Privacy Policy

Who we are: PitchRoom is operated by Eran Caspary, Tel Aviv, Israel. In this policy, "PitchRoom", "we", "us", or "our" refers to the operator of PitchRoom. PitchRoom is a B2B Proposal, Quoting & Scope Sign-Off Software platform for agencies. This Privacy Policy explains how we collect, use, process, and safeguard personal data in compliance with the EU/UK General Data Protection Regulation (GDPR), the Israeli Protection of Privacy Law, and the California Consumer Privacy Act (CCPA).

1. Data Controller vs. Data Processor Roles

• PitchRoom as Data Controller: For our Agency subscribers (account registration, workspace administration, and billing inquiries), PitchRoom acts as the Data Controller.
• PitchRoom as Data Processor: For client names, scope documents, and client room sign-off events created by an Agency inside PitchRoom, the Agency acts as the Data Controller and PitchRoom acts as the Data Processor on the Agency's behalf.

2. Information We Collect

• Agency Account & Workspace Data: Work email address, agency name, workspace license key, and optional notification webhook or payment redirect URLs configured by the Agency.
• Subscription Billing Data (via Paddle.com): All subscription payments are processed by our Merchant of Record, Paddle.com. PitchRoom does not store raw credit card numbers; we receive only subscription status, plan tier, billing email, and transaction identifiers from Paddle via encrypted webhooks.
• Proposal Room Telemetry & Scope Sign-Off Audit Trail: When a prospective client opens and interacts with a Proposal Room, PitchRoom records:
  • 3-Second Visibility Verification: A human-visibility beacon that triggers only after the room has been actively visible in a browser tab for 3 seconds (filtering out automated link-preview bots and email security scanners).
  • Technical Metadata: Timestamp, coarse country/IP header, and browser user-agent string.
  • Scope Approval Audit Log: When a client approves a scope tier, we record the signatory's full name, title, billing email, selected tier (Option A / B / C), timestamp, and the cryptographic SHA-256 versionHash of the approved scope.

3. How We Use Information

We use collected information solely to:

• Provide, maintain, and secure the PitchRoom proposal and scope sign-off platform;
• Deliver real-time room-open, tier-selection, and scope-approval alerts to the sending Agency;
• Generate verifiable scope approval audit trails and downloadable PDF kickoff deposit invoices;
• Provision software licenses and provide customer support.

4. Data Sharing & Subprocessors

We do not sell personal data to third parties. We share data only with essential infrastructure subprocessors bound by GDPR-compliant Data Processing Addenda:

• Paddle.com Market Limited: Merchant of Record for subscription billing, tax compliance, and invoicing.
• Cloudflare, Inc. & Cloud Hosting Providers: Encrypted HTTPS delivery, DDoS protection, and database hosting.
• Transactional Email Service (Resend): Delivery of instant proposal open and scope sign-off notifications to the Agency.

5. Security & Cryptographic Integrity

Every Proposal Room uses an un-guessable 128-bit identifier (`rm_` + 16 hexadecimal characters) and a SHA-256 `versionHash` of the published scope tiers. All data in transit is encrypted via TLS 1.2/1.3 (`https://` enforced on all external redirects).

6. Your GDPR & CCPA Rights

You have the right to access, rectify, export, or request deletion of your personal data at any time. To exercise these rights, email support@getpitchroom.com. We respond to all privacy requests within 14 days.