Privacy Policy

1. Introduction

Pitchbase places great importance on protecting your personal data. This Privacy Policy describes how Pitchbase collects, uses, retains, and protects your personal data in connection with your use of the platform available at https://pitchbase.app (the "Service").

This policy complies with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and the French Data Protection Act, as amended.

2. Data controller

The controller of your personal data is:

• Pitchbase, a French simplified joint-stock company (SAS) with a share capital of €200, registered with the Brest Trade and Companies Register under number 130 520 497
• Represented by Briac Roudaut, President
• Registered office: 64 rue de la Fontaine Blanche, 29800 Landerneau, France
• Email : contact@pitchbase.app

Given the size of the organization, no Data Protection Officer (DPO) has been appointed. Any request relating to your personal data may be sent directly to the data controller at the address above.

For team and school spaces, the company or institution is the controller of its members' data, and Pitchbase acts as its processor (see section 3 bis).

3. Personal data we collect

3.1 Data you provide directly

• Account data: email address, first name, last name, profile picture (where applicable via Google OAuth), preferred language
• Professional profile data: product sold, industry, role, team size, experience level and how you heard about us (collected during in-app onboarding)
• Data about your offer: your company's website address, text you type and documents you upload (PDF, TXT, MD, HTML) to describe your offer. We read the public pages of the website you provide; for uploaded documents, only the extracted text is kept
• Content data: personas you create, simulation scenarios, account files of your training clients (see section 5 ter), transcripts of your training calls, audio recordings of simulations (kept for a maximum of 90 days)
• Payment data: no banking data is stored by Pitchbase. Payments are exclusively handled by Stripe (see sub-processors section)
• Communications: messages sent via the contact form and support requests. A message sent from the app includes your name, email, offer, space and role, language and browser, so we can answer you
• Referrals and rewards: if you take part in the program, your referral code, the accounts you referred and, for a reward, the link to your post or the text of your testimonial

3.2 Data collected automatically

• Technical data: IP address, browser type, operating system, language, time zone
• Usage data: pages visited, session duration, features used, login dates
• Simulation data: call duration, AI-generated scores, and metrics computed from the transcript (talk time, pace, filler words). Your voice is only analyzed to be transcribed: no emotion or personality trait is inferred from it
• Cookies and identifiers: see Cookies section below

3 bis. Team and school spaces

When you join a company's or a school's space, its manager and heads of sales can review your training to support you: scores, transcripts, feedback, pipeline, last sign-in date, and listen to the audio recordings of your calls (kept for 90 days at most). They can write you coaching notes, which you also see and which appear in your export. They can export this data. A notice tells you so when you join the space.

For this data, the company or school is the controller and Pitchbase acts as its processor, under the contract signed with it. The same applies to a free team space opened online by a manager or a trainer: the organisation they open it for is the controller, under the terms of service they accepted, and the same notice tells you so when you join the space. AI-generated scores are practice indicators: they are not designed to assess an employee's professional performance or to grade an exam. AI-generated scores are practice indicators: they are not designed to assess an employee's professional performance or to grade an exam.

3 ter. Artificial intelligence

Simulation prospects are played by an AI with a synthetic voice: you are told so before and during every call. Feedback and scores are produced automatically by a language model; they are indicative and may contain errors. Pitchbase takes no decision producing legal effects concerning you based solely on them (GDPR Article 22). If a piece of feedback looks wrong to you, write to us at contact@pitchbase.app.

4. Purposes of processing and legal bases

5. Sub-processors

To deliver the Service, Pitchbase relies on the following sub-processors. All are bound by contractual commitments compliant with Article 28 of the GDPR.

Transfers outside the EU: some sub-processors are located in the United States. These transfers rely on the EU-US Data Privacy Framework for certified providers (Google, Meta, Stripe, Render), and on the European Commission's Standard Contractual Clauses for the others (OpenAI, Anthropic, Deepgram, Supabase).

Resources loaded by our pages: when displaying our pages, your browser contacts font, image and library services (Google Fonts, Unsplash, jsDelivr, unpkg, esm.sh, Tailwind CDN), located in the United States or on global networks. They receive your browser's IP address; no other data is sent to them.

