1. Introduction
PitchFit L.L.C-FZ ("PitchFit", "we", "us", or "our") is committed to protecting your privacy and handling all user data with international best-practice confidentiality and security mechanisms. This Privacy Policy explains how we collect, use, disclose, store, and protect personal data and Customer Content when you use our websites and our subscription products, Ask and Insights (collectively, the "Services").
PitchFit is a Limited Liability Company licensed in the Meydan Free Zone, Dubai, United Arab Emirates (Licence No. 2526573.01). This Policy is designed to align with global best practices, including the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
By using the Services, you acknowledge that you have read this Policy. Where required by law, we rely on a lawful basis (described below) or your consent to process personal data.
2. Who Is Responsible for Your Data (Controller / Processor)
For personal data about your use of the Services (such as account and billing data), PitchFit acts as a data controller. For Customer Content that you upload and process through the Services - including financial statements you add to Insights - PitchFit acts as a data processor (or service provider) and processes that content only on your instructions and to provide the Services. Where you upload personal data within Customer Content, you are the controller of that data and are responsible for having a lawful basis to provide it to us.
3. Information We Collect
3.1 Information you provide
- Account data: name, email address, organization, role, and login credentials.
- Billing data: subscription plan, billing contact, and payment information (processed by our payment providers; we do not store full card numbers).
- Communications: messages, support requests, and feedback you send us.
3.2 Customer Content
Financial statements, documents, files, queries, and other materials you upload or generate within the Services, including statements you add to Insights for standardization and comparison. Customer Content may include data about companies and, in some cases, individuals. It is stored within your Instance.
3.3 Information collected automatically
- Usage data: features used, actions taken, and timestamps.
- Device and log data: IP address, browser type, device identifiers, and diagnostic logs.
- Cookies and similar technologies: used to operate the Services, remember preferences, and measure performance (see Section 10).
4. Google User Data (Google Workspace APIs)
This Section applies to data PitchFit receives from Google APIs when you choose to connect a Google account to the Services. It supplements the rest of this Policy. Where any other provision of this Policy would permit a use of Google user data that this Section does not, this Section controls.
"Google user data" means data PitchFit obtains through Google APIs under the scopes listed in Section 4.2, and includes both the raw data obtained from those scopes and any data aggregated, anonymized, or derived from it.
4.1 Limited Use affirmative statement
PitchFit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy).
4.2 What we access, and why
Connecting a Google account is optional and is not required to use the Services. We request the narrowest scopes that support the features described below, we request them in context at the point the feature is used, and we access Google user data only after you grant consent on Google's own OAuth consent screen. We do not request access to data for features we have not built.
| OAuth scope | What it gives us access to | Why we need it | Classification |
|---|---|---|---|
| .../auth/calendar.events | View and edit events on all your calendars | PitchFit can create reminders or invites using your Google Calendar, requiring the calendar.events scope to create, read, and update events on behalf of the user. | sensitive |
4.3 No AI or ML training on Google user data
PitchFit does not use, transfer, or sell Google user data to create, train, fine-tune, or improve any generalized, foundational, or frontier machine learning or artificial intelligence model. This applies to our own models and to any third party's models. Google user data is not stored in conjunction with any such model, and is not used to build training corpora, evaluation sets, benchmarks, or persistent embeddings indexes.
This restriction applies equally to raw Google user data and to data aggregated, anonymized, or derived from it.
Embeddings, extracted text, table structure, and any other representation computed from Google user data are themselves treated as Google user data under this Policy and are subject to every restriction in this Section.
4.4 How AI features process Google user data
Certain user-facing features, including Ask, use large language models to produce an answer to a question you have asked. Where you direct such a feature at content from a connected Google account:
- Google user data is transmitted to the AI providers listed in Section 4.5 solely to execute the specific request you made;
- where retrieving the relevant passage requires it, text is converted into vector embeddings. Embeddings computed from Google user data are held in memory for the duration of the request and are not written to any vector store, search index, or other persistent location;
- the resulting output is returned to you within your Instance;
- Google user data is not co-mingled with the data of other customers, and is not used to tune, personalize, or improve any model that serves other customers;
- each provider listed in Section 4.5 is engaged through its commercial API under an organization account, not a consumer subscription, on terms that prohibit the provider from training its models on data we submit. We are not enrolled in any opt-in data-sharing or model-improvement programme with either provider.
If we are no longer able to make the commitment in the final bullet above for a given provider, we will stop transmitting Google user data to that provider.
