Privacy Policy

1. Introduction

PitchSpark ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, which connects founders, investors, and connectors in the startup ecosystem.

2. Information We Collect

Information You Provide

• Account registration details (name, email address, role type)
• Profile information (company name, bio, location, profile photo)
• Pitch and startup information submitted through our forms
• Messages and communications sent through the platform
• Payment and billing information processed through our payment providers

Information Collected Automatically

• Device information (browser type, operating system)
• Usage data (pages visited, features used, session duration)
• IP address and approximate location
• Cookies and similar tracking technologies

Nuke Me roasts. If you opt into the Nuke Me mode on Score & Roast, the roast is shown to you once and its text is not stored. We record your consent (a yes flag and a server timestamp) and anonymous run statistics (mode, an intensity score, moderation-guard counts, whether the standard roast ran instead, whether you de-escalated) under the same hashed, non-identifying record as standard roasts. No public link is created and nothing is emailed.

3. How We Use Your Information

• To create and manage your account
• To facilitate connections between founders, investors, and connectors
• To process transactions and send related information
• To personalize your experience and deliver relevant content
• To communicate updates, promotions, and platform news
• To monitor and analyze usage trends and improve the platform
• To detect, prevent, and address fraud or security issues
• To comply with legal obligations

4. Information Sharing

We do not sell your personal information. We may share your information in the following circumstances:

• With other users: Profile information and pitch data you choose to make visible on the platform
• Service providers: Third-party vendors who help us operate the platform (hosting, analytics, payment processing)
• AI assistants: If your pitch is approved, its public details (company name, one-line summary, sector, stage, region, amount raising, PitchSpark score when it is 70 or higher, and the public pitch link) may be shared with third-party AI assistants through our MCP server, as described in section 14. Listings our admin team added that no founder has claimed are not shared. Once delivered, those services handle the information under their own terms and privacy policies, not ours.
• Live Roast event hosts: If you join a Live Roast event, we share your name and email address with the organiser of that event, as described in section 13
• Legal requirements: When required by law, regulation, or legal process
• Business transfers: In connection with a merger, acquisition, or sale of assets

5. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit and at rest, secure authentication, and regular security assessments. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Your Rights and Choices

Depending on your location, you may have the right to:

• Access, correct, or delete your personal information
• Object to or restrict certain processing of your data
• Request a portable copy of your data
• Withdraw consent where processing is based on consent
• Opt out of marketing communications at any time

You can manage many of these preferences from your Privacy & Security settings within the platform, or by contacting us directly.

7. Cookies

We use cookies and similar technologies to maintain your session, remember your preferences, and understand how you interact with our platform. You can control cookie preferences through your browser settings, though disabling certain cookies may affect platform functionality.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide services. We may also retain certain information as required by law or for legitimate business purposes, such as fraud prevention and dispute resolution. You may request deletion of your account and associated data at any time. Different retention periods apply to information about companies we list without a submission; see section 12, and to AI assistant request records; see section 14.

9. Children's Privacy

PitchSpark is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will take steps to delete that information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the platform or sending you an email. Your continued use of PitchSpark after changes are posted constitutes acceptance of the updated policy.

11. Doc Vault & Confidential Document Data

Draft — pending legal review

When you use the Doc Vault to share or view documents within a conversation, we process the following additional data:

• Documents you upload, and metadata such as file name, type, size, category, and access settings (view-only/downloadable, expiry, NDA/passcode requirements).
• Access logs recording who viewed or downloaded a document, and when, including IP address — to provide forensic attribution to the sharer.
• NDA acceptance records including the typed-name signature, timestamp, IP address, browser user agent, the NDA template version, and a cryptographic hash of the exact text accepted.

Retention. Document file contents are hard-purged when a document expires or is removed. Access logs are retained for approximately 12 months in full and may be kept in pseudonymized form for up to 6 years to support NDA enforcement. NDA acceptance records are retained for approximately 6 years and survive document purge and account deletion, as they may be needed to evidence a binding agreement. A document may be placed on legal hold, which suspends purge while the hold is in effect.

View-only documents are watermarked with the viewer's identity. We do not prevent screenshots or photographs of shared documents.

12. Companies We List Without a Submission

Draft — pending legal review

Our admin team adds some startups to PitchSpark that did not submit a pitch themselves. This section explains what we do with information about those companies and the people who run them. It applies whether or not you have a PitchSpark account. The controller of this information is Pitchspark, PO Box 571, Tulsa, OK 74114. You can reach us at privacy@pitchspark.io.

What we collect

• Company information: name, website, description, sector, stage, location, fundraising amounts, and scores we generate from that information.
• People: the names and roles of founders and executives, one business email address, and, when a pitch deck lists one, a LinkedIn profile link.
• Provenance: the web page where we found an email address.