5 bis. Personas based on real prospects

Pitchbase lets you create a training persona from a real prospect, so you can rehearse before a meeting. Three sources are possible: information you provide yourself (a pasted profile, notes, a description), the PDF of a LinkedIn profile that you exported yourself from LinkedIn, or a copy of a prospect already saved in your workspace. Pitchbase never collects profiles automatically. The PDF is read without being kept, and its contact details (email, phone, links) are removed before analysis.

This processing relies on our legitimate interest (Article 6.1.f): it is individual, one-off and private training. The following safeguards apply:

• the text or profile you provide is never stored: only the structured persona fields and the generated preparation sheet are saved;
• generation excludes direct contact details (email address, phone number), non-professional or sensitive data, and quotations from correspondence;
• the preparation sheet is an AI-generated training fiction, never a copy of your notes or messages;
• these personas are never shared, sold, or used to train models, and do not constitute any commercial database;
• personas created to rehearse a specific meeting are deleted automatically 30 days after they are archived; the history of simulations run with them follows the retention period of your simulations.

If you are a person for whom a user has created a persona and wish to exercise your rights, please write to contact@pitchbase.app.

5 ter. Account files

For calls that follow a signed deal (client debrief, quarterly business review, expansion) and for a lost deal brought back into play, Pitchbase prepares an account file: the client's contacts, licenses and usage, tickets, commitments. This file is a training fiction generated by AI from your prospect, your offer and the calls already played. It also holds elements only the AI client knows, invented for the simulation: they are not about you and are never displayed.

If you wish, you can enrich it with your own notes (pasted text or a PDF, TXT, MD or HTML file). These notes may name real people, for example the contacts of one of your clients. The following safeguards apply:

• your notes and files are never stored: the file is read without being saved, only the rewritten account file is kept;
• email addresses and phone numbers are removed before analysis;
• the account file keeps professional information only, contacts appear by first name and surname initial, and no sentence from your notes is copied;
• the account file is visible to you only: the manager of a team or school space has no access to it (they can read call transcripts, see section 3 bis);
• the account file is deleted with the deal or with your account.

For the people named in these notes, this processing relies on our legitimate interest (Article 6(1)(f)): individual, private training, never shared or sold. If you are one of these people and wish to exercise your rights, write to us at contact@pitchbase.app.

5 quater. Video calls

Meeting stages (demo, closing, debrief, review, expansion) are played as video calls. You can turn on your camera: its image stays in your browser, it is neither transmitted to Pitchbase nor to any provider, nor recorded, nor analyzed. Nothing about your face, posture or gaze enters the feedback.

You can also share your screen (a deck, your software) so the AI prospect reacts to what you show. In that case:

• a capture of the shared screen is taken when its content changes, at reduced resolution, and sent to Anthropic (United States, Standard Contractual Clauses) to be described in a few lines to the AI prospect; no image is kept, neither by Pitchbase nor by Anthropic beyond the request;
• only the text description (title, elements, readable figures) is kept with the call transcript, where it appears as "Screen" lines; it follows the same retention as the transcript;
• sharing starts and stops by you alone, during the call; the cockpit shows "Screen shared with the AI prospect" while it is active;
• do not share a file or tool containing third-party personal data unrelated to the training (customer file, mailbox, CRM): a presentation deck or a product demonstration, including ones prepared for a real client, are allowed.

5 quinquies. Your scoring method

A quote-based team or school space can ask for its own sales method to serve as the feedback's reading grid, next to the catalogue frameworks. In that case Pitchbase sets it up on the space, from the text or document its owner sends us:

• the text or document is used only to draft the letters of the grid (what each expects from the rep); it is sent to Anthropic (United States, Standard Contractual Clauses) for that drafting, then is not kept: only the validated letters are stored on the space, and the message that carried it is deleted once the grid is in place;
• names of people and individual results it may contain are ignored: the grid only describes rep behaviours one can hear in the call, never a state, an attitude or an emotion;
• the grid does not change the AI prospect and is not an evaluation grid: it is there to practise with, like the others (see section 3 bis for what the manager sees);
• it is removed at the space's request and deleted with it.

5 sexies. Dictation

In the app, a "Dictate" button lets you speak instead of typing: to describe your offer when you sign up, correct a block of your offer, or describe a training mission.