4.5 Third-party AI sub-processors
The following third-party AI providers may process Google user data to deliver the features described in Section 4.4. This is a complete list.
| Provider | Service and tier | What it is used for | Provider's training commitment |
|---|---|---|---|
| Anthropic, PBC | Claude API (first-party), commercial pay-as-you-go tier | Reasoning and answer generation in Ask. Vision-based extraction of text and table structure from statement documents in Insights. | Anthropic's Commercial Terms of Service state that Anthropic may not train models on Customer Content submitted through the Services. |
| OpenAI, L.L.C. | Embeddings API, commercial pay-as-you-go tier | Converting text into vector embeddings so the passages relevant to your question can be retrieved. | OpenAI states that data sent to the OpenAI API is not used to train or improve its models unless the customer explicitly opts in. PitchFit has not opted in. |
Both providers are accessed through commercial APIs under PitchFit organization accounts, never through consumer subscriptions. Each provider may retain a request briefly in its own abuse-monitoring logs under its security policies, by default for up to 30 days in each case. That retention serves the provider's security purposes only and is not used to train or improve any model.
4.6 What we never do with Google user data
Consistent with the Limited Use requirements, we do not:
- transfer or sell Google user data to third parties such as advertising platforms, data brokers, or information resellers;
- transfer, sell, or use Google user data to serve advertising of any kind, including retargeted, personalized, or interest-based advertising;
- transfer, sell, or use Google user data to determine credit-worthiness or for lending purposes;
- transfer, sell, or use Google user data to create, train, or improve any machine learning or artificial intelligence model beyond the user-facing feature you directed;
- include Google user data in the aggregated or de-identified data described in Section 5;
- scrape Google user data, or create permanent copies or databases of Google user data beyond what is necessary to provide the feature you directed.
We transfer Google user data only: to provide or improve the user-facing features described in Section 4.2 and with your consent; for security purposes, such as investigating abuse; to comply with applicable laws or regulations; or as part of a merger, acquisition, or sale of assets, and in that case only after obtaining your explicit prior consent.
4.7 Human access to Google user data
We do not allow humans to read Google user data, except:
- where you have given, and we have documented, your explicit consent for us to read specific data, for example to resolve a support request you raised;
- where the data, including any derivations, has been aggregated and anonymized and is used only for internal operations in accordance with applicable law, and never to train or improve any AI or ML model;
- where it is necessary for security purposes, such as investigating abuse; or
- to comply with applicable laws or regulations.
Access is restricted to named personnel on a least-privilege basis and is logged.
4.8 Storage, retention, and deletion of Google user data
- Google user data is stored within your Instance, logically separated from other customers.
- Google user data is encrypted in transit over secure modern protocols and at rest using industry accepted encryption standards.
- OAuth access tokens and refresh tokens are encrypted at rest, are held in a dedicated key management system, and are never exposed to other customers or to third parties.
- We retain Google user data only for as long as is necessary to provide the feature you directed.
You can end our access to your Google account at any time:
- in your Google Account, by removing PitchFit at https://myaccount.google.com/permissions, which immediately ends our ability to call Google APIs on your behalf; or
- by writing to hey@pitchfit.ai, and we will disconnect the integration and delete the Google user data held in your Instance.
Following disconnection, revocation, unsubscription, or Account deletion, we stop accessing Google APIs and delete Google user data held in your Instance within 60 days, other than residual copies in routine backups, which are overwritten in the ordinary backup cycle, and any records we are required to retain by law.
4.9 Changes to how we use Google user data
If we intend to access a type of Google user data not disclosed in Section 4.2, or to use Google user data for a purpose not disclosed in this Section, we will update this Policy and prompt you to consent before we do so.
5. How We Use Information
We use information to:
- provide, operate, maintain, and secure the Services, including processing and standardizing financial statements and generating comparisons within Insights;
- create and manage your Account and Subscription, and process payments;
- provide customer support and respond to your requests;
- monitor, troubleshoot, and improve performance, reliability, and security, and prevent fraud or abuse;
- develop and improve the Services using aggregated or de-identified data that does not identify you or any individual or company. This use expressly excludes Google user data. Data obtained from Google APIs, whether raw, aggregated, anonymized, or derived, is never used to develop, train, or improve any generalized or foundational AI or ML model, and is never included in the aggregated or de-identified data described in this bullet (see Section 4);
- send service, security, and administrative communications, and, where permitted, relevant product updates (you may opt out of marketing at any time); and
- comply with legal obligations and enforce our Terms.
