Privacy Policy

Effective Date: November 4, 2026

The short version

• We collect what you give us, like your account details, deals and call transcripts, and what your browser sends us, like your IP address (section 2).
• PitchGenius does not train AI models on your data today, and a setting in your account controls whether it ever may (section 3).
• Section 5 names every company that receives personal data from us, and what each one receives.
• Your data is hosted in Germany, and companies and people outside Germany also process it, including in the United States (section 6).
• You can download or delete your data yourself in Settings, and backups can still hold deleted data for a time (sections 7 and 9).
• A ZoomInfo tag runs on our public pages only if you accept it, and it never runs inside the app (section 8).
• The Services are not directed to anyone under 18, and we delete any data we learn came from a child (section 11).

This Privacy Policy explains how PitchGenius AI ("PitchGenius," "we," "us," or "our") collects, uses, discloses, and protects personal information when you access or use our website, platform, desktop app, AI tools, and related services (the "Services").
It also describes your rights and how to use them.

This Policy should be read together with our Terms of Service.

1. Who We Are and Scope

PitchGenius AI provides AI-powered sales psychology and buyer-intelligence tools.
This Policy applies to personal information we process in connection with the Services.
It does not apply to third-party websites or services that we do not control, even if linked from our Services.

For the purposes of the EU General Data Protection Regulation (GDPR) and similar laws, PitchGenius is the controller of personal data we collect directly from you (account data, usage data, billing information).
With respect to any personal data of third parties (e.g., prospective buyers, LinkedIn profile data, or contact details) that you upload or provide to the Services, you are the controller and PitchGenius acts as a processor / service provider on your documented instructions.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: your name and email address, your role, and your password, which we store only as a salted hash.
• Email addresses you used before, if you change yours, so that your download and your deletion still cover what you gave us under them.
  They go when your account goes.
• Workspace information: your company name, website, industry, products, problem statement, call scripts and uploaded source documents.
• Billing contact details, which go to Stripe.
  Your card details never reach us.
• Content you submit to the Services ("Inputs"): buyer names, titles, email addresses, companies and LinkedIn URLs, plus deals, notes and CRM records.
• Call transcripts.
  The desktop app turns call audio into text on your computer, and it sends us that text and short facts drawn from the audio.
  We do not receive or store call recordings.
• Your answers to the coaching check.
• What you send through forms on our public site: your name, email address, company, job title, LinkedIn URL and ROI calculator inputs.
• Messages you send us.

2.2 Information Collected Automatically

• Sign-in records: your IP address, browser, the time, and whether the attempt worked.
• Server logs and error reports, which can include your IP address, browser, the page or request involved, and your user ID.
• AI usage records: the feature, the model and the cost of each AI request, without its content.
• On our demo and ROI calculator pages: a random visitor ID kept in your browser, the steps you reach, campaign tags from the link you followed, and your browser’s language, time zone, screen size, platform, processor count and touch support.
• Cookies and similar technologies (see Section 8).

2.3 Information from Third Parties

• If your workspace connects a CRM or ZoomInfo, we read the records the feature needs from it.
• To prepare a call we search the public web for a buyer’s name and company through Serper, and keep what the AI drew from the results in that deal’s notes.
• Stripe tells us the status of your payments and subscription.

2.4 What You Have to Give Us

• To have an account we need your name, your email address, a password and a code we email you.
  We need them to make and keep our contract with you, and without them we cannot open an account.
• A paid plan needs billing contact details and a card with Stripe.
  Without them it cannot start.
• Everything else is your choice.
  Without workspace details or the coaching check, coaching is less tailored to you.
  Without buyers, deals or call transcripts, the features that work on them have nothing to work on.
  Without a connected CRM or ZoomInfo, those records stay out of PitchGenius.
• The forms on our public site are your choice.
  Without them you do not get what that form offers, and the rest of the site still works.

3. How We Use Your Information

• To provide, operate, and maintain the Services, including generating AI profiles, scripts, and recommendations based on your Inputs.
• To process transactions, send invoices, and manage subscriptions.
• To communicate with you about the Services, security alerts, product updates, and (with your consent where required) marketing.
• To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• To comply with legal obligations and enforce our Terms of Service.

