Privacy Policy

This Privacy Policy explains how Pitchanite ("Pitchanite", "we", "us", or "our") collects, uses, stores, and protects your information when you use our website and platform (the "Service"). Pitchanite is operated by Threepoints Lab Ltd, a company registered in England and Wales, with its registered office at 5 Brayford Square, London, England, E1 0SG.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Who We Are

Pitchanite is an outreach platform that helps content creators and micro-influencers find brands, write personalised pitch emails, send those emails from their own connected email account, and track replies. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Threepoints Lab Ltd is the data controller responsible for your personal data.

2. Information We Collect

Account information

When you create an account we collect your name, email address, and profile details you provide, such as your creator niche, audience information, and the persona details you set up for your pitches.

Google account information

If you connect your Google account, we access certain data through Google's APIs strictly to provide the Service. This is described in detail in Section 4 below.

Usage information

We collect information about how you use the Service, including campaigns you create, brands you add to campaigns, emails you send through the platform, and aggregate performance metrics such as delivery counts and reply rates.

Technical information

We automatically collect limited technical data such as device and browser type, IP address, and log data, used to operate, secure, and improve the Service.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Send pitch and follow-up emails from your connected email account on your instruction
• Track whether a recipient has replied, so we can calculate your reply rate and pause or manage campaigns appropriately
• Personalise pitch drafts using the persona and campaign details you provide
• Provide customer support and respond to your requests
• Send you marketing communications, such as product updates, offers, and discount codes, where you have not opted out (see below)
• Detect, prevent, and address technical issues, abuse, and deliverability problems
• Comply with our legal obligations

You can opt out of marketing emails at any time by using the unsubscribe link in any marketing email or by contacting us. Opting out of marketing does not affect essential service and account emails, such as sign-up confirmations and security notices.

4. Google User Data and Gmail Access

Scopes we request and why

When you connect your Google account, we request the following scopes, each used only to provide the features described:

• Send email (gmail.send) — to send your campaign pitches and follow-up emails from your own inbox.
• Modify messages and labels (gmail.modify) — to detect replies and bounces so we can manage follow-ups and show campaign status in your dashboard, and to apply labels that organise your sent campaign mail. Each campaign is tagged with its own sub-label under a main "Pitchanite" label in your inbox.
• Account email address (userinfo.email) — to identify which mailbox you have connected.

How we use your Google data

We use Google data solely to operate the user-facing features above: sending your emails, tracking replies and bounces, organising campaign mail with labels, and identifying your connected mailbox. We do not use it for any other purpose. Specifically, we do not:

• use your Google data for advertising, or sell or rent it;
• allow humans to read your Gmail data, except where necessary for security, to investigate abuse, to comply with the law, or for support you have specifically requested and consented to;
• use your Gmail content to train, develop, or improve artificial intelligence or machine learning models.

What we store

To provide reply detection and follow-ups, we store a limited set of data:

• Outgoing email bodies and message IDs of the campaign emails you send, so we can match and time follow-ups.
• OAuth tokens that authorise sending on your behalf, encrypted at rest using AES-256-GCM.

We do not store the content of incoming replies. Replies and bounces are checked in real time through the Gmail API and are not retained in our database. This data is stored in our MongoDB database, hosted in the European region.

5. How We Share Information

We do not sell your personal data, and we never share it for advertising purposes.

We share information only with the service providers ("sub-processors") that help us run the Service, and only to the extent necessary. These include:

• Google (Gmail API) — sending email and authenticating your connected mailbox
• MongoDB — primary database and account data storage
• Redis — queuing and short-term caching to run sending and follow-up jobs
• Vercel — hosting for the web application
• DigitalOcean — backend servers
• DigitalOcean Spaces — file and asset storage
• Stripe — payment and subscription processing
• OpenAI — generating optional AI-assisted pitch templates from your persona and website details
• Resend — transactional emails from Pitchanite (such as sign-up and account emails)
• PostHog — error and bug monitoring, to detect and fix technical problems in the Service

Each of these providers processes data on our behalf under their own security and data protection commitments. We may also disclose information where required by law, to enforce our terms, or to protect the rights, property, or safety of Pitchanite, our users, or others.

6. Data Retention and Deletion

We keep your account and stored Google data for as long as your account is active and you have Gmail connected, so we can send your campaigns and manage follow-ups. When you no longer need the Service, you can have your data removed as follows:

• Disconnecting Gmail: When you disconnect your Google account, we revoke the OAuth authorisation and purge the associated tokens and stored outgoing email data linked to that connection.
• Account deletion: You can request full deletion of your account and associated data by emailing hello@pitchanite.com. We will complete deletion within 90 days. The only exception is billing and transaction records, which we retain for up to 7 years where required to meet UK tax, accounting, and legal record-keeping obligations. These records do not include Gmail content.

Where we retain data while your account is active, we keep it only as long as necessary to provide the Service or to meet our legal obligations, after which it is deleted or anonymised.

7. How to Revoke Access

You can revoke Pitchanite's access to your Google account at any time in two ways:

• Disconnecting your Google account within the Pitchanite settings, or
• Visiting your Google Account permissions page at myaccount.google.com/permissions and removing Pitchanite.

Revoking access stops Pitchanite from sending emails or managing follow-ups through your account, and triggers the purge described above.

8. Data Security

We use appropriate technical and organisational measures to protect your data. These include encryption of data in transit using TLS, encryption of sensitive data at rest (including OAuth tokens, which are encrypted using AES-256-GCM), restricted access controls so that only authorised personnel can access systems on a need-to-know basis, and secure, access-controlled hosting environments. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Cookies and Error Monitoring

We use cookies and similar technologies that are necessary to operate the Service, such as keeping you signed in and maintaining your session. We also use PostHog to monitor for technical errors and bugs so we can fix them, which may involve cookies or similar identifiers. We do not use cookies for third-party advertising. You can control or block cookies through your browser settings, though some parts of the Service may not function properly without essential cookies.

10. Links to Other Websites

The Service may contain links to websites that are not operated by us. If you click a third-party link, you will be directed to that third party's site. We have no control over, and accept no responsibility for, the content or privacy practices of any third-party sites, and we encourage you to review their privacy policies.

11. Your Rights

Under UK GDPR, you have the right to access, correct, delete, or restrict the processing of your personal data, to object to certain processing, and to data portability. You also have the right to withdraw consent where processing is based on consent, and to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us using the details below.

12. International Transfers

Some of our service providers may process data outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses, in line with UK GDPR.

13. Children's Privacy

The Service is not intended for anyone under the age of 18, and we do not knowingly collect personal data from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Significant changes will be communicated to you where appropriate.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, contact us at:

Threepoints Lab Ltd
5 Brayford Square, London, England, E1 0SG
hello@pitchanite.com