Privacy Policy

1. Who we are

PitchWhip is operated by PitchWhip Ltd, a company registered in England and Wales (company number 17389184). Registered office: 96A Wandsworth Bridge Road, London SW6 2TF, United Kingdom. For the personal data described in this policy where we decide the purposes and means of processing, PitchWhip Ltd is the controller. We have not appointed a Data Protection Officer because we are not required to; privacy questions go to hello@pitchwhip.com — a human answers, usually within two working days.

Two related documents sit alongside this policy: our Terms of Use (the commercial terms) and our Data Processing Agreement (which governs the data we process on your behalf, as your processor). Cookies are covered in the Cookie Policy.

2. The short version

PitchWhip is a Chrome extension for sales professionals. Most of what it does still happens in your browser and in your own Google account. Since August 2026 we also run a small set of cloud services — PitchWhip Cloud — that hold, per licence: your reveal credit balance, the prospect contacts you have chosen to reveal, your own call log, and your team settings, so that these survive a device change and can be shown in the customer portal. That data is yours: it is readable only with your licence (and, if you join a team, by your team-mates to the extent described below), we process it only on your instructions, and it is deleted when your licence ends. We do not sell personal data, we do not use it for advertising, and we do not train AI models on it.

3. Who this policy covers

This policy is written for four groups of people:

• Visitors to pitchwhip.com.
• Customers and users — people who buy a licence, use the extension, or log in to the customer portal, including members of a team plan.
• Prospects — people whose LinkedIn or Sales Navigator profile a user views, researches, reveals contact details for, or calls using PitchWhip. If that is you, section 7 and section 12 explain how your data reaches us and what to do about it.
• Enquirers — anyone who emails us or fills in a form on the site.

4. Controller or processor: our role for each kind of data

Data-protection law distinguishes a controller (who decides why and how data is processed) from a processor (who processes it on the controller’s instructions). PitchWhip wears both hats, and it matters which one:

5. What we collect, why, and for how long

Below is everything we process, grouped by activity, with the lawful basis we rely on under UK GDPR and EU GDPR and how long we keep it. Where the basis is legitimate interests we have balanced our interest against your rights; you can object at any time (section 12).

5.1 Visiting the website

5.2 Buying and holding a licence

5.3 Using the extension: AI generation and metering

When you generate a brief, opener, objection handle, coaching note or similar, the extension sends the LinkedIn or Sales Navigator profile text on your screen, together with your pitch context, through our API proxy (a Cloudflare Worker) to Anthropic’s API, which generates the text. The live-call features send more through the same route: if you turn on live transcription, the transcript of the call so far (the prospect’s words as well as yours) is sent for live suggestions; the full call transcript is sent for the post-call summary and coaching, for call replay and — if you enable it — for voice learning; the weekly review sends, for each recent call, the coaching lessons and improvement points, the prospect’s company, the outcome and any hang-up reason; and a Redo instruction you type is sent with the request it refines. Your free-text call notes are not sent. Our proxy exists so that you do not need your own API key. It forwards each request and streams the answer back; it does not store the content of requests or responses (the one exception — quality telemetry — is described below). What it does keep is metering: token counts per day keyed by your licence key (or, on the free tier, a random device identifier and your IP address — IPv6 addresses are truncated to their /64 prefix), so that fair-use limits work. Anthropic processes API inputs under its commercial terms and does not use them to train its models; see Anthropic’s privacy policy. Lawful basis: contract (for licensed users) and legitimate interests (offering a limited free tier and preventing abuse). Retention: usage counters expire shortly after the day they relate to.

Web search. Two features ask Anthropic to search the open web as part of answering, using Anthropic’s own server-side search tool. We do not choose or contract with the search engine behind it; the query goes to Anthropic and Anthropic performs the search. First, Enrich, which you press: it searches for public information about the prospect’s company — recent news, their website, public coverage — to judge the buying signals you have defined, and cites its sources. Second, and this one is automatic: when a call is synced to your CRM sheet and the industry, headcount or head-office country is missing, the extension looks the company up so those columns are not blank. That automatic lookup sends the company name and, if known, the contact’s job title — not their name, not their profile URL, and not your notes. It runs only when you have a Google Sheets or Apps Script sync configured, is capped at two searches per company, and the result is cached so the same company is not looked up twice.

