Privacy Policy

The short version: We collect only what we need to run PitchFlow. We do not sell your data. We do not use your data for advertising. Your generated proposals belong to you. You can delete your account and all associated data at any time.

1. Who We Are & Our Role

PitchFlow is a product built and operated by Moses Sifuna, trading as PitchFlow, headquartered in Bungoma, Kenya ("PitchFlow", "we", "us", "our").

For the purposes of data protection law — including the EU General Data Protection Regulation (GDPR) and the UK GDPR — PitchFlow is the Data Controller for personal data collected through pitchflowapp.com and our related services. This means we determine why and how your personal data is processed.

Where we engage third-party service providers ("sub-processors") to process personal data on our behalf — such as Supabase for database storage or OpenAI for AI generation — we remain responsible for ensuring that processing complies with this Privacy Policy and applicable law.

For all privacy-related enquiries, contact us at privacy@pitchflowapp.com.

2. Personal Data We Collect

2.1 Data You Provide Directly

2.2 Data Collected Automatically

When you use PitchFlow, we automatically collect certain technical data:

• Usage data — proposals generated, tones selected, platforms chosen, features used, session duration
• Device & browser data — browser type and version, operating system, device type
• Network data — IP address (used primarily for rate limiting and fraud prevention, not for tracking)
• Log data — server logs, error reports, request timestamps
• Cookies & local storage — see Section 8 below for details

2.3 Data From Third Parties

If you register or log in using Google OAuth, we receive your name and email address from Google as permitted by your Google account privacy settings. We do not receive your Google password.

2.4 Data We Do Not Collect

• Full payment card numbers, CVVs, or bank account details (handled exclusively by Paystack)
• Government-issued ID numbers
• Sensitive personal data (racial origin, health data, political opinions, etc.) — please do not include these in your proposals or profile

3. Legal Bases for Processing GDPR

For users in the EU and UK, we process your personal data under one of the following legal bases as required by the GDPR:

Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms as a data subject.

4. How We Use Your Data

We use your personal data for the following purposes:

• Service operation — creating and managing your account, authenticating your login, providing proposal generation, saving proposal history, and enabling team features on Agency plans
• Profile pre-fill — using your profile data (skills, experience, bio) to personalise and improve the quality of generated proposals
• Billing & subscriptions — managing your subscription, processing payments through Paystack, sending receipts and billing notices
• Transactional communications — sending account verification emails, password reset links, billing confirmations, and usage alerts (e.g. approaching Free plan limits)
• Security & fraud prevention — rate limiting, detecting abuse, preventing unauthorised account access, investigating suspicious activity
• Product improvement — analysing aggregated or anonymised usage patterns to improve prompts, generation quality, and platform features. We do not use the specific content of your proposals for AI training without your explicit consent.
• Customer support — responding to your enquiries and resolving issues
• Legal compliance — meeting our obligations under applicable laws, responding to lawful requests from authorities

We do not use your data for targeted advertising, sell it to data brokers, or share it with third parties for their own marketing purposes.

5. AI Processing & Your Content

5.1 What We Send to AI Providers

When you generate a proposal, the job description and profile details you provide are sent to our AI provider (OpenAI), which also writes any follow-up message, to generate a draft. This data is transmitted securely over HTTPS. Your name and email are not included in these requests unless they appear in the content you paste.

5.2 AI Provider Data Policies

OpenAI processes your input content under its API terms and data policy. As of the effective date of this policy, OpenAI does not use API input data to train its models by default. We recommend reviewing its current policy for the latest information:

• OpenAI API data usage: openai.com/policies/api-data-usage-policies

5.3 Ownership of Generated Proposals

You own all proposals generated through PitchFlow. We do not claim any rights over your generated content. Stored proposals in your history are retained to provide the Service and are deleted when you delete your account.

6. When We Share Your Data

We share personal data only in the following limited circumstances:

6.1 Sub-processors

We share data with our service providers to operate PitchFlow (see Section 14 for the full list). These providers act as data processors and may only use your data to provide services to us.

6.2 Agency Team Members

If you are on an Agency plan, your name and email address may be visible to the account owner who invited you to their team workspace.

6.3 Legal Requirements

We may disclose your data if required to do so by law, court order, or other governmental authority, or where we believe disclosure is necessary to protect the rights, property, or safety of PitchFlow, our users, or the public.

