Privacy Policy

1. Who We Are

Pitchkit is operated by Mari Luukkainen. For questions about privacy, email: [email protected].

2. What We Collect

• •Email Address (When You Sign Up)
• •Pitch Content You Upload or Enter
• •Usage data (e.g., pages visited, actions taken)
• •Payment info (handled via Stripe - see their policy https://stripe.com/privacy)

3. Why We Collect It

• •To Provide and Improve the Service
• •To communicate with you (support, updates)
• •To Analyze Product Usage
• •To Process Payments

4. Legal Basis (under GDPR)

• •Your Consent (When You Sign Up)
• •Contractual necessity (to deliver the product)
• •Legitimate Interest (to Improve the Service)

5. Data Retention

We retain your data only as long as needed to provide the service or comply with legal obligations. You can request deletion at any time.

• •Account data (name, email, profile): retained while your account is active, deleted within 30 days of account deletion
• •Pitch content and analyses: retained while your account is active, deleted on account deletion
• •Payment and billing records: retained for 7 years after the transaction to comply with tax and accounting obligations (EU requirement)
• •Server logs (including IP addresses): automatically deleted after 30 days
• •Email communication records: retained for 12 months, then deleted

6. Sub-Processors and Third-Party Services

We use the following sub-processors to provide our service. Each processor has a Data Processing Agreement (DPA) in place:

• •Stripe, Inc. (San Francisco, US): payment processing. Handles credit card data and billing. Data processed: payment details, billing email, transaction history. DPA: included in Stripe's service agreement.
• •Supabase, Inc. (San Francisco, US): database, authentication, and file storage. Data processed: all account and application data. DPA: included in Supabase's terms of service. Data hosted in EU (Frankfurt).
• •Vercel, Inc. (San Francisco, US): application hosting and edge network. Data processed: request metadata, IP addresses, server logs. DPA: included in Vercel's data processing addendum.
• •marketing:openai
• •Anthropic, PBC (San Francisco, US): AI content analysis and rewriting. Data processed: pitch deck text content sent for AI analysis, scoring, and suggestions. Anthropic does not use API data for training. DPA: Anthropic's commercial terms of service apply.
• •Amazon Web Services EMEA SARL (Luxembourg; servers in Stockholm, EU): email delivery through Amazon SES. Data processed: email addresses, email content. DPA: AWS GDPR Data Processing Addendum.
• •Glyphex: privacy-focused website analytics. Data processed: anonymized page views, referrer, browser type, and country. No cookies are used and no personal data is collected. Data is not shared with third parties.

All sub-processors maintain SOC 2 compliance or equivalent security certifications. We review our sub-processor list periodically and will update this page if changes are made.

Server Logs and IP Addresses

Our hosting provider (Vercel) automatically collects server access logs that may include your IP address, browser type, and request timestamps. These logs are used for security monitoring and debugging, and are automatically deleted after 30 days. We do not use IP addresses for tracking or profiling.

7. Your Rights

Under GDPR, you have the right to:

• •Access Your Data
• •Request Correction or Deletion
• •Withdraw Consent
• •File a Complaint With Your Local Data Protection Authority

To exercise your rights, email [email protected].

8. Cookies

We don't use tracking cookies. If analytics are used, they are anonymized and cookie-free.

9. Changes

We may update this policy. If we make significant changes, we'll notify users on the site.