Where it comes from

• A pitch deck shared with us. An admin uploads the deck and we read its text, including the team and contact slides.
• Public web pages. If the deck has no email address, an admin can search public sources such as the company's own website, code repositories, product directories, app store listings and press coverage for a published contact address. We never use LinkedIn, Crunchbase, Wellfound or AngelList as sources, and we keep an address only when it appears on the page we cite. For listings we build from the web without a deck, company facts come from the company's own site or from press and news coverage, and we use only a business address published on the company's own domain.

Why we use it and our lawful basis

• To create a pitch record for the company, review it, and, once an admin approves it, show it to investors.
• To let the founder find, claim, edit or remove that record, and to pass on investor messages.

We rely on our legitimate interests (Article 6(1)(f) GDPR / UK GDPR). Our interest is running a marketplace where investors find startups that are raising and startups receive investor interest without doing anything. We judged that this does not override your interests because we use only business contact details taken from material shared with us or published publicly, we never give contact details to investors, we do not email an address we found through a web search to ask you to claim or approve the record, and you can object at any time. Ask us and we will send you a summary of that assessment.

Who can see it

• PitchSpark admins, who review every record before it is published.
• Signed-in investors, only after an admin approves the listing. A record built from a deck is created unpublished and pending, and stays out of investor view until it is approved. Investors can see the company information and the team names, roles and LinkedIn links from the deck. They never see email addresses, and a listing nobody has claimed is labelled "Listed by PitchSpark, not yet claimed". An investor's message reaches you only through PitchSpark.
• Service providers that host the platform, deliver email, and run the AI models that read decks and search the web, acting on our instructions.
• Authorities, when the law requires it.

We do not sell this information. If you are a California resident: we do not sell it or "share" it for cross-context behavioral advertising, as those terms are defined in the CCPA.

How long we keep it

• Web-search log: each contact search writes an audit record with the admin who ran it, the company name, the host of the page where an address was found, the admin's IP address, and a one-way SHA-256 hash of any address found, never the address itself. It does not record founder names or the company website. We keep these records for 12 months and then delete them.
• Listing and contact details: until you claim the record (after which section 8 applies) or you ask us to remove it.
• Removal and opt-out records: when you remove a listing or stop our email, we keep only a one-way hash of the address, the company's domain, the date and the type of request, so that we do not list or email you again.

Claiming a record

Sign in to PitchSpark with the email address on the record. For a record built from a deck, that address is held as an invited team member and is linked to your account when you sign in with it. For a listing built from the web, open the claim option on the listing: the exact address on file is attached straight away, another address on the company's own domain can claim it automatically, and any other address goes to our admin team for review. Whenever a claim is made by a different address, we notify the address on file and include a "This wasn't us" link that pauses the claim.

Listing matches. When you create a pitch whose website matches an existing listing, we record your account email, both pitch IDs, the domain, and whether you told us the listing isn't yours. Only our admin team sees this record. We use it to prevent duplicate and false listings, and we delete it 12 months after it is resolved or when you delete your account.

Your other rights

You can ask us for a copy of your information, to correct it, to delete it, to restrict how we use it, and, where it applies, to receive it in a portable format. Email privacy@pitchspark.io; we reply within one month. You can also complain to a data protection supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority in the country where you live or work. We would like the chance to help first.

The scores on a listing are automated estimates made from the deck and public information. We do not use them to make decisions that have legal or similarly significant effects on you.

13. Live Roast Events

Draft — pending legal review

PitchSpark runs in-person pitch roast events where guests take part from their phones. This section explains what we do with your information when you join one. It applies whether or not you have a PitchSpark account.

What we collect. When you scan the event code and sign up, we collect your name, email address and the role you pick (investor, founder, ecosystem, or just here for the show). During the event we record your winner prediction, your ratings, your reactions and the roast lines you write, together with the time you joined. Judges give us their name and email address and their scores. We keep a code on your phone so you stay signed in for the event; it is removed when the event closes.

Why we use it and our lawful basis. We use this information to run the event you asked to join: to count predictions, show ratings and reactions on the venue screen, moderate roast lines and announce results. Our lawful basis is that this is needed to provide the participation you requested (Article 6(1)(b) GDPR / UK GDPR) and, for showing approved lines and prediction winners in the room, our legitimate interests in running the event (Article 6(1)(f)). We also use event results as per-pitch totals and averages, with no names, email addresses or other guest details, to improve PitchSpark's pitch scoring, to send the founder of a pitch a summary of how the room rated it, and in anonymised statistics we share with partners; our lawful basis for this is our legitimate interest in improving our scoring and research (Article 6(1)(f)). Roast lines go into those statistics only as topic labels, never as the words you wrote. Before a roast line reaches the host, it is checked by an automated filter run by Anthropic, our service provider, and approved lines are sent to Anthropic again and tagged by topic; Anthropic sees the line text only, and the host, not the filter, decides what is shown.