Feedback and quality telemetry. Two things from the extension are stored, keyed to your licence key, in the same Cloudflare database as your cloud data: (a) feedback — text you choose to send us with the “Also send to PitchWhip” button after a Redo; and (b) quality telemetry — when our automatic writing checks flag a generated script, the extension sends us a diagnostic record containing the identifiers of the rules that fired, which opener style was used, and timings. It does not contain the script itself, the prospect, or anything you wrote — earlier versions sent short excerpts of the flagged opener; they no longer do. We use both only to tune our writing rules; they are never shown to other users and never used to train AI models. Lawful basis: legitimate interests (improving the product). Retention: until you ask us to delete them, and otherwise for as long as we still need them for tuning; email hello@pitchwhip.com and we will remove every row for your licence.

5.4 PitchWhip Cloud: your call log, reveals and team

These are the records we hold on your behalf, per licence key. You are the controller of the personal data inside them; we are your processor under the DPA. They exist so that your data survives a device change and can be shown in the customer portal.

5.5 Contact reveals

When you press Reveal phone or Reveal email, our Worker sends the prospect’s name, company and LinkedIn profile URL to FullEnrich, a B2B contact-data provider we work with under a reseller agreement, and returns what it finds. The extension never talks to FullEnrich directly. A credit is spent only when data is found. FullEnrich is an independent controller of its own contact database and its processing is described in its own privacy policy; for the request itself we act as your processor. Retention on our side is described in 5.4.

5.6 Team Learning (optional, off by default)

If you or your team admin turn sharing on, the objection/rebuttal pairs from your calls are anonymised inside our Worker before they are stored — names, companies, emails, phone numbers, places and amounts are removed by an AI scrub pass with a rule-based backstop, and any record that cannot be cleaned is dropped. The pool therefore contains no personal data by design. Every sharing toggle defaults to off and is enforced on our server. Lawful basis: consent (you switch it on) and legitimate interests (improving suggestions for everyone).

6. What stays on your device

Everything not listed above stays on your device or in your own Google account, and we do not store it:

• Settings, pitch profiles, coaching memory, notes and full call records live in Chrome’s local and sync storage. Coaching lessons and call outcomes are among the inputs sent transiently to the AI for live suggestions and the weekly review (5.3); your notes are never sent.
• Live transcription, if you turn it on, uses Chrome’s own speech recognition. Be aware what that means: Chrome streams the microphone audio to Google to convert it to text, in the same way as voice typing elsewhere in the browser. That happens between Chrome and Google — the audio never reaches us, and we never store it — but it does mean the audio of a call you transcribe leaves your device. The resulting transcript is kept only on your device. Note the further exception in 5.3: when you use live suggestions, the post-call summary and coaching, call replay or voice learning, the relevant transcript text is sent through our proxy to Anthropic (transiently — we do not retain it) so that those features can work.
• Google Sheets and Calendar sync, if you connect Google, writes to a spreadsheet and calendar events in your own Google account. The extension uses the restricted drive.file scope (access only to files it created) and calendar.events for bookings. Nothing from your Google account is sent to us. PitchWhip’s use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

7. Prospect data: your responsibilities

When you use PitchWhip to research, reveal or call prospects you are processing the personal data of third parties, and you (or your organisation) are the controller for that data. We are your processor for the parts that touch our services. In practice that means:

• You need a lawful basis for your outreach. For B2B prospecting under UK GDPR and PECR this is usually legitimate interests, but the assessment is yours to make and document. In the US, cold-calling and texting rules such as the TCPA and Do Not Call registries apply to you.
• Tell prospects where their data came from where the law requires it, and honour objections: if a prospect asks you to stop or to delete their details, do so — including deleting them from your call log and CRM. Ask us and we will remove the matching rows from PitchWhip Cloud.
• Call-recording law applies to you. In the UK and many US states, recording or transcribing calls may require telling or asking the other party. Check before turning transcription on.
• Revealed contact details are for your own outreach. Do not resell them, publish them or build a database for others; the Terms of Use set out the restrictions that flow down from our data supplier.

