Privacy Policy

This Privacy Policy explains how Pipehero (“we”, “us”) collects, uses, and protects your information when you use our website, CLI, dashboard, and MCP server (the “Service”). By using the Service you agree to this policy.

Information we collect

• Account data — your name and email address, provided via Google sign-in (through Supabase) when you create an account.
• Workspace & tunnel data — workspaces you create, tunnel subdomains, members and invitations, and API tokens.
• Captured webhook data — when a request reaches one of your tunnels, we store its metadata and body (request and response) so you can inspect and replay it. This content is controlled by you and may include data from your third-party services.
• Billing data — plan and subscription status. Payments are handled by Stripe; we do not store your card details.
• Usage & technical data — log data, IP address, device/browser information, analytics events, and error reports.
• Support data — messages you send us via chat or email.

How we use your information

To provide, operate, secure, and improve the Service; to process payments and manage subscriptions; to communicate with you (including transactional email and support); to prevent abuse and enforce our Terms; and to comply with legal obligations.

Legal bases (GDPR)

Where the GDPR applies, we process your data on the basis of: performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service and prevent abuse), consent (for optional analytics/marketing cookies), and legal obligation (e.g. tax and accounting).

Sharing & subprocessors

We do not sell your personal data. We share it only with service providers who process it on our behalf under appropriate agreements:

We may also disclose data if required by law or to protect our rights and users.

International transfers

Your data may be processed in countries outside your own, including the United States. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Data retention

We retain account data while your account is active. Captured webhook history is retained according to your plan (e.g. 3, 30, or 90 days) and then deleted. On account deletion we remove your personal data within a reasonable period, except where retention is legally required.

Security

We use encryption in transit (TLS), scoped access tokens, and reputable infrastructure providers. No method of transmission or storage is 100% secure, but we work to protect your data.

Your rights

Depending on your location (including under the GDPR and CCPA), you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to processing, and to withdraw consent. You may exercise these rights, or lodge a complaint with your local data protection authority, by contacting us at privacy@pipehero.app. We do not sell personal information.

Cookies

We use cookies and similar technologies as described in our Cookie Policy.

Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

Changes

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.

Contact

Questions? Email privacy@pipehero.app.