Compliant with GDPR · ePrivacy Directive · ISO/IEC 27001:2022
This Cookie Policy explains what cookies and similar technologies PitchFlow uses, why we use them, and how you can control them. It should be read alongside our Privacy Policy.
Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device on subsequent visits and to store information about your preferences or actions.
Similar technologies include:
This policy covers all such technologies, collectively referred to as "cookies" unless specified otherwise.
PitchFlow uses four categories aligned with the IAB Europe Transparency and Consent Framework (TCF 2.2) and GDPR Article 6.
Legal basis: Legitimate interest / ePrivacy Directive Article 5(3) exemption
Essential to enable you to use PitchFlow. You cannot opt out while using the Service.
| Cookie Name | Purpose | Duration | Type | Provider |
|---|---|---|---|---|
| pf_access_token | JWT access token — authenticates your session | 15 minutes | HttpOnly Cookie | PitchFlow |
| pf_refresh_token | JWT refresh token — issues new access tokens | 7 days | HttpOnly Cookie | PitchFlow |
| __Host-pf_csrf | CSRF protection token | Session | HttpOnly Cookie | PitchFlow |
| pf_cookie_consent | Stores your cookie consent choice | 12 months | Cookie | PitchFlow |
All PitchFlow authentication cookies are HttpOnly (not accessible to JavaScript), Secure (HTTPS only), and SameSite=Lax to mitigate CSRF attacks.
Legal basis: Consent (GDPR Art. 6(1)(a))
Allows PitchFlow to remember your preferences. If declined, you can still use the core Service.
| Cookie Name | Purpose | Duration | Provider |
|---|---|---|---|
| pf_lang | Remembers your preferred language | 12 months | PitchFlow |
| pf_tone | Remembers your last selected proposal tone | 12 months | PitchFlow |
| pf_platform | Remembers your last selected platform | 12 months | PitchFlow |
Legal basis: Consent (GDPR Art. 6(1)(a))
Helps us understand how visitors interact with PitchFlow. Data is aggregated and anonymised. PitchFlow does not use Google Analytics. Vercel Analytics is privacy-first and does not use cross-site tracking or fingerprinting.
| Cookie Name | Purpose | Duration | Provider |
|---|---|---|---|
| _vercel_analytics | Aggregated page-view analytics | Session | Vercel Analytics |
| pf_feature_usage | Records which features are used (anonymised) | 30 days | PitchFlow |
Legal basis: Consent (GDPR Art. 6(1)(a)) — would be required
PitchFlow does not use third-party advertising or marketing cookies. If this changes in the future, we will update this Policy, seek fresh consent, and provide explicit opt-in controls before any marketing cookies are set.
| Third Party | Purpose | Category | Opt-Out |
|---|---|---|---|
| Google OAuth | Social login authentication | Strictly Necessary (when used) | Don't use Google login |
| Zoho SalesIQ | Live support chat widget | Functional (consent required) | Decline functional cookies / close chat widget |
| Paystack | Payment checkout iframe | Strictly Necessary (checkout only) | Don't initiate checkout |
Third-party cookies are governed by those parties' own policies:
When you first visit pitchflowapp.com, a consent banner is displayed. The banner:
Silence, scrolling, or continued browsing does NOT constitute consent, in line with GDPR Recital 32 and the Planet49 (C-673/17) judgment.
When you provide or deny consent, PitchFlow records:
Consent records are retained for 3 years for GDPR accountability compliance (Article 5(2)).
You can update your preferences at any time by clicking Cookie Settings in the footer of any PitchFlow page. Withdrawing consent will not affect the lawfulness of processing based on consent before withdrawal.
Your consent is stored for 12 months. After 12 months, or whenever we update this policy with material changes to cookie usage, we will re-show the banner and ask for fresh consent.
| Property | Implementation |
|---|---|
| Trigger | First visit; after 12 months; after policy version change |
| Pre-consent state | No non-essential cookies set — analytics and functional blocked |
| Accept All | Accepts all categories; records consent with timestamp |
| Reject All | Rejects all non-essential; records rejection with timestamp |
| Manage Preferences | Opens granular panel with per-category toggles |
| Banner dismissal | Only via explicit button click — not scroll, click-outside, or timeout |
| Accessibility | WCAG 2.1 AA — keyboard navigable, ARIA-labelled, screen reader compatible |
| Consent storage | localStorage key: pitchflow_cookie_consent (JSON with version + timestamp) |
| Re-prompt | On policy version change — bump CONSENT_VERSION in CookieConsent.tsx |
| Category | Description | Default State |
|---|---|---|
| Strictly Necessary | Core functionality — login, session, CSRF. Cannot be disabled. | Always ON — locked |
| Functional | Language, tone, and platform preferences. | OFF (requires opt-in) |
| Analytics | Aggregated usage data. No cross-site tracking. | OFF (requires opt-in) |
| Marketing | Not currently used by PitchFlow. | OFF — unavailable |
| Browser | Path |
|---|---|
| Google Chrome | Settings → Privacy and Security → Cookies and other site data |
| Mozilla Firefox | Settings → Privacy & Security → Cookies and Site Data |
| Apple Safari | Preferences → Privacy → Manage Website Data |
| Microsoft Edge | Settings → Cookies and Site Permissions → Cookies and Site Data |
| Opera | Settings → Advanced → Privacy & Security → Site Settings → Cookies |
Note: blocking all cookies will prevent you from staying logged in to PitchFlow.
PitchFlow honours the "Do Not Track" (DNT) browser signal. If your browser sends DNT=1, we will not set analytics or functional cookies regardless of your stored consent preference. Note that third-party services embedded in PitchFlow may not honour DNT signals.
In accordance with GDPR Article 35, PitchFlow has conducted a DPIA for its cookie and tracking practices. Key findings:
The full DPIA is available to supervisory authorities on request.
| Control ID | Control Name | How Applied |
|---|---|---|
| A.5.34 | Privacy and PII protection | Consent obtained before non-essential cookies; data minimisation applied |
| A.8.10 | Information deletion | Cookie data deleted on consent withdrawal; TTLs enforced |
| A.5.36 | Compliance with policies | Cookie policy reviewed annually; version-controlled |
| A.8.2 | Privileged access rights | Cookie consent logs accessible only to authorised compliance staff |
| A.5.14 | Information transfer | Third-party cookie data transfer governed by DPA agreements |
| A.6.8 | Information security event reporting | Cookie-related breaches reportable under incident management |
When we introduce new cookies or change providers, we will:
Privacy / cookie questions: privacy@pitchflowapp.com
Data Protection Officer: dpo@pitchflowapp.com
Change cookie preferences: click Cookie Settings in the footer of any page
Last reviewed: 4 June 2026 · Next scheduled review: 4 June 2027 · Policy certified accurate at time of publication.