AI Processing and Model Training

Your Inputs, including call transcripts, are sent to the AI providers named in Section 5 to generate Outputs.
We send them only to get your results back, not so that those providers can train on them.
How those providers handle them is set by their own API terms.

PitchGenius does not train AI models on your data today.
Settings, then Privacy, has a control for this, and it stays off unless you turn it on.
If we ever start training, we will only use data from people who have it on, and we will update this Policy first.

You can turn it off at any time, in the same place or by writing to privacy@pitchgenius.ai.
Turning it off does not affect processing that happened before.

When we delete an account, we keep the count of its AI usage with no person attached, for cost accounting.
When a workspace closes, the count has no workspace attached either.

4. Legal Bases for Processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we process personal data on the following legal bases:

• Performance of a contract (providing the Services you requested).
• Legitimate interests (security, fraud prevention, error tracking, and understanding use of the Services) balanced against your rights.
• Consent (the ZoomInfo tag on our public pages, certain marketing, and model training if we ever offer it and you turn it on).
• Legal obligation (compliance with applicable laws).

5. How We Share Information

We do not take money for your personal information.
We share it only in the following circumstances.

Service providers. These companies receive personal data so that we can run the Services:

Your workspace. The owner and managers of a workspace can read its members’ deals, calls, transcripts and coaching reports.
The owner can close the workspace, which deletes its deals, calls and everything else in it.
Its members keep their accounts and only lose their place in it.

Signed orders. The signing record inside a signed order shows each signer’s name, email address, IP address and browser to the other party, and both parties keep a copy.

Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets.

Legal requirements. When required by law, subpoena, or governmental request, or to protect the rights, property, or safety of PitchGenius, our users, or the public.

With your consent or direction. When you instruct us to share information or connect third-party integrations.

6. International Data Transfers

PitchGenius is based in the United States.
Our server and its database are in Nuremberg, Germany.

Personal data also leaves Germany.
Our AI, email, payment, error tracking, search and marketing providers in Section 5 process it in the United States and other countries.
Timofi LLC’s staff, who build and operate PitchGenius, work from the United States and other countries, including Brazil, and can reach production data from there.

Those countries may have data-protection laws different from those in your country of residence.
This table shows the safeguard each company publishes for moving personal data out of Europe, and where to read it.

We have not finished confirming that each of these applies to our own account.
Where a row says not confirmed, we have not found a safeguard we can point to yet.
This section will change when that work is done.
To ask for a copy of what applies to a given company, write to privacy@pitchgenius.ai.

7. Data Retention

• Your account, deals, call transcripts and Outputs are kept while your account or workspace stays open.
• When an account or workspace closes, or you ask us, its data is deleted from production within 30 days and the deletion is recorded.
  Using Delete my account in Settings does this at once.
• Backups can still hold deleted data for a time.
  We are setting up a rule that removes each backup automatically after 35 days, and until it is live a backup can be kept longer than that.
• Live call state is kept in memory for about 90 minutes after a call’s last activity, and it goes at once if you delete your account.
• Working copies in our job queue and AI answer cache can outlast a deletion, and they clear on their own within 24 hours.
• If GoHighLevel cannot remove your contact when you delete your account, we try again for about two hours.
  If that still fails, the contact can stay there until you write to privacy@pitchgenius.ai.
• Error reports are kept for the retention period of our Sentry plan.
  Server logs are kept until newer logs overwrite them, once a service has written about 150 MB.
  Both can outlast a deleted account for that time.
• Sign-in attempts are deleted after 90 days, and session records 30 days after the session ended or was last used.
• Server health samples, which hold no personal data, are deleted after 48 hours and their roll-ups after 90 days.
• What you sent through our public site’s forms is kept until you ask us to delete it.
• Records of visits to our public site with no address or account behind them are deleted after 90 days.
• Invoices stay with Stripe, because tax law requires them.
• Email you exchanged with us stays in our company mailbox until you ask us to delete it.
• A pilot under a signed order keeps its signed order and evidence records, including the names and quotes in them, until the retention period in that order ends.
  They are then deleted.
• Each deletion leaves a record of what kind of thing was deleted, when, and how many rows.
  It holds no personal data.
• When an account is deleted, we keep a one-way fingerprint of each email address it used and when it let that address go, and never the address itself.
  It is how we keep what was filed under an address before that moment out of the next account to use it.
• We keep a security log of every change our staff make in our admin tools, and of every attempt to sign in to them.
  It can hold details about you, it cannot be edited, and a deletion does not remove it.