What other people can see. Approved roast lines, prediction winners and the best roast line of the night are shown on the venue screen and on other guests' phones under your first name and last initial, for example "Alex T.". Ratings and reactions are shown only as totals and averages. If the event host turns it on for its event, approved roast lines may also be published in our online Roast Archive under the same first name and last initial with the event title and date. We never show your email address, your role, or your full name to other guests or the public. The event host is the one exception, as explained under "Sharing with the event host" below.

Emails you can choose. At signup you can tick two separate boxes: one to receive the results of the event by email, and one to receive a link to claim a free PitchSpark account. We send these emails only if you ticked the box, and we send the claim link once. Each email has a link to stop further email, or you can write to privacy@pitchspark.io. We do not add event guests to any PitchSpark newsletter, digest or marketing list.

Sharing with the event host. Live Roast events are run by an event host, the organiser named on the signup form, who may be a company or person other than PitchSpark. When you join, we share your name and email address with the host of that event, and with no one else. The signup form tells you this before you join; there is no box to tick, so if you do not want your details shared with the host, please do not join. The host gets your details only for its own events, and never your role, your individual ratings, reactions or predictions, or anything from other events. We are not paid for your details. Once the host has your details, it is an independent controller of them: it decides how to use them under its own privacy policy, not ours. A host other than PitchSpark may send you marketing emails; when PitchSpark is the host, we do not. Every marketing email from a host must include a working unsubscribe link, and the host must honour it. To stop the host's emails, use the unsubscribe link in them or contact the host at the details shown on the signup form. If you ask us to delete your information, we delete ours and tell the host of your request. Our legal basis for sharing is our and the host's legitimate interest in letting the organiser know who attended its event (Article 6(1)(f)); the host is responsible for having a lawful basis for its own marketing. If you joined an event under an earlier signup notice that offered a box to agree to the host's marketing and you did not tick it, the host may not send you marketing. If you joined under our earliest notice, which said we would not share your email address with the host, we do not share your details with the host.

Sponsors. An event may include segments paid for by a sponsor. These are labelled "Sponsored" on the venue screen and on your phone. Sponsors do not receive your name, email address or any other information about you or other guests.

How long we keep it. We delete guest and judge records, including names, email addresses, roles and any roast lines that were not approved, 30 days after the event closes. Ratings, reactions, predictions and scores are kept only as event statistics with no link to you. Roast lines published to the Roast Archive stay there with your first name and last initial until you or the host asks us to take them down. If you claim a PitchSpark account, section 8 applies to your account from then on. Our 30-day deletion does not reach the copy of your name and email address that the event host already holds; the host keeps that under its own privacy policy, and you can ask the host to delete it.

Age. You must be 18 or older to take part in a Live Roast event.

Your rights and contact. You can ask us for a copy of your information, to correct or delete it, or to remove a published roast line, by emailing privacy@pitchspark.io. We reply within one month. For the copy the event host holds, contact the host directly, or write to us and we will pass your request on. You can also complain to a data protection supervisory authority, as described in section 12.

14. AI Assistant Access (MCP)

PitchSpark runs a public MCP (Model Context Protocol) server that AI assistants can call to search public pitches on the platform. This section explains what we record when they do.

What we log. For each request we record:

• A salted, keyed hash of the requester's IP address. We do not store the raw IP address. IPv6 addresses are grouped by their /64 network before hashing.
• The date of the request.
• The search terms sent.
• The pitches returned.
• The name and version of the AI client, and its user agent.

Because we hold the key used to make the hash, the hashed IP address is still personal data, and we treat it that way. Search terms are whatever the AI assistant sends, so please do not include personal information in them.

Why we use it and our lawful basis. We use these records to enforce the free limit of 3 pitches per day, to prevent abuse, and for service analytics. Our lawful basis is our legitimate interests in running the service fairly and securely and understanding how it is used (Article 6(1)(f) GDPR / UK GDPR).

How long we keep it. We keep these records for as long as we operate the service and need them for the purposes above: enforcing the daily limit, preventing abuse, and service analytics. If that changes, we will update this policy.

Legacy agent API. Our older agent API has been retired. Its past request logs now hold only a salted, keyed hash of the IP address, made the same way as for MCP requests; the raw IP addresses have been removed. These logs are kept on the same basis and for the same purposes as described above.

Founders. Section 4 explains which public pitch details AI assistants receive. You can exercise the rights in section 6, including the right to object, by emailing privacy@pitchspark.io.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please reach out through our Contact page or email us at privacy@pitchspark.io.