Privacy Policy

This policy explains what [Company legal name] ("PitchPilot", "we") collects when agencies use PitchPilot, why, and the choices you have. Contact: [privacy@your-domain] · [postal address].

Who this covers

• Agency users: people who sign up and use PitchPilot. For their data we act as the controller.
• Prospects and clients of agencies: businesses an agency researches, emails or serves. For this data the agency is the controller and we process it on the agency's behalf.

What we collect

• Account data: name, work email, password (stored only as a salted hash), agency name, branding and postal address.
• Prospect data that agencies enter or import: business name, website, city, category, business phone and email, notes, deal stage and outreach history.
• Website audit results: we load a prospect's public website the way a browser would and store the results of automated checks.
• Google Maps data: when the agency connects a Google Places API key, business listings, ratings and review counts come from Google Maps through Google's official API and are shown with "Google Maps" attribution. In line with Google's policies we keep only Google place IDs long term; ratings shown in a saved audit are a snapshot of what was displayed at the time of the audit.
• Content and reports agencies create for their clients.
• Billing data: handled by Stripe; we store the Stripe customer and subscription IDs, never card numbers.
• Technical data: IP address (for rate limiting and security, kept for at most 24 hours), and a session cookie.

How we use it

• To provide the service: audits, discovery, outreach, content, reports, team access and billing.
• To keep it secure: rate limits, abuse prevention and fraud detection.
• To send account emails (verification, password reset, invitations) and outreach emails that agencies send through us.

We don't sell personal data and we don't use it for advertising.

Service providers

• Anthropic (AI drafting of pitches, content and report summaries), when the AI feature is enabled.
• Google (Places API), when enabled by the agency.
• Stripe (payments).
• [Email delivery provider] (sending email).
• [Hosting provider and region] (application and database hosting).

Cookies

We use one essential, HTTP-only session cookie to keep you signed in. We don't use analytics or advertising cookies.

Retention and deletion

• Agency owners can export all agency data as JSON and permanently delete the agency from Settings at any time.
• Users can delete their own account from Settings.
• Backups are kept for [N] days and then deleted.
• Anyone can stop outreach from an agency with the unsubscribe link in its emails; we keep the address on a do-not-email list so the opt-out keeps working.

Your rights

Depending on where you live (for example under the UAE PDPL, Saudi PDPL, India's DPDP Act or GDPR) you may have rights to access, correct, delete or port your data and to object to processing. If you are a prospect or client of an agency, contact that agency first; we will help them respond. Otherwise write to [privacy@your-domain].

International transfers

[Describe where data is stored and the transfer safeguards used.]

Changes

We will post updates here and tell account owners by email about material changes.