6. Legal Bases for Processing (GDPR / UK GDPR)
Where the GDPR or UK GDPR applies, we process personal data on one or more of the following legal bases:
- Contract: to provide the Services you have subscribed to.
- Legitimate interests: to secure, improve, and promote the Services, balanced against your rights.
- Consent: where required, for example for certain cookies or marketing; you may withdraw consent at any time.
- Legal obligation: to comply with applicable laws, including accounting and tax requirements.
7. How We Share Information
We do not sell your personal data. We do not "sell" or "share" personal data for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. We do not sell or transfer Google user data to any third party, including advertising platforms, data brokers, and information resellers; Section 4 governs all disclosure of Google user data. We disclose information only as follows:
- Service providers (sub-processors): trusted vendors who host, process, or support the Services (for example, cloud hosting, payment processing, analytics, customer support, and the AI providers listed in Section 4.5) under contractual confidentiality and data-protection obligations, including a contractual prohibition on training models using data we submit. A list of our sub-processors, including each AI provider and the service tier we use, is available on request.
- Within your organization: with authorized users of your Account.
- Legal and safety: where required by law, regulation, legal process, or to protect rights, safety, and the integrity of the Services.
- Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy. Where such a transfer would include Google user data, we will obtain your explicit prior consent before the transfer, as required by the Google API Services User Data Policy.
8. International Data Transfers
PitchFit operates globally and may process and store information in countries other than your own, including the UAE, the United States, and the European Union. Where we transfer personal data across borders, we implement appropriate safeguards required by applicable law, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent mechanisms under the UAE PDPL, together with technical and organizational measures to protect the data.
9. Data Retention and Deletion
We retain personal data and Customer Content only for as long as necessary to provide the Services and for the purposes described in this Policy.
Customer Content: including financial statements added to Insights, is stored within your Instance and is deleted when your Account is unsubscribed or deleted. Retention and deletion of Google user data is governed by Section 4.8.
Account and billing data: We may retain limited account and transaction records for as long as needed to comply with legal, tax, accounting, and audit obligations.
Backups: Residual copies may persist in routine, secure backups for a limited period before being overwritten in the ordinary course.
On request, and subject to legal retention requirements, we will delete or return personal data we process on your behalf.
10. Cookies and Tracking Technologies
We use cookies and similar technologies to operate the Services, keep you signed in, remember your preferences, and understand usage so we can improve performance. You can control non-essential cookies through your browser settings or, where provided, our cookie banner. Disabling certain cookies may affect functionality. Where required, we obtain consent before placing non-essential cookies.
11. Data Security
We apply international best-practice technical and organizational measures to protect personal data and Customer Content, including encryption in transit and at rest where appropriate, access controls and least-privilege principles, logical separation of customer Instances, network and application security controls, monitoring and logging, and regular review of our security practices. No system is completely secure; in the event of a personal data breach affecting your rights, we will notify affected parties and the relevant authorities as required by applicable law.
12. Your Privacy Rights
12.1 GDPR / UK GDPR rights
Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.
12.2 CCPA/CPRA rights (California residents)
Subject to applicable law, you have the right to know what personal information we collect and how it is used and disclosed, to access and delete it, to correct inaccurate information, and to non-discrimination for exercising your rights. As noted above, we do not sell or share personal information for cross-context behavioral advertising.
12.3 UAE PDPL rights
Subject to applicable law, you have rights to access your personal data, request correction or erasure, restrict or object to processing, request portability, and withdraw consent, in accordance with the UAE PDPL.
To exercise any of these rights, contact us at hey@pitchfit.ai. We will respond within the timeframes required by applicable law and may need to verify your identity before acting on a request.
13. Children's Privacy
The Services are intended for business and professional use and are not directed to children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us personal data, please contact us and we will take appropriate steps to delete it.
14. Third-Party Links and Sources
The Services may link to or process data from third-party websites and publicly available sources. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies. Publicly available financial statements processed through the Services remain subject to the rights and terms of their respective sources.
15. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice (for example, by email or in-product notice) and update the effective date above. Your continued use of the Services after the changes take effect constitutes acceptance of the updated Policy.
16. Contact Us
For privacy questions or to exercise your rights, contact us at hey@pitchfit.ai.
PitchFit L.L.C-FZ - Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Licence No. 2526573.01.