Your privacy comes first

1. Information We Collect

When you create an account and use PitchRight, we collect the following information:

• Account information: name and email address received from Google when you sign in with Google OAuth (name and email claims only); your plan tier; and billing identifiers from our payment processors.
• Resume data: the resume files you upload and the structured text we extract from them (skills, roles, employment history) to tailor cover emails to each job.
• Job data: job URLs you paste and the parsed job description, title, company, and location.
• Contact lookups: recruiter and hiring manager details (name, title, company, email) returned to us by our contact-search providers when you request them for a specific job.
• Google user data: described in sections 2 and 3 below.
• Usage & device data: pages visited, actions taken in the app, approximate location (country only, from your IP for currency detection), browser, operating system, and a device fingerprint used solely to prevent abuse of free-tier credits.
• Payment data: processed by our payment partners (Razorpay and Dodo Payments). We receive only an order identifier, status, and plan details — never your full card number or UPI VPA.

2. Google User Data We Access

When you connect your Google account to PitchRight, we request the following OAuth scopes:

• openid, email, profile — used to identify your account at sign-in. We receive your name, email address, Google account id, and avatar URL.
• https://www.googleapis.com/auth/gmail.send — used only to send outreach emails that you compose and explicitly approve inside PitchRight to recruiters you select. This scope lets us create and send a message on your behalf; it does not grant us access to your Gmail inbox, sent folder, drafts, labels, or any other mail content.

We request only the minimum scopes required to operate the features you use. We do not use any broader Gmail scope (such as gmail.readonly, gmail.modify, or mail.google.com).

3. How We Use Google User Data

PitchRight uses Google user data strictly to provide and improve the user-facing features you request:

• Identification: your name, email, and Google account id are used to sign you in and link your PitchRight account to your Google identity.
• Sending outreach emails: the gmail.send scope is used solely to deliver the specific outreach email message you compose and click “Send” on inside PitchRight. The recipient, subject, and body are all set by you; we only transmit the message you have approved.

We do not use Google user data for any purpose other than providing or improving these user-facing features.

4. Google API Services User Data Policy — Limited Use

Affirmative statement: PitchRight's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We do not use Google user data to serve advertisements, including retargeted, personalized, or interest-based advertising.
• We do not sell Google user data, transfer it to data brokers, or share it with information resellers.
• We do not use Google user data — whether raw, aggregated, anonymized, or derived — to create, train, or improve any generalized or non-personalized artificial-intelligence or machine-learning models, whether our own or any third party's.
• We do not allow humans to read Google user data unless we have your explicit consent for a specific message, it is necessary for security investigation (e.g. a confirmed abuse report), or the data has been aggregated and de-identified.
• Because we only hold the gmail.send scope, no Gmail message content is ever read from your mailbox, stored by PitchRight, or forwarded to any AI service. The only content that leaves PitchRight towards Gmail is the outbound email you compose and click “Send” on.

4b. Third-Party AI Services

PitchRight integrates the following third-party AI providers to power resume parsing, resume-to-job matching, and personalized email drafting. Google user data obtained via the Gmail scope is never transmitted to any of these providers.

• OpenAI, L.L.C. — direct API access, paid tier (standard API usage). We send the user's own resume text and the public job description to generate tailored email drafts. Per OpenAI's API Business Terms and enterprise-privacy policy, API inputs and outputs are not used to train OpenAI models, and prompt data is retained for a maximum of 30 days for abuse monitoring.

We do not route requests through any AI aggregator, gateway, hub, or multi-model router. We do not use any self-hosted or offline AI model. If we introduce an additional AI provider or an aggregator in the future, we will update this section before routing any user data to it, and will re-verify compliance with the Limited Use requirements.

5. How We Share Information

We do not sell your personal information or Google user data. We share information only with the following categories of recipients, each under a written data-processing arrangement limiting their use of the data to providing their service:

• Supabase, Inc. — our managed database and authentication provider; hosts your account record, uploaded resume files, and application history.
• Google LLC — receives the outbound email message when you click “Send” so it can be delivered via Gmail on your behalf.
• OpenAI, L.L.C. — processes your resume text and the job description to generate personalized email drafts. Content sent to OpenAI is not used to train their foundation models (OpenAI's API data-use policy).
• Prospeo & Hunter.io — look up publicly available recruiter and hiring-manager contact details for a company you have asked us to search.
• Resend — sends transactional and administrative emails from the PitchRight team (receipts, account notifications).
• Razorpay Software Private Limited and Dodo Payments, Inc. — process your plan purchases. We never see your payment credentials.
• Cloudflare, Inc. — serves our website, provides CDN caching, and protects against abuse.
• Google Analytics — aggregated, non-identifying page-view metrics; does not receive any Google user data obtained through the Gmail scope.