If you are a prospect and want to know what a PitchWhip user holds about you, the user (their organisation) is the controller and is the right first contact. If you do not know who that is, email hello@pitchwhip.com — we will help you identify the controller where we can and will act on their instructions to delete data we hold for them.

8. Who we share data with

We share personal data only with the providers below, each under a contract that limits what they may do with it — except where the table says a provider is engaged by you rather than by us (Chrome’s speech recognition, and your own Google Sheets and Calendar), where your relationship with that provider governs and we have no contract to rely on. Otherwise we share only when the law requires it (for example a court order) or to protect our rights. We do not sell personal data.

We will update this table, and give customers 30 days’ notice by email or on this page, before adding a sub-processor that will handle PitchWhip Cloud data. If we are ever acquired or merge, customer data may transfer to the successor under this policy; we will tell you first.

9. International transfers

We are based in the United Kingdom. Some providers above process data in the United States. Where personal data leaves the UK or the EEA we rely on: for transfers from the UK, the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; for transfers from the EEA, the EU Standard Contractual Clauses (Modules 2 and 3 as applicable) with a transfer risk assessment; and, where the recipient is certified, the EU–US Data Privacy Framework and its UK Extension. Transfers between the EEA and the UK rely on the European Commission’s adequacy decision for the UK. Copies of the relevant clauses are available on request from hello@pitchwhip.com.

10. Retention

The tables in section 5 give the detail. In summary:

• PitchWhip Cloud data (call log, revealed contacts, team settings, credit ledger) is kept for the life of your licence. After it ends we delete it on request straight away and otherwise within 90 days, as part of our clean-up of lapsed licences. Purchase and refund entries in the ledger are kept for up to 6 years for accounting and tax.
• Account and licence records are kept while your licence is active and for up to 6 years afterwards for accounting, tax and legal-claim purposes.
• AI request content is not retained by our proxy; metering counters expire shortly after the day they relate to. The exception is the feedback and quality-telemetry records in 5.3 (feedback you choose to send, and short excerpts of flagged generated scripts), which we keep until you ask us to delete them or we no longer need them for tuning.
• Enquiries and support email are kept up to 24 months from last contact.
• Extension data on your device is under your control and is removed when you delete it or uninstall the extension.

To have your cloud data deleted before your licence ends, email hello@pitchwhip.com from the address on your purchase. Note that deleting revealed contacts means a later reveal of the same person will spend a credit again.

11. Security

Everything is encrypted in transit (TLS) and at rest by our hosting providers. Cloud data is isolated by licence key — every query is scoped to the calling licence or its team — and licence keys never appear in URLs. Secrets (API keys, signing keys, webhook secrets) are held in provider secret stores, never in source code. Access to production systems is limited to the people who run the service, on least-privilege accounts with multi-factor authentication. Webhooks from our payment and data providers are signature-checked before anything is written. The customer portal never exposes your licence key to browser scripts after login (the session cookie that carries it is HttpOnly); a compromised key can be deactivated on request. If we suffer a breach that affects your data we will tell you and, where required, the regulator without undue delay and within 72 hours of becoming aware. Annex 2 of the DPA lists the measures in more detail.

12. Your rights (UK and EU)

If you are in the UK or the EEA, you have the right to access the personal data we hold about you and receive a copy; to rectify it if it is wrong; to have it erased; to restrict processing; to object to processing based on legitimate interests (including any direct marketing, which we will always stop); to data portability for data you gave us that we process by automated means under contract or consent; and to withdraw consent at any time where consent is the basis (for example, analytics cookies — use the “Change your choice” control on the Cookie Policy page). Withdrawing consent does not affect processing before you withdrew it.

