Privacy & Policy

A. Information You Provide Directly

We collect information you provide when you register, subscribe, or communicate with us, including:

• Name
• Email address
• Company or brand details
• Social media or creator handles (e.g. Instagram, TikTok, YouTube)
• Payment details (processed securely via Stripe)
• Messages, support requests, or forms you submit

B. Information Collected Automatically

When you use our Services, we automatically collect:

• IP address and device identifiers
• Browser type and version
• Pages visited, features used, and session duration
• Log files, crash reports, and usage analytics
• Cookies and tracking technologies

C. Google account connection (Gmail)

Pitchlo lets you connect your Google account so outreach emails you write are sent from your own address rather than ours. We ask Google for one Gmail permission, gmail.send, which allows sending only. Google’s sign-in also shares the email address of the account you choose (the openid and email permissions); we use it only to show which account is connected and to send from that address.

We cannot read your email. We do not request, and have not been granted, any permission to read, search, download, or list the contents of your mailbox, your metadata, or your settings. No Pitchlo feature reads your Gmail.

When you connect your account we store: an access credential (refresh token), encrypted at rest with AES-256-GCM; the Google email address you connected; the token’s expiry time; the date you connected; and the permission granted. The credential is never written to logs and is never sent to your browser.

A message is sent only when you click send on a pitch you have composed. Pitchlo never sends email from your account automatically, on a schedule, or in the background.

You can disconnect at any time in Settings → Email. Disconnecting deletes the stored credential from our database and revokes Pitchlo’s access at Google.

We use artificial intelligence in several features, including to help creators draft pitch and application text. These drafts are generated by Anthropic (Claude), accessed through Anthropic’s commercial API. No data obtained through your Google account connection is ever sent to Anthropic or to any other AI provider. The Gmail permission we request (gmail.send) does not allow us to read, search, list or download anything in your mailbox, and the email address connected for sending is never included in an AI request. Google user data is not used, transferred or sold to create, train or improve any machine learning or artificial intelligence model, whether foundational or generalised.

Pitchlo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

D. Payment Information

All payments are processed by Stripe or other secure processors. We do not store full card details.

A. What we access, per platform

Instagram (Instagram API with Instagram Login, available for Instagram professional accounts): with the instagram_business_basic permission we read your account ID, username, account type, profile picture, follower count, and media count, and, for posts you add to your portfolio, the media ID, media type, thumbnail or image URL, and permalink. If we request the instagram_business_manage_insights permission, it will appear on Instagram’s consent screen and we use it only to read performance metrics for your own account and your own media, to display on your portfolio.

TikTok (Login Kit and Display API): with user.info.basic we read your TikTok open ID, display name, and avatar; with user.info.profile, your username, profile link, bio, and verification status; with user.info.stats, your follower, following, likes, and video counts; and with video.list, the ID, cover image, title, and share link of your own public videos, so we can show the right cover on videos you add to your portfolio.

YouTube (YouTube Data API, youtube.readonly scope): we read your channel ID, channel name, handle or custom URL, channel thumbnail, subscriber count, and video count, and, for your own videos you add to your portfolio, the video ID, title, thumbnail, and link. We do not upload, edit, delete, rate, or comment on videos, and we do not manage your channel.

B. How we store it

Access and refresh tokens issued by Instagram, TikTok, or Google are encrypted at rest with AES-256-GCM, are never written to logs, and are never sent to your browser. The profile basics, counts, thumbnails, and links listed above are stored with your Pitchlo profile. Follower counts and the videos you choose to add are shown on your public creator portfolio; everything else is visible only to you and to Pitchlo staff who need it to operate the Services.

C. Sharing

We do not sell data from connected accounts, we do not use it for advertising or ad targeting, and we do not share it with third parties other than the service providers that host and operate Pitchlo on our behalf (see Section 6), who may process it only to provide the Services. We do not use it to build profiles of you for any purpose other than your Pitchlo portfolio.

D. Retention, disconnecting, and deletion

We keep data from a connected account only while the account remains connected. You can disconnect any account at any time in the Pitchlo app under Profile → Socials. Disconnecting immediately deletes the stored tokens and the related profile data and counts; any remaining copies in backups are removed within 30 days. Cover images you have already added to your portfolio stay part of your portfolio until you remove them.

You can also request deletion of this data at https://app.pitchlo.com/data-deletion or by emailing privacy@pitchlo.com. We complete deletion requests within 30 days.

If you remove Pitchlo’s access from within Instagram, TikTok, or Google instead, we treat it the same as disconnecting. We honour Meta’s deauthorization and data deletion callbacks: when Meta notifies us that you removed Pitchlo or asked for your data to be deleted, we delete the stored tokens and related data within 30 days.

E. Google and YouTube

Pitchlo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This applies to both the YouTube connection described here and the Gmail connection described in Section 2C.

Pitchlo uses YouTube API Services. By connecting your YouTube account you agree to be bound by the YouTube Terms of Service, and Google’s handling of your information is described in the Google Privacy Policy.

In addition to disconnecting in Pitchlo, you can revoke Pitchlo’s access to your Google account (including YouTube and Gmail) at any time from your Google security settings at https://security.google.com/settings/security/permissions.

F. Meta and TikTok

Our use of Instagram data follows the Meta Platform Terms, and our use of TikTok data follows the TikTok Developer Terms of Service. Meta and TikTok process your information under their own privacy policies. Pitchlo is not affiliated with, endorsed by, or sponsored by Meta, Instagram, TikTok, Google, or YouTube.

To exercise any of these rights, contact us at hello@pitchlo.com. We will respond within 30 days.

You can opt out of marketing emails at any time by clicking “unsubscribe” or contacting us directly.

These third parties are bound by data protection and confidentiality obligations.

AI processing

Anthropic PBC (United States) — AI text generation. We use Claude, via Anthropic’s commercial API, for drafting and content features across the service, including pitch and application drafts, lifecycle and transactional email drafts, and the processing of publicly posted job listings. Under Anthropic’s commercial terms, inputs and outputs submitted through their API are not used to train their models. We use no other AI provider, and no AI gateway, aggregator or model hub.

No system is entirely secure, but we take reasonable steps to protect your information.

When no longer required, your information will be securely deleted or anonymised. You may request deletion at any time (see Section 10). Data from connected social accounts is kept only while the account is connected, as described under Connected Social Accounts.

To exercise these rights, contact us at privacy@pitchlo.com. We may request proof of identity before fulfilling your request.

Opt out of the “sale” or “sharing” of your personal information (we do not sell data) To make a request, email privacy@pitchlo.com with the subject line “California Privacy Request.”

You may unsubscribe from marketing communications at any time.