In this Privacy Policy, “Pipelex”, “we” and “us” refer to Evotis S.A.S., 10 Rue Mabillon, 75006 Paris, France, and its affiliates. We are committed to protecting your personal data and being transparent about what we collect and why.

Our guiding principle is simple: We build tools for agents and humans, not surveillance for users. We only process the information we need to run our services, to support you and to improve our software.

This policy covers three ways you may interact with us:

As a Visitor to our websites, such as pipelex.com and our documentation.
As a User of Pipelex Cloud, our hosted platform: the web console at app.pipelex.com, the API at api.pipelex.com and the Pipelex MCP at mcp.pipelex.com.
As a User of Pipelex Software that you run yourself, whether open-source, source-available or closed-source.

1. Who Is Responsible for Your Data

Pipelex is the controller of the personal data this policy describes: your account, your use of our website and services, billing, and our communications with you.

What you bring to and produce in Pipelex Cloud (“Customer Content”, described below) is a different case. We process it on behalf of the organization that uses Pipelex Cloud and following its instructions, which makes us its processor. When Customer Content contains personal data about other people, that organization is responsible for having a legal basis to process it.

We rely on the following legal bases:

Performance of our contract with you: to create your account, run your methods, bill your usage and support you.
Our legitimate interests: to secure our services and prevent abuse, to understand how our services and software are used so we can improve them, and to manage our relationship with our users.
Your consent: for analytics cookies on our websites and in the web console, which you can refuse or withdraw at any time.
Legal obligations: to keep accounting records and to answer lawful requests.

2. As a Visitor to Our Websites

This section covers every website we run, such as pipelex.com, our documentation at docs.pipelex.com, mthds.ai, the MTHDS Hub at mthds.sh and knowhowgraph.com. To understand how visitors find our sites and which pages are most useful, our websites use some of the following tools:

Vercel Analytics: cookieless, aggregated page-view counts.
PostHog: hosted in the European Union.
Google Analytics: on pipelex.com.

When you browse our websites:

What we track: Pages visited, referrer (where you came from), device type, and approximate location (country/city) derived from IP.
Your Privacy: We do not link this data to your personal identity. Google Analytics and PostHog use cookies to identify a “session,” but we do not upload your name or email to these tools.
Opt-Out: On pipelex.com, Google Analytics and PostHog load only after you accept cookies, and declining the cookie banner prevents them from running. You can additionally prevent Google Analytics from using your data by installing the Google Analytics Opt-out Browser Add-on.

3. As a User of Pipelex Cloud

Your Account

You sign in to Pipelex Cloud through WorkOS, our authentication provider, using one of the sign-in methods offered on the sign-in page, such as your email address or your Google or GitHub account.

What we store: your name, your email address and an identifier from WorkOS. If you sign in with a password, WorkOS holds it; we never see or store it. We do not store profile photos.
Sign-in records: for security, we record each sign-in with its date, the sign-in method, your IP address and your browser type.
Organizations: your account comes with a personal organization, and you can join team organizations. An organization’s methods and runs are visible to its members, and its admins can invite people by email (the invitation is sent by WorkOS).
API keys: we store only a fingerprint of each Pipelex API key, never the key itself.
Onboarding survey: if you answer our optional survey (your role, your company, your use case and similar questions), we store your answers with your account and share them with our product analytics and our customer relationship management tool.

Customer Content

Customer Content is what you bring to and produce in Pipelex Cloud: your methods and their code, the prompts, inputs and files you provide, the outputs your runs produce, and the history of each run.

Use: we use it only to run your methods and show you the results. Our team accesses it only to support you at your request, to investigate an incident, or to prevent abuse.
No training: we do not use your Customer Content to train AI models.
Storage: it is stored with our cloud hosting provider and kept as long as we need it to provide the service to you. We may set time limits on how long run outputs and run histories are kept.
Deletion: you or your organization can delete Customer Content at any time. Deleting a run erases its data, including the copy held by our workflow engine, and deleting a method erases the method and its runs.

How Your Runs Are Processed

When you run a method, Pipelex Cloud executes it on our infrastructure with the help of the providers below. Each one receives only what it needs for its part of the run.

AI Model Providers

A method’s model calls go through our inference gateway, which sends your inputs (prompts, files, text) to the provider that serves the model. Pipelex’s own configuration, not your request, decides which provider serves each model. Some document processing, such as extracting text from PDF files, runs on our own servers and reaches no provider.