To exercise any of these, email hello@pitchwhip.com. We will respond within one month (extendable by two further months for complex requests, which we will tell you about). We may ask you to confirm your identity — usually by writing from the email address on your purchase. There is no fee unless a request is manifestly unfounded or excessive. Where we act as your processor (PitchWhip Cloud data), the customer portal lets you see your call log and revealed contacts and export your call log, and we will delete on instruction.

You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113); in the EEA, the data-protection authority of the country where you live or work — the European Data Protection Board keeps a list of members. We would appreciate the chance to resolve your concern first.

13. US state privacy rights (California and others)

This section applies if you are a resident of California (under the California Consumer Privacy Act as amended by the California Privacy Rights Act, together the “CCPA”) or of another US state with a comprehensive privacy law (including Colorado, Connecticut, Delaware, Iowa, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia). PitchWhip Ltd is a small UK company and may fall below the thresholds at which some of these laws apply; we honour the rights below for all US residents regardless.

Notice at collection: categories, sources and purposes

In the last 12 months we have collected the following categories of personal information, in each case for the business purposes described in section 5:

We disclose these categories to the service providers listed in section 8, for the business purposes of providing the service, processing payments, hosting, security and analytics. We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 16. Because we do not sell or share, there is no opt-out to operate; if we ever change that we will add a “Do Not Sell or Share My Personal Information” link to this site first. We treat a browser Global Privacy Control signal as a valid opt-out request. Retention periods for each category are in sections 5 and 10.

Your rights

• Right to know / access — the categories and specific pieces of personal information we have collected about you, the sources, purposes, and the categories of third parties we disclosed it to.
• Right to delete — subject to exceptions (for example, completing a transaction, security, or legal obligations such as tax records).
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing, and to limit the use of sensitive personal information — not applicable in practice, because we do neither.
• Right to non-discrimination — we will not deny you service, charge a different price or provide a different level of quality because you exercised a right.
• Right to appeal — if we decline a request you may ask us to reconsider by replying to our decision; residents of states that provide a statutory appeal may then complain to their state attorney general.

How to exercise them. Email hello@pitchwhip.com with the subject line “Privacy request” (or, for the avoidance of doubt, “Do Not Sell or Share”). We do not operate a toll-free number because we interact with customers online only. We will confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 days with notice. To verify a request we will match it to the email address on your purchase or account and may ask for one further piece of information we already hold; we do not require you to create an account. An authorised agent may submit a request on your behalf with your signed permission, and we may ask you to confirm the agent’s authority directly. Where we hold information only as a service provider (processor) for a PitchWhip customer — for example, because a customer revealed or logged a call to you — we will forward your request to that customer and act on their instruction.

Shine the Light. California Civil Code section 1798.83 lets California residents ask once a year what personal information we disclosed to third parties for their own direct-marketing purposes. The answer is: none — we do not disclose personal information to third parties for their direct marketing.

14. Children

PitchWhip is a business tool for adults. You must be at least 18 to buy a licence or use the service, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, email hello@pitchwhip.com and we will delete it.

15. Cookies

The site sets three first-party cookies, all strictly necessary: pw_session (portal login), pw_consent (your cookie choice) and pw_geo (country code for the banner). Web analytics is cookieless and runs only with your consent where consent is required. The extension sets no cookies. Full details, and the control to change your choice, are on the Cookie Policy page.

16. Automated decisions and AI

We do not make decisions about you by automated means that have legal or similarly significant effects. The AI features generate suggestions — openers, briefs, objection handles, coaching — for you to use or ignore; nothing is sent to a prospect or actioned without you. Fair-use and credit limits are simple counters, not profiling. Team Learning uses an AI pass only to remove personal data from shared text.

17. Changes to this policy

If we change how PitchWhip handles data — a new sub-processor for cloud data, a new category of data, a new purpose — we will update this page and its effective date before the change takes effect and, for significant changes, email licence holders. Earlier versions are available on request.

18. Contact

PitchWhip Ltd, 96A Wandsworth Bridge Road, London SW6 2TF, United Kingdom. Email hello@pitchwhip.com. For EU data subjects we have not appointed a separate EU representative; contact us directly at the same address.