Privacy Notice

1. Who we are

Pitch Check AI, which operates the Business Genie AI website and service, is the data controller for the personal data described in this notice. That means we decide why and how your personal data is processed. You can reach us at privacy@businessgenie.ai.

2. What we collect and why

• Account data — your email address, login credentials (passwords are stored only as salted hashes), and, if you sign in with Google, your name and profile picture. Used to create and secure your account and to identify you when you sign in. Legal basis: performance of our contract with you.
• Pitch content — the pitch text and any image you submit, and the AI critique returned to you. Used to provide the Service and to show you your own history. Legal basis: performance of our contract with you.
• Credit and purchase records — your credit balance, a ledger of credits granted, spent, and refunded, and a record of which packs you bought (we do not store your card details). Used to deliver what you paid for and keep accurate records. Legal basis: contract and legal obligation.
• Device and network data — a randomly generated device identifier stored in your browser and a one-way hash of your IP address. Used only to limit abuse of the free trial. Legal basis: our legitimate interest in preventing fraud and abuse of a paid service.
• Technical and error logs — request metadata and error diagnostics. Used to keep the Service secure, debug faults, and improve it. Legal basis: legitimate interests.
• Support messages — what you send us when you contact us. Used to answer you. Legal basis: legitimate interests.

We do not sell your personal data, and we do not use your pitch content to advertise to you.

3. Who we share it with

• Merchant of Record — Paddle.com acts as the Merchant of Record for all our orders, and handles the sale, payment processing, invoicing, tax compliance, and refunds. Paddle collects your payment and billing details directly and processes them under its own privacy notice.
• AI providers — the pitch text and any image you submit are sent to the third-party AI model provider that generates your critique. Only the content needed to produce the critique is sent; your name, email, and payment details are not.
• Infrastructure and service providers — our hosting, database, authentication, and error-monitoring providers, who process data on our instructions as subprocessors.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where we are required to disclose by law, or to establish, exercise, or defend legal claims.

4. International transfers

Our providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards, such as adequacy decisions or Standard Contractual Clauses, to protect your data.

5. How long we keep it

• Account data and pitch history: for as long as your account is active.
• After you delete your account: deleted or anonymised within 30 days, except where we must keep records longer.
• Purchase and credit ledger records: retained for as long as required for tax and accounting purposes, typically up to seven years.
• Abuse-prevention identifiers and technical logs: retained for a limited period and then deleted.

6. Your rights

Depending on where you live, you have the right to access your personal data, correct it, have it erased, restrict or object to its processing, receive a portable copy, and withdraw any consent you have given. Where we rely on legitimate interests, you can object at any time.

To exercise any of these rights, email privacy@businessgenie.ai. We will respond within one month. If you are in the UK or EEA and are unhappy with our response, you can complain to your local data protection supervisory authority.

7. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, database access controls that restrict each account to its own records, and least-privilege access for our own systems. No service can be completely secure, so please use a strong, unique password.

8. Cookies and local storage

We use only essential storage. Your browser holds your login session so you stay signed in, and a random device identifier used to limit free-trial abuse. We do not use advertising or cross-site tracking cookies. You can clear this data through your browser settings, which will sign you out.

9. Children

The Service is not intended for children. Do not use it if you are under the age at which you can enter a contract in your country.

10. Changes to this notice

We may update this notice. Material changes will be reflected in the "last updated" date above, and we will notify you where required by law.