6.4 Business Transfers

In the event PitchFlow is acquired, merged, or its assets are transferred, your personal data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6.5 What We Never Do

• Sell your personal data to any third party
• Share your data for third-party advertising purposes
• Disclose your generated proposals to other users or the public

7. International Data Transfers

PitchFlow is operated from Kenya. When you use our Service, your data may be transferred to and processed in countries other than your own, including:

• European Union — Supabase database hosting (EU region)
• United States — OpenAI (AI generation), Vercel (hosting & CDN), Resend (email), Upstash (caching), Google (OAuth)

For transfers of personal data from the EU/UK to countries not covered by an adequacy decision (including the United States and Kenya), we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission where applicable, and by ensuring that our sub-processors maintain equivalent protections under their own DPA-compliant terms.

You may request details of the transfer mechanisms we rely on by contacting privacy@pitchflowapp.com.

8. Cookies & Tracking Technologies

8.1 What We Use

8.2 What We Do Not Use

• Third-party advertising or tracking cookies (e.g. Google Ads, Meta Pixel)
• Behavioural profiling cookies
• Cross-site tracking technologies

8.3 Managing Cookies

Essential cookies are required for the Service to function. You can disable cookies in your browser settings, but doing so may prevent you from logging in or using core features. As we do not use non-essential or advertising cookies, there is no cookie consent banner to manage for those categories.

For more information on cookies, see our Cookie Policy.

9. Data Storage & Security

9.1 Where Your Data Is Stored

User account data is stored in Supabase (PostgreSQL), hosted in the EU region. Proposal content, history, and profile data are stored in the same database. Cached session data is stored in Upstash (Redis) for rate limiting.

9.2 Security Measures

We implement the following security controls:

• Password hashing — all passwords are hashed with bcrypt and are never stored in plain text
• JWT sessions — short-expiry access tokens stored in httpOnly cookies, not accessible to browser JavaScript
• Row Level Security (RLS) — database-level policies ensure users can only access their own data
• Transport encryption — all data transmitted over HTTPS/TLS
• Encryption at rest — where supported by the hosting provider
• Rate limiting — API and generation endpoints are rate-limited to prevent abuse
• Access controls — internal access to production data is restricted on a need-to-know basis

9.3 Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected users without undue delay and, where required by law, notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

9.4 Limitations

No system is 100% secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security. We encourage you to use a strong, unique password and to keep your account credentials confidential.

10. Data Retention

To delete your account, go to your account settings or email privacy@pitchflowapp.com. Note that billing records are retained for legal compliance even after account deletion.

11. Your Rights — EU & UK Users GDPR

If you are located in the European Union or United Kingdom, you have the following rights under GDPR and UK GDPR:

To exercise any of these rights, email privacy@pitchflowapp.com or contact our Data Protection Officer at dpo@pitchflowapp.com. We will respond within 30 days. We may ask you to verify your identity before processing your request. Exercising your rights is free of charge.

EU residents also have the right to lodge a complaint with your local supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu. UK residents may contact the ICO at ico.org.uk.

12. Your Rights — California Residents CCPA

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know — request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell
• Right to Delete — request deletion of personal information we have collected from you
• Right to Correct — request correction of inaccurate personal information
• Right to Opt-Out of Sale — we do not sell personal information; this right is not applicable, but we will never sell your data
• Right to Non-Discrimination — we will not discriminate against you for exercising any of these rights

To exercise your CCPA rights, contact us at privacy@pitchflowapp.com. We will respond within 45 days as required by law.

13. Your Rights — All Users

Regardless of where you are located, you may:

• Access your data — view your profile, proposals, and billing history from your account dashboard
• Correct your data — update your profile and account information at any time from your settings
• Delete your account — permanently delete your account and all associated personal data from your account settings or by emailing us
• Unsubscribe from emails — opt out of non-essential email communications using the unsubscribe link in any email we send you
• Port your proposals — download your saved proposals from the proposal history section at any time

14. Third-Party Services & Sub-processors

We use the following third-party services to operate PitchFlow:

Each of these providers has its own privacy policy and data processing terms. We maintain data processing agreements with sub-processors and review them for compliance where required. We do not authorise sub-processors to use your data for their own purposes beyond what is necessary to provide their services to us.

15. Children's Privacy

PitchFlow is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us at privacy@pitchflowapp.com and we will delete it promptly.

16. Links to Third-Party Websites

PitchFlow may contain links to external websites or services that we do not operate. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policy of any third-party site you visit.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make significant changes, we will:

• Update the "Effective Date" and "Version" at the top of this page
• Notify registered users by email at least 14 days before material changes take effect
• Display a prominent notice within the Service

For non-material changes (corrections, clarifications), we will update the policy without individual notice. Continued use of PitchFlow after the effective date of a revised policy constitutes your acceptance of the changes.

18. Contact & Data Protection Officer

We aim to respond to all privacy-related enquiries within 5 business days.