We may also disclose information if required by law, court order, or valid legal process, or to protect the rights, property, or safety of PitchRight, our users, or the public.

6. How We Protect Your Data

We take industry-standard administrative, technical, and organizational measures to protect your personal information and Google user data from unauthorized access, disclosure, alteration, or destruction. These include:

• Encryption in transit: all traffic to and from PitchRight is served exclusively over HTTPS using TLS 1.2 or higher. Insecure HTTP requests are redirected to HTTPS.
• Encryption at rest: your account record, resume files, and application data are stored in managed databases and object storage that encrypt data at rest using AES-256. Google OAuth refresh tokens are additionally encrypted with an application-level secret before being written to our database, so a database-only compromise cannot expose them.
• Access controls: production credentials are accessible only to a limited set of engineers on a need-to-know basis; all access is auditable. Infrastructure access requires strong, unique passwords and multi-factor authentication.
• Principle of least privilege: our application requests only the minimum Google OAuth scopes required (see section 2); internal services use narrowly-scoped credentials.
• Abuse protection: rate limiting, device fingerprinting (used only to block repeat free-tier abuse), and anomaly detection on API endpoints.
• Secure development: all code is reviewed before deployment; dependencies are kept current; automatically scanned for known vulnerabilities.
• Incident response: we investigate and respond to suspected security incidents, and will notify affected users without undue delay in the event of a breach of their personal information, as required by applicable law.

No system is perfectly secure. If you suspect your account has been compromised, please contact us immediately at info@pitchright.in.

7. Data Retention & Deletion

We retain personal information only for as long as reasonably necessary to provide the Service, comply with our legal and accounting obligations, and resolve disputes.

• Account data is retained for the life of your account.
• Resumes, job data, and application history are retained for the life of your account so you can review past applications.
• Google OAuth tokens are retained only while your Google account is connected. If you disconnect Gmail inside PitchRight (Settings → Gmail → Disconnect) or revoke access from your Google Account, we delete the stored tokens within 7 days.
• Payment records are retained for the period required by applicable tax and accounting law (typically 7 years).
• Server logs containing IP addresses and request metadata are retained for up to 90 days for security and troubleshooting, then deleted.

Account & data deletion: you may request deletion of your account and all associated personal information at any time by emailing info@pitchright.in from your registered address, or by using the “Delete account” option inside PitchRight (where available). We will complete the deletion within 30 days, except where we are required to retain certain records to comply with legal obligations (e.g. payment records for tax law).

8. Your Rights & Choices

You have the following rights with respect to your personal information and Google user data:

• Revoke Google access: at any time at myaccount.google.com/permissions. Revocation stops all further Gmail sends initiated through PitchRight; our stored tokens become unusable and are deleted within 7 days.
• Access, correction, portability: you can request a copy of the personal information we hold about you, correct inaccuracies, or receive it in a portable format by emailing us.
• Deletion: see section 7.
• Opt out of analytics: use your browser's “Do Not Track” setting or install an analytics-blocking extension. We also respect the “sec-gpc” Global Privacy Control header.
• Marketing emails: we send only service and account emails. We do not send marketing emails without separate opt-in, and every such email includes an unsubscribe link.

Residents of the EEA/UK (GDPR), California (CCPA/CPRA), and other jurisdictions have additional rights under local law, including the right to lodge a complaint with their data protection authority.

9. International Data Transfers

PitchRight is operated from India. Depending on the sub-processor involved (section 5), your information may be processed in the United States, European Economic Area, India, or other jurisdictions. Where required, we rely on appropriate transfer safeguards such as Standard Contractual Clauses approved by the European Commission.

10. Children

PitchRight is intended for working-age job seekers and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information in error, please contact us and we will delete it.

11. Cookies & Similar Technologies

We use strictly necessary cookies to keep you signed in and remember your preferences (e.g. preferred currency). We also use Google Analytics (Google Analytics 4), which sets analytics cookies to measure aggregated usage of our website. These analytics cookies do not identify you personally. You can block non-essential cookies in your browser or use a privacy extension; the Service will continue to function.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version at this URL and update the “Last updated” date above. If the changes are material — for example, a new use or recipient of your Google user data — we will notify you by email or by a prominent in-app notice before the change takes effect, and where required by law we will obtain your consent.

13. Contact Us

If you have any questions about this Privacy Policy or our handling of your personal information or Google user data, please contact us at info@pitchright.in. We aim to respond within 5 business days.

Data controller: PitchRight — info@pitchright.in — pitchright.in