8. Cookies and Similar Technologies

Needed to run the Services. We set cookies that keep you signed in and protect sign-in with a CRM.
We keep your theme and a few form steps in your browser’s storage.
On our demo and ROI calculator pages we keep the random visitor ID from Section 2 in your browser’s storage, and a campaign cookie for 30 days.

ZoomInfo. Our public marketing pages can run a ZoomInfo tag, with Clickagy, which identifies companies that visit.
It collects your IP address, browser details and the pages you view, and those companies handle that under their own privacy policies.
It runs only after you press Accept in our cookie notice.
It never runs inside the app, in the demo, or while you are signed in.

You can change your choice at any time here or in our site footer.

Cookie settings

Other companies. The signed-in app loads fonts from Google Fonts.
The booking calendar on our pricing page comes from GoHighLevel and loads when you open it.
Sentry receives error reports from the app.
Section 5 says what each one receives.

You can also control cookies through your browser settings, though blocking the sign-in cookies stops you from signing in.

9. Your Privacy Rights

Depending on where you live, you have these rights, and this is how to use each one:

• See and take a copy of your data (access and portability): in Settings, then Privacy, press Download my data.
  If you own a workspace, the file also holds the workspace’s data.
  Deals you added to a workspace you have since left stay with it and are not in your file, so ask its owner for those.
  If Settings asks you to confirm your email, do that first, or anything filed only under your address stays out of the file and out of a deletion.
• Correct your data: change your name and email in Settings, then Profile.
  Change deals and workspace details where you entered them.
• Delete your data (erasure): use Delete my account in Settings, or email privacy@pitchgenius.ai.
  If you own a workspace with other members, you either hand it to one of them or close it for everyone.
  A workspace’s subscription is cancelled before it closes.
  If you hand it over, its subscription stops at the end of the period already paid and your card is removed, and the new owner adds their own card to keep it going.
• Take back consent: turn off AI model training in Settings, then Privacy, and change the ZoomInfo choice with Cookie settings in our site footer.
• Restrict or object to certain processing: write to privacy@pitchgenius.ai.
• Delete data with no account behind it, such as a form you sent on our site: write to privacy@pitchgenius.ai.
• Opt out of the "sale" or "sharing" of personal information (CCPA/CPRA): press Decline in our cookie notice, or never accept it.
• Appeal a decision we make regarding your request (where required by law): write to privacy@pitchgenius.ai.

You can use any of these rights by writing to privacy@pitchgenius.ai.
We may need to verify your identity first, and we will respond in accordance with applicable law.
California residents may also designate an authorized agent under the CCPA/CPRA.

If a PitchGenius customer holds your details as one of its buyers or contacts, that customer controls them.
Write to the customer first.
If you write to us, we will work with them on your request.

10. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration.
No method of transmission or storage is 100% secure.
You are responsible for maintaining the security of your account credentials.

11. Children's Privacy

The Services are not directed to individuals under 18 years of age.
We do not knowingly collect personal information from children.
If we become aware that we have collected personal information from a child, we will take steps to delete it.

12. Third-Party Links and Integrations

The Services may contain links to third-party websites or allow integrations with third-party services (e.g., CRM platforms).
We are not responsible for the privacy practices of those third parties.
We encourage you to review their privacy policies.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.
Material changes will be indicated by updating the "Effective Date" at the top and, where appropriate, by additional notice (email or in-product).
Where required by law, we will seek fresh consent for material changes.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

R T Pontone Investment LLC
12582 Willstatter Ave
Orlando, FL 32827

Email: privacy@pitchgenius.ai
Legal / General: legal@pitchgenius.ai
Website: https://pitchgenius.ai

If you are located in the EEA or UK and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.