Your data may be processed by one or more of the following providers, depending on the models your methods use:

Microsoft Azure: OpenAI’s GPT and image models, other models offered through Azure AI Foundry, and document reading with Azure AI Document Intelligence.
Amazon Bedrock: Anthropic’s Claude models and open-weight models.
Google Gemini API: Google’s Gemini models, including image generation.
Linkup: web search and web page retrieval.
TypeSafe: judgment models, which return typed decisions.

Note: We continuously evaluate new technologies. We may add providers to this list to improve service quality, and we update the list when we do, after telling organizations in advance as our Terms of Use describe.

Data Usage & No-Training Guarantee:

Pipelex: We do not use your data (inputs or outputs) to train AI models.
Providers: We use these providers under their commercial API terms, which commit them not to use data sent through their APIs to train or improve their models.

What We Keep About Model Calls:

Our inference gateway records each call’s model, provider, token counts, duration and status, with the identifiers of the run, user, organization and API key it belongs to. We use these records to bill usage, to support you and to prevent abuse. The prompts and answers of model calls may also be kept, for up to one year, for the same purposes.

Infrastructure

Pipelex Cloud runs on infrastructure providers of the following kinds. You can ask for their names and locations at privacy@pipelex.com, and our Terms of Use describe how we tell organizations before we add or replace one.

Cloud hosting: hosts the platform, its databases, its file storage and the web console.
Workflow engine: keeps each run’s state so that it can retry and resume after a failure. It receives a run’s inputs, intermediate results and outputs while the run executes and keeps its history afterwards; deleting a run erases it there too.
Isolated code execution: runs the Python code steps of a method in an isolated sandbox, created for each step without internet access and deleted right after. It receives that step’s code and data.
MCP hosting: hosts the Pipelex MCP at mcp.pipelex.com. When a chatbot such as ChatGPT or Claude uses it, the requests, results and attached files of those calls pass through this host.

Other Services

Anthropic (Claude Managed Agents): runs the build assistant, which helps you write methods. Your messages, the method files the assistant reads and the results of its tools go to Anthropic, which keeps the conversation so that you can return to it.
WorkOS: sign-in, organization membership and invitation emails.
Lemon Squeezy: payments, described below.
PostHog: product analytics, described below, hosted in the European Union.
Attio: our customer relationship management tool. It receives your name, your email address and your user identifier when you sign up or change your profile, and your answers to our onboarding survey.
Slack: our team’s internal messaging. We are notified of each sign-up, with your name and email address, and of each piece of feedback you send, with your email address, your message and what you attach to it.

Product Analytics and Cookies

We use PostHog, hosted in the European Union, to understand how Pipelex Cloud is used and where it breaks. What PostHog receives is tied to your user identifier and your organization, never to your email address.

Usage events: our servers record events such as a sign-up, a sign-in, a run started, a method created or published, or an API key created, with technical details of the request such as the tool and version you used.
Error reports: when the web console hits an error, it reports the error to PostHog.
Page views and session recordings, with your consent: only if you accept analytics cookies in the web console does it record the pages you visit and recordings of your sessions, so that we can see where people get stuck. Recordings are masked so that they do not show what you type or the content of your methods. You can withdraw your consent at any time.

The web console sets the cookies it needs to work, which need no consent: your session, your language, your active organization and your display preferences. PostHog stores an identifier in your browser only once you accept analytics cookies.

Payment Information

Lemon Squeezy: We act as the software provider; Lemon Squeezy is our Merchant of Record. They handle all payment processing, taxes and PCI compliance, and tell us what you bought and with which email address. We do not store credit card details.

Where Your Data Is Processed

Pipelex Cloud and most of the providers above process your data outside the European Economic Area, mainly in the United States. When your personal data leaves the European Economic Area, the transfer relies on the European Commission’s Standard Contractual Clauses or on the recipient’s certification under the EU–U.S. Data Privacy Framework.

How Long We Keep Your Data

Account information: while your account exists.
Customer Content: as long as we need it to provide the service to you, and no longer than your account exists. We may set shorter limits for run outputs and run histories.
Prompts and answers of model calls: up to one year.
Service logs, including IP addresses: between 14 and 90 days.
Usage and billing records: as long as accounting law requires.
Backups: up to 35 days after the data they contain was deleted.

