Privacy Policy

• Account data. When you sign in through our authentication provider (Clerk), we receive your name, email address, profile image, and authentication identifiers.
• Roster data you provide. Information about the freelancers you manage — names, contact details, day rates, skills, work history, CVs, and writing samples — that you upload to build and pitch their profiles.
• Mission data. Publicly available freelance mission listings we retrieve from third-party sources on your behalf.
• Integration data. If you connect Slack, the tokens needed to post review notifications, stored encrypted at rest.
• Gmail connection (optional). If you connect a freelancer’s Google account to send their applications, we store an OAuth token (encrypted at rest) scoped only to sending email on their behalf. We do not read, store, or otherwise access their mailbox — see “Google user data” below.
• Usage data. Logs, device and browser metadata, and diagnostic information used to operate and secure the Service.

We use it to operate the Service: match freelancers to relevant missions, generate tailored application drafts from the profile data you provide, notify you for review, and let you approve submissions. If you connect a Gmail account, we also use it to send the applications you have explicitly approved, from the freelancer’s own mailbox. We do not sell personal data or use it for advertising.

Application drafts are generated by a large language model (provided by Anthropic) from the profile data you supply. Drafts are grounded in that data and are always reviewed by a human before any submission — nothing is sent automatically.

We rely on a small set of trusted providers to run the Service: Clerk (authentication), Neon (database), Vercel (hosting and file storage), Anthropic (AI draft generation), Slack (notifications, if you connect it), and Google (sending application emails from a connected Gmail account, if you connect one). These providers process data on our behalf under appropriate agreements. Data may be processed in the European Union and the United States.

If you connect a freelancer’s Google (Gmail) account, we request a single, send-only permission (the gmail.send scope) so that, when you explicitly approve an application, the application email is sent from that freelancer’s own Gmail account. We request only this scope: we do not read, list, search, label, modify, or delete any messages, and we do not otherwise access the mailbox. We also request the basic openid and email scopes solely to identify which Gmail address is connected.

We store the resulting OAuth token encrypted at rest and use it only to send emails you have explicitly approved in the Service. We never use Google user data for advertising or to train machine-learning models, and we do not sell or transfer it. When you disconnect the account, we revoke the token with Google and delete it.

Pitch Autopilot’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Because the Service processes personal data about the freelancers you manage, you act as the data controller for that data and we act as your processor. You are responsible for having a lawful basis to upload it, for informing the individuals concerned, and for honoring their rights.

Depending on your location (including under the GDPR in the EEA), you may have rights to access, correct, delete, restrict, port, or object to the processing of your personal data. Contact us at the address below to exercise them. We will respond within the time required by applicable law.

We retain data for as long as your account is active or as needed to provide the Service, then delete or anonymize it. Data is encrypted in transit, and secrets such as integration tokens are encrypted at rest.

Where personal data is transferred between the EU and the US, we rely on appropriate safeguards such as the applicable standard contractual clauses.

We may update this policy. Material changes will be posted on this page with a new effective date.

Questions or requests: privacy@pitchautopilot.com.