.

Booking a call

When you book a call we collect your name, email address, the time you chose, your timezone and any company name or notes you add, and we create an event in our Google Calendar with a Google Meet link and an invitation to you.

Reviews

If you send a review we collect your name, email address, role, company, the project it relates to, your rating, your review and your consent to publish it. We use your email address only to confirm the review with you before publishing it; it is never published.

Proposals

If we send you a proposal link and you accept it, we record your name, email address, job title, the time of acceptance, your IP address and your browser's user-agent string as evidence of the acceptance.

Business contacts we email

We introduce our services to businesses by email. These introductions come from a member of our team, written with help from our AI assistant. For that we keep the company's name, website and public information about it (for example news, hiring or product launches), and a business contact address that the company itself has published, together with the page where it was published and, where known, the contact's name and role. We also keep the emails we exchange and our notes. Our emails say where we found the address and link to this policy, and you can object at any time by replying or using the unsubscribe link in any of them.

Emails you send us

If you email us, including Pip's mailbox, we keep your email address, your name as it appears on the message, what you wrote and our replies, even when it isn't about a project (for example a job application or a supplier introduction).

Technical data

• Server logs. Our hosting provider records requests (IP address, user agent, URL and time) to run and secure the service.
• Abuse prevention. To rate-limit forms and Pip we store a one-way hash of your IP address with a counter for a short time window. We do not store the raw address for this.
• Bot protection. When you send the contact form, chat with Pip, book a call or sign in to the admin area, Vercel BotID runs a short check in your browser and sends Vercel signals about the browser and device, so it can tell people from automated bots. Vercel tells us whether the request looks automated; we don't store those signals. For an enquiry (the contact form or Pip's chat) we keep that result with it: when the check doesn't pass, we still read your message and a person replies, but no automatic email (receipt or follow-up) is sent to the address entered.
• Analytics. Aggregate, cookieless usage and performance statistics (see cookies and analytics).

Please don't send us sensitive personal data (such as health or financial details, or government ID numbers) through Pip or our forms. We don't need it to respond to you.

We use personal data only for the purposes below. Where the GDPR or UK GDPR applies, each purpose relies on the legal basis shown.

Under India's DPDP Act, we process personal data with your consent or for a legitimate use the Act permits, such as when you voluntarily give us your details for a specific purpose (for example, to get a reply to your enquiry or to book a call).

We don't sell personal data, and we don't use it for third-party advertising.

Pip is Softpiper's AI, not a person. It runs on Claude, a model provided by Anthropic, PBC. If Claude is unavailable, Pip falls back to Gemini, provided by Google. To generate each reply, your messages, the page you're on and the conversation so far are sent to the relevant provider through its commercial API.

• Under Anthropic's and Google's commercial API terms, these providers do not use the content we send them to train their models by default. They may keep it for a limited period for abuse and safety monitoring, as their terms describe.
• Pip's price ranges come from our pricing engine and policy, not from the AI model inventing numbers. They are indicative and are not a quote.
• Pip does not make decisions about you that have legal or similarly significant effects. People on our team can read conversations to follow up with you and to improve Pip.
• We also use Claude to read and sort email sent to Pip's mailbox, to research businesses from public sources and to draft emails; a person on our team can review them. Outgoing email can be reviewed by a person on our team before it is sent.

Pip can remember you between visits on the same device, but only if you turn on Remember me on this device in the memory menu at the top of the Pip panel. It is off by default, and nothing is kept for it while it's off.

• What's kept. A random ID for your device, when you turned memory on, and one short note (about 2 KB at most) that Pip writes: your name and company if you gave them, your project brief and needs, decisions and preferences you shared, and where you left off. Pip is instructed never to keep payment, ID or login details, sensitive data such as health information, or details about people outside your company, and our server refuses notes that look like payment, ID or login details.
• Why. So you can pick up where you left off without repeating yourself. At the start of each new conversation on that device, the note is given to Pip, and so to our AI providers as described above.
• Where. The ID is kept in your browser's local storage; the note and the record of your consent are kept in our database. They are not linked to your email address or to your other devices. Like conversations, the note can be read by people on our team.
• How long. Deleted automatically 180 days after a conversation last used it.
• Seeing and deleting it. The same menu shows what Pip remembers. Choose Forget me and the note and your consent are deleted from our database straight away, memory turns off and the ID is removed from your browser. If you clear your browser's site data instead, the note is deleted after 180 days, or sooner if you email info@softpipersolutions.com.

Your conversations themselves, including the note as Pip was given it and the updates Pip wrote to it during them, are kept as described in how long we keep it; turning memory off or choosing Forget me doesn't delete them.

Pip sends email from its own softpipersolutions.com address (reply to any email from Pip to reach it) and always signs as Softpiper's AI. Depending on how you came to us, you may receive:

• a receipt after you contact us, and our replies;
• if you agreed, a personal follow-up about your enquiry and one short reminder, which stop as soon as you reply or book a call;
• if your business published a contact address, an introduction and a small number of follow-ups. These come from a member of our team, written with help from our AI assistant, not from Pip.