4. As a User of Pipelex Software

When you run Pipelex Software yourself, your model calls go directly to the providers you configure, with your own keys and under their own terms. When Pipelex Software uses a Pipelex API key, for example to run a method on Pipelex Cloud, those calls are covered by section 3.

Custom Telemetry (User-Controlled)

As detailed in our documentation, the Pipelex runtime supports Custom Telemetry. This allows you to send traces and logs to your own observability backends (e.g., your own PostHog instance, Langfuse, or OTLP collectors).

Configuration: Controlled via .pipelex/telemetry.toml.
Default: Disabled by default (pipelex init telemetry creates the file with options disabled).

Privacy:

PostHog: Supports redaction. You can enable redaction to strip sensitive properties (like prompts/completions) before sending.
Langfuse & OTLP: These exporters receive full span data (including prompts and completions) because they are designed for your internal observability. Enable these only if you trust the destination endpoint.

Your Stream: Custom Telemetry goes only to the endpoints you configure. It is separate from the anonymous usage statistics described in section 5.

5. Anonymous Usage Statistics in Pipelex Software

The tools you install and run yourself send anonymous usage statistics to Pipelex, so that we know which features are used, on which systems, and what fails. They are on by default. A notice tells you so the first time one of these tools runs on your machine, and the statistics of that first run are sent too; you can turn them off at any time, even before that first run. A tool whose output is meant for another program, such as pipelex-agent in JSON mode, shows no notice but still sends its statistics, and the notice appears on the next run whose output is meant for you.

The tools that send them are the Pipelex runtime (its pipelex and pipelex-agent command-line tools, the self-hosted API server and its Docker image, and any Python program you write that uses it), the Pipelex runtime for Node.js, plxt, the Pipelex extension for VS Code and the mthds and mthds-agent command-line tools. Each tool sends them from the release whose changelog announces them; earlier releases send none. Our other libraries and our SDKs send none, and nothing is ever sent from a web browser. Pipelex Cloud sends none of these statistics: its product analytics are described in section 3.

What Is Sent

Counts and categories: the commands you run and your runs, and their outcome, whether they succeed, fail or are cancelled, with the category of an error taken from a fixed list, never its message; whether a command was sent to Pipelex Cloud; for the init command, where it set runs to execute and which provider kinds it enabled; whether a run was a dry run, and the kind of source its method came from, such as a local bundle or a published address, never the address itself; the number of pipes of each built-in type, and of all other types together; which language features a run used, and whether it received an image or a document as input; the size and nesting depth of a method bundle; the verdict of each validation of a method, with its numbers of errors and warnings; what each code generation produced, for which language, and whether it succeeded; the models used, named by their handle in the catalog our release ships, or "other" for any model outside it, and their provider kind, or "custom"; the number of model calls and of failed ones, with the category of each failure; token counts, images generated, pages extracted and the estimated cost in US dollars, and whether a run could count them; for plxt, the number of files it processed, in ranges, and the number of problems it reported, by kind; the features of the VS Code extension you use and how often, and the days on which it starts; durations.
Your environment: the tool's name and version, which of its entry points sent the event, such as the pipelex-agent command-line tool or the API server, and the version of the format the event follows; how it was started, from a fixed list such as the command line, a pre-commit hook, a Python program or a server; the program of ours that embeds or starts it, such as cocode or mthds-agent, when that program declares itself; your operating system and processor architecture; the major and minor version of Python, or the major version of Node.js; for the extension, the editor that runs it, such as VS Code, Cursor, Windsurf or VSCodium, and its version; whether the tool runs in continuous integration or in a container; which version of our notice has been shown on your machine; and whether the machine is marked as one of our team's, so that we can leave our own use out of the statistics.
Your country: PostHog derives it from your IP address. We store neither the IP address nor any finer location, such as a city, a region or coordinates.
An installation identifier: a random identifier created the first time one of our tools runs on your machine and shared by our tools on that machine. It is never derived from your machine name, user name, network address, file paths or anything else about you or your computer, and you can replace it at any time. Each event also carries the time it occurred, a random identifier of its own, drawn for that event alone so that an event sent twice is stored once, and whether the process that sent it is the one that created the installation identifier. No profile of a person is created, except briefly when we delete your statistics at your request, and that profile is deleted with them.