• your voice is streamed live from your browser to Deepgram (European infrastructure, US company, Standard Contractual Clauses, training program disabled), which transcribes it; the text appears while you speak;
• neither the audio nor the text is kept by Pitchbase at this stage: the text comes back into the field and you choose whether to send it; dictation stops when you decide, and after 3 minutes at most;
• the text you send then follows the rules of the field it is written in (your offer, a mission), drafted or corrected with Anthropic as described in section 5;
• only speech is transcribed: nothing is inferred from your voice (tone, emotion, identity). The animation that follows your voice on screen reads the sound level in your browser only, without sending anything.

6. Retention periods

• Account data: retained as long as your account is active, and deleted immediately when you delete your account; our backups, kept for 7 days, then disappear
• Documents and text describing your offer: kept as long as the offer exists, deletable one by one, deleted with the account
• Simulation transcripts: retained as long as your account is active, deleted with the account
• Simulation audio recordings: 90 days maximum, then deleted automatically (deleted immediately with the account)
• Personas created to rehearse a meeting: deleted automatically 30 days after they are archived
• Account files: kept with the deal, deleted with it or with the account; the notes and files you add to them are not stored
• Video calls: your camera image is never kept; captures of the shared screen are never kept; their text description follows the transcript
• Billing data: retained for 10 years in accordance with French accounting obligations
• Technical and security logs: 12 months maximum
• Audience measurement cookies: 13 months maximum
• Commercial prospecting data: 3 years from the last contact

7. Your rights

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access: obtain a copy of all your data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): request deletion of your data
• Right to restriction of processing: temporarily suspend the use of your data
• Right to data portability: receive your data in a structured format
• Right to object: refuse certain processing (especially marketing)
• Right to withdraw consent at any time when processing is based on it
• Right to issue post-mortem directives regarding the fate of your data

To exercise these rights, contact us at contact@pitchbase.app with your specific request. A response will be provided within a maximum of one month.

If you disagree with our response, you have the right to lodge a complaint with the French Data Protection Authority (CNIL): www.cnil.fr.

8. Cookies and trackers

Pitchbase uses the following cookies and trackers:

• Strictly necessary cookies and storage: authentication, language preference, session, remembering your cookie choice. No consent required.
• App local storage: a few display preferences; the code of a referral link, kept until sign-up; and, if you take part in the referral program, a random device identifier used only to prevent abuse.
• Audience measurement cookies: Google Analytics 4, 13 months maximum. Only set after your consent via the cookie banner.
• Cookie-free audience measurement: our server counts the site's page views (page, language, referring site, device, country) as anonymous totals, with no cookie, no identifier and without keeping your IP address. This count cannot identify you and does not require consent.
• Advertising cookies: Google Ads and Meta (Facebook/Instagram). Only set after your consent via the cookie banner. Some are Google or Meta cookies whose lifetime they set themselves.

On your first visit, a banner lets you accept or refuse these trackers; none is set before you choose, and your choice is kept for 6 months. You can change it at any time via the floating button at the bottom of the page or by clicking here. In the app, no banner is shown: the choice made on the website applies there (with no choice, none of these trackers is loaded), and "Manage cookies", in Settings, lets you change it.

9. Security

Pitchbase implements appropriate technical and organizational measures to protect your data:

• HTTPS encryption (TLS 1.2+) for all communications
• Encryption of data at rest (Supabase, Render)
• Authentication via JWT and time-limited tokens
• Primary hosting in the European Union
• Strict access controls per user identifier
• Regular and encrypted backups
• Access monitoring and logging

10. User-generated content

The transcripts, personas, scenarios, and other content you create on Pitchbase belong to you. Pitchbase does not use them to train its AI models nor share them with third parties, except for the technical sub-processors necessary to deliver the service (see section 5).

11. Minors

The Service is intended for professionals and for students in higher education, as part of their training. It is not intended for persons under 18 years of age, and Pitchbase does not knowingly collect data about them. Pitchbase's partner institutions train post-secondary students and only enrol adult students. If you believe a person under 18 is using the Service, please contact us: their data will be deleted.

12. Changes to this policy

Pitchbase reserves the right to modify this Privacy Policy at any time. Any substantial change will be notified to you by email or via an in-Service notification at least 30 days before it comes into effect. The date of the last update appears at the top of this document.

13. Contact

For any question regarding this policy or the processing of your personal data:

• Email: contact@pitchbase.app
• Mail: Pitchbase, 64 rue de la Fontaine Blanche, 29800 Landerneau, France