Every introduction and follow-up identifies us, includes our postal address and has a one-click unsubscribe link. Pip's own emails also carry a List-Unsubscribe header your email app can use. You can also simply reply and ask us to stop. When you unsubscribe we add your address to a suppression list and stop all pending messages to it. We keep that list, which holds only the address, the reason and the date, so we can keep honouring your choice.

We don't use advertising or cross-site tracking cookies. The only cookie this site sets is a sign-in session cookie for the site owner on the private admin area. Visitors never receive it.

To make features you use work, the site stores a few items in your own browser:

These items stay on your device and you can clear them at any time in your browser settings.

We use Vercel Web Analytics and Vercel Speed Insights to see aggregate page views, referrers, countries, device and browser types, and page performance. They set no cookies and do not build a profile of you across sites; Vercel counts visits with an identifier derived from the request that it discards within 24 hours.

We use the service providers below to run the site and our business. They process personal data on our instructions and under contracts that require them to protect it.

We may also share personal data with professional advisers (such as lawyers and accountants), with authorities when the law requires it, or with a successor if our business is reorganised or sold, in which case this policy will continue to protect your data.

Softpiper is based in India and some of our providers are in the United States or operate globally, so your data may be processed outside the country where you live, including in India and the United States.

Where the GDPR or UK GDPR applies, we rely on recognised safeguards for these transfers, such as the European Commission's Standard Contractual Clauses (with the UK Addendum) or a provider's certification under the EU-U.S. Data Privacy Framework and its UK extension. You can ask us for details of the safeguard for a particular provider. Under the DPDP Act, we don't transfer personal data to any country the Government of India restricts.

We keep personal data only as long as we need it for the purposes above:

• Pip conversations: up to 12 months after your last message, unless they become part of an enquiry or engagement.
• Enquiries, bookings and related email: up to 24 months after our last contact if we don't start working together.
• Clients: for the length of the engagement, then for as long as accounting, tax and other laws require (in India, generally eight years for financial records).
• Business outreach records: up to 24 months after our last contact.
• Other email we receive: up to 24 months after the last message.
• Unsubscribe list: for as long as we need it to honour your choice.
• Our email service's copies (Resend): up to 30 days for the automated email it sends and the replies it receives for Pip.
• Email delivery events (bounce and spam-complaint reports, without the message itself): 90 days.
• Reviews: while published, until you ask us to remove them. Submissions we don't publish are deleted within 12 months.
• Pip memory notes (optional): 180 days after a conversation last used them, or straight away when you choose “Forget me”.
• Rate-limit counters: about two days.

When a period ends we delete the data or anonymise it so it no longer identifies you.

We also keep encrypted backups of our database for disaster recovery: the 30 most recent daily copies and the first copy of each month for 12 months. A copy we remove is permanently deleted 30 days later. Data deleted from the live system, including Pip memory notes, disappears from backups as those copies are deleted, and we never restore it into normal use except to recover from a failure.

Wherever you are, you can ask us what we hold about you, ask us to correct or delete it, and tell us to stop emailing you. Depending on where you live, the law gives you specific rights:

EEA and UK (GDPR and UK GDPR)

• access a copy of your personal data;
• have inaccurate data corrected, and have data erased;
• restrict or object to processing, including an absolute right to object to direct marketing;
• receive data you gave us in a portable format;
• withdraw consent at any time, without affecting earlier processing;
• complain to a data protection authority, such as the one where you live or work, or in the UK the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to put things right first.

India (Digital Personal Data Protection Act, 2023)

• obtain a summary of the personal data we process about you and how we process it, and the identities of those we have shared it with;
• have your data corrected, completed, updated or erased;
• withdraw consent as easily as you gave it;
• have your grievance addressed by us, and then, if you are not satisfied, complain to the Data Protection Board of India;
• nominate another person to exercise your rights if you die or become incapacitated.

How to make a request

Email info@softpipersolutions.com with “Privacy” in the subject line. We may ask you to confirm your identity before we act. We reply within the time the law allows, which under the GDPR and UK GDPR is one month, and we won't charge you unless a request is clearly excessive. To stop emails immediately, use the unsubscribe link in any message from us.

Our site and services are for businesses and are not directed at anyone under 18. We don't knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we'll delete it.

We use technical and organisational measures appropriate to the data we hold, including:

• encryption in transit (HTTPS) for the site, Pip and our APIs;
• access limited to the people who need it, with admin sign-in by single-use email links for approved addresses only;
• a database that is not exposed through a public API;
• unsubscribe tokens stored only as hashes, and IP addresses hashed for rate limiting;
• separate, least-privilege credentials for each provider.

No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

We update this policy when our services, providers or the law change. The date at the top shows the latest revision. If a change materially affects how we use data you have already given us, we'll tell you before it takes effect, by email where we can. Our terms of use explain the rules for using this site.