Each tool's documentation lists every property it sends.

What Is Never Sent

Your methods and their source; the names of your pipes, concepts, domains and classes, and any other name you wrote; prompts, inputs, outputs and any generated content; file names, paths, URLs and repository addresses; method names and catalog identifiers; run identifiers; the order in which a run's pipes executed; error messages and stack traces; command arguments and option values; environment variables; machine names, user names and email addresses; IP addresses. The only exceptions are the install and publish events of public methods, described at the end of this section, which carry the public fields of the method's manifest.

Where They Go and How Long We Keep Them

The usage statistics go to PostHog, hosted in the European Union, in a project that holds nothing else. They are kept for the retention period of PostHog, currently seven years, and we delete them sooner on request. We may publish totals of these statistics, which describe no single installation.

We designed these statistics to be anonymous: they do not tell us who you are. If the installation identifier counts as personal data, we process it on the basis of our legitimate interest in understanding how our software is used so that we can improve it, and you can object at any time by turning the statistics off. To ask us to delete the statistics of your installation, write to us with its identifier, which pipelex usage-stats status shows. A deletion usually takes up to a week, and it covers only the statistics sent before your request, so turn the statistics off or reset your identifier first.

Turning Them Off

Any one of the following turns the statistics off:

DO_NOT_TRACK=1: this universal environment variable turns off everything our software sends to Pipelex, in every one of our tools, and your Custom Telemetry as well. It does not affect the logs you configure yourself, and it has no effect on Pipelex Cloud, which runs on our servers.
PIPELEX_USAGE_STATS=0: for every one of our tools, except the method install and publish events described below, and DISABLE_TELEMETRY=1 for the mthds tools.
pipelex usage-stats disable: records your choice for every one of our tools on your machine, as do plxt usage-stats disable and mthds telemetry disable. Every tool also honours DISABLE_TELEMETRY=1 in ~/.mthds/config, where earlier releases of mthds record that choice. Turning the statistics off with usage-stats disable also discards the events still waiting to be sent, and a tool that is already running, such as a server or the VS Code extension, stops sending.
A project setting: enabled = false in the [usage_stats] section of a project's .pipelex/pipelex.toml turns the statistics off for everyone who works in that project. A project can only turn them off, never on.
VS Code's own telemetry setting, for the Pipelex extension. The programs the extension starts never send statistics of their own: the extension counts their use itself, under that setting.

pipelex usage-stats status shows whether the statistics are on and your installation identifier, PIPELEX_USAGE_STATS_DEBUG=1 prints the events instead of sending them, and pipelex usage-stats reset-id replaces your installation identifier with a new one and discards the events still waiting to be sent.

Methods You Install or Publish with `mthds`

The mthds and mthds-agent command-line tools also send an event each time you install or publish a method from a public repository, which counts the method's installs on the MTHDS Hub at mthds.sh. The event describes the method with the public fields of its manifest: its address, name, display name, version, description, authors, license, main pipe, exported pipes and the version of the MTHDS standard it follows. It carries no user identifier. PostHog receives your IP address with the request, and we ask it not to derive a location from it. Nothing is sent for a private repository. DO_NOT_TRACK=1, DISABLE_TELEMETRY=1 and the choice recorded on your machine by pipelex usage-stats disable, plxt usage-stats disable or mthds telemetry disable turn these events off as well, while PIPELEX_USAGE_STATS=0 and a project setting do not.

6. Your Rights

Under the General Data Protection Regulation, you can ask to access, correct, delete or export your personal data, restrict or object to its processing, and withdraw your consent at any time. Write to privacy@pipelex.com and we will answer within one month.

Deleting your account: on request to the same address, we delete your account, and the data of the organizations of which you are the only member, within 30 days.
Personal data in Customer Content: if your request concerns personal data inside an organization’s Customer Content, we forward it to that organization and help it answer.
Complaints: you can lodge a complaint with the CNIL, the French data protection authority, at www.cnil.fr.

7. Changes to This Policy

We update this policy when our services change, and the date at the top shows the current version. When a change is significant, we tell Pipelex Cloud users by email or in the web console before it takes effect.

8. Contact

For questions regarding this policy or your data rights, please contact us at: privacy@pipelex.com

Evotis S.A.S.
10 Rue Mabillon
75006 Paris
France

Privacy Policy