Privacy Policy

Operator: Elite Automation LLC, doing business as PipelineForge ("we," "us," or "our"). This policy describes information processed through PipelineForge's business-to-business introduction service. It does not govern an independent IT provider's services or practices.

1. Information and sources

We collect information you provide directly: company or organization name, contact name, business email, location or region, company size, website, IT needs, timing, service coverage, ideal customers, and contact/sharing consent. We record submission dates, form origin, consent wording and timestamps, and staff review or assignment information. Staff accounts also involve sign-in credentials and account identifiers managed by our authentication service.

Our submission service processes your connection's IP address to create a one-way hash for abuse prevention, with form type and time. Hashing reduces direct identifiability but does not make all information anonymous. Hosting and authentication services may process technical connection, security, and operational logs. Do not include passwords, health information, payment details, or other sensitive information in requests.

2. Why we use information

Staff may enter and update provider profiles in a private directory. Those records are labeled staff-entered and do not imply provider application or consent. Approved profiles may be considered for staff-requested matching.

• Review business requests and MSP applications, assess stated coverage, and administer introductions.
• Contact you about your request or application within the permission you give us.
• Maintain consent and review records, secure staff access, and investigate spam or misuse.
• Handle privacy inquiries, resolve disputes, and satisfy applicable legal requirements.

Submitting a request is not consent to unrelated marketing. The website does not initiate automated marketing or publicly list submissions. MSP enrollment payments are handled through hosted Stripe checkout.

3. Disclosures and provider introductions

New requests with versioned automatic-matching permission and a linked invited buyer account are evaluated using recorded country/region, services and company size. Only staff-approved linked MSPs with verified paid subscription coverage, recorded fit, available capacity and participation permission qualify. Up to three providers receive private in-app invitations showing selected service categories, country/region, company-size range and timeframe—not names, email or free-text needs. After provider acceptance, current eligibility and consent checks permit contact and request-detail disclosure and a separate private conversation. Uncertain or unmatched requests are held for staff review. No account is automatically created from a submitted email. Withdrawal in the buyer portal stops future disclosure; information already shared cannot be recalled. Notifications are in-app only; email notifications are not configured.

Authorized staff can access submissions. Invited accounts linked by staff to approved MSPs can maintain that organization's profile, services and pricing and view only its assigned requests where sharing permission is recorded. Staff notes and consent evidence are not displayed in the provider portal. Hosting, authentication, and other operational service providers may process information to support the service. We may disclose information when required by law, to respond to lawful process, protect legal rights or safety, or address fraud. A merger, acquisition, or asset transfer may involve relevant records, subject to applicable law and notice requirements.

When staff explicitly request AI-assisted matching, Lovable AI processes the IT needs and location entered for that request, along with selected approved providers' organization names, regions, stated coverage, and ideal-customer descriptions. Contact names and email fields are not included automatically. Free-text fields may still contain personal information; staff should remove personal or confidential details before requesting recommendations. AI recommendations are advisory and do not automatically assign a lead or contact a provider.

Only with the business submitter's express sharing permission, we may give relevant request and contact details to an appropriate independent managed IT provider so that provider can evaluate the request and contact the business. Providers control their own subsequent processing; ask them for their privacy policy. Revoking permission cannot undo a disclosure already made, but you may ask us to stop future introductions and contact the provider about its records.

We do not operate a personal-information list-selling business. Our provider pilot contemplates paid participation under separate agreements. Legal definitions of "sale" or "sharing" of personal information can be broader than ordinary usage. You may contact us about your information and any applicable opt-out rights; no categorical exemption is claimed.

Invited buyer accounts linked by staff can maintain a company profile, budget priorities, and their own IT requests. Introduced provider details appear only for consented, assigned requests and approved providers. Buyer accounts do not receive private staff notes or other buyers' requests.

MSPs may optionally permit a company listing in the signed-in buyer directory. This choice is unchecked by default and separate from application and matching consent. We record the permission version and timestamp and any withdrawal. Buyers see only company name, region, services, website, and optional pricing or profile note—not contact email, contact name, staff notes or consent evidence. Visibility requires provider permission, staff approval, a linked provider account, verified active paid coverage and staff review of the current displayed content. Providers can withdraw permission in their portal; eligibility loss or changes to reviewed content hide the listing automatically. Withdrawing directory permission does not itself withdraw separate matching participation.

Assigned approved MSPs may submit private responses to open, consented introductions. We store each response, its provider attribution, account identifier, and timestamp. Linked buyers can read response history for their own requests, including after closure or reassignment; newly assigned providers cannot read another provider's responses. Responses appear in the portals and do not trigger automatic emails.

4. Cookies, account sessions, and third parties

Portals also store saved requests and profile work, onboarding completion, provider availability and response templates, two-way messages, meeting proposals and confirmations, commercial proposals and decisions, rematch requests, and opportunity updates. Read markers support in-app unread indicators. Buyers retain their request history after reassignment; a newly assigned MSP cannot access the previous MSP's private thread. Meeting calendar files are downloaded by the user; the service does not send automatic email reminders or book external calendars.

Staff, buyer, and MSP sign-in uses browser storage and authentication/session technology. The current application does not include an advertising-tracking integration. Third-party links and remotely loaded services, including fonts, may process connection information under their own policies. We do not control independent websites or providers.

5. Retention

Retention is assessed by record type, the status of a request or application, the need to document consent and introductions, security and dispute needs, and applicable legal obligations. No fixed automatic deletion schedule has been implemented. The rate-limit check uses a one-hour window; that is not a promise that stored hashes are deleted after one hour. Deletion requests are handled individually, subject to applicable legal obligations and permitted retention for security, consent records, and disputes.

6. Security and processing locations

We use access-controlled storage and role-restricted staff access. No system is completely secure, and we cannot guarantee absolute security. Information may be processed where our service providers operate, including outside your state or country. Provider handling after an authorized introduction is independent of PipelineForge.

7. Choices and California privacy rights

Email katie@katie-melissa.com to request access, correction, deletion, or withdrawal of future contact or sharing permission. We may reasonably verify identity and authority, request limited additional information, and retain information where law permits or requires it. Avoid sending sensitive documents unless we arrange a secure method.

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to us and your information, rights may include knowing/accessing information, correction, deletion, portability, opting out of sale or sharing, limiting qualifying uses of sensitive personal information, and non-discrimination for exercising rights, subject to statutory exceptions. Authorized agents may submit requests with appropriate proof of authority. We will handle legally applicable requests within required deadlines; this policy does not waive statutory rights.

This policy does not assert a categorical exemption from California privacy law or that automatic Global Privacy Control processing has been implemented. Contact us to exercise any applicable rights. Business contact information is not automatically excluded from California privacy protections.

8. Children

The service is intended for adult business representatives, not children under 18. We do not knowingly solicit children's information. Contact us if you believe a child has submitted information so we can investigate and take appropriate action.

9. Changes and contact

We may update this policy to reflect changes in practices or law and will provide additional notice or consent where required. Material changes will not retroactively expand consent where prohibited. The effective date appears above.

Privacy contact: Elite Automation LLC dba PipelineForge — katie@katie-melissa.com.