Privacy Policy

1. Introduction

pitchera.ai("we", "us", "our") is a pitch deck analysis service operated by Wojciech Buła, a sole proprietor trading as Blackgate Consulting. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website and services at pitchera.ai. Processing is governed by Regulation (EU) 2016/679 (GDPR) and Polish data-protection law. By using our service, you agree to the practices described herein.

2. Data controller

The data controller responsible for your personal data is:

Wojciech Buła, sole proprietor trading as Blackgate Consulting
Registered place of business: ul. Racławicka 100/19, 53-146 Wrocław, Poland
Tax ID (NIP): 8941846779 · EU VAT ID: PL8941846779
REGON: 527197049
Registered in the Central Register and Information on Economic Activity (CEIDG) (CEIDG)
E-mail: [email protected]
Phone: +48 573 895 100

We have not appointed a Data Protection Officer; for any data-related inquiry contact us via the email or phone number above.

3. What data we collect

We collect the following categories of data:

• Email address — provided during upload, used to verify the Free Snapshot request and deliver transactional result or paid-report messages.
• Pitch deck file — the PDF you upload for AI analysis and, if you choose an upgrade, reuse in the paid analysis without another upload.
• Business context (BSA questionnaire) — optional short text answers about your company and target customers, used solely to improve the relevance of your report.
• Billing data — for B2B purchases, full billing details (name, address, Tax/VAT ID) collected by Stripe Checkout and returned to us so we can issue an invoice.
• Payment data — processed entirely by Stripe. We receive only a payment status and the last four digits of the card; we never see or store the full card number.
• Usage and consent data — browser type, device type, referring URL, pages visited, timestamps, campaign parameters, and your cookie/marketing preferences. Collected via server logs and optional analytics or marketing tools only according to your consent choices (see Section 9).
• Abuse-prevention and funnel data — keyed hashes of email, IP, device and deck, a pseudonymous funnel identifier, operational status, model cost and timing. These records do not contain deck or report text.

We do not collect passwords, government IDs, phone numbers, or any other personal information beyond what is listed above.

4. Purposes and legal bases (GDPR Art. 6)

• Contract performance (Art. 6(1)(b) GDPR) — verifying and delivering the Free Snapshot you requested, processing a paid upgrade, and reusing the retained deck for that upgrade.
• Legal obligation (Art. 6(1)(c) GDPR) — issuing invoices and retaining accounting records for the period required by Polish tax law (5 years from the end of the tax year).
• Legitimate interests (Art. 6(1)(f) GDPR) — replying to support inquiries and ensuring service security (server logs, abuse protection).
• Consent (Art. 6(1)(a) GDPR) — optional analytics and marketing tags, and where we explicitly request it (e.g. your express consent to begin performing the digital service before the 14-day withdrawal period expires; see Terms §9), your request on a Free Deck Review result page to be considered for an investor intro (see Investor intros), and your choice, at a paid upload or later in your dashboard, to let matching investors see your paid analysis (see Matched investors).

5. Data retention

• Unverified Free Snapshot upload — deleted after 7 days.
• Completed Free Snapshot deck, online result, PDF and feedback — deleted after 60 days. A change to either Free Snapshot period applies to uploads made after it takes effect; an earlier upload keeps the period that applied when it was made.
• Free Deck Review you asked us to consider for an investor intro - deck, online result and PDF are kept for 12 months from your consent instead of 60 days. Withdrawing the consent returns them to the 60-day period counted from upload; if that date has already passed, they are deleted within a day.
• Pseudonymous Free Snapshot funnel and cost ledger — up to 90 days; it excludes email, deck/report text, company name and active access tokens.
• Anonymized research statistics — when a Free Snapshot expires, we retain its numeric dimension scores and coarse metadata (sector category, funding stage, deck length, upload date) in fully anonymized form, indefinitely. These records contain no email address, no deck or report text, no file name and no company name, and are used solely for aggregate research we may publish (for example deck-quality benchmarks).
• Paid analysis - uploaded deck file - automatically deleted 180 days after report generation.
• Paid analysis - generated report (online report, PDF and its link) - kept so that you keep access to the report you paid for, until you delete it with Delete your data or ask us by email. A report you made visible to matching investors stays visible to them until you switch visibility off in your dashboard or the report is deleted.
• Email and order metadata — up to 12 months from the last activity, then anonymized or deleted.
• Invoices and accounting records — 5 years from the end of the tax year in which the invoice was issued (legal obligation).
• Server logs and analytics — up to 12 months.

You can request deletion at any time — use the delete-data form and all your files, analyses, and personal data will be permanently removed (except accounting records we are required to keep).

6. Security

We use industry-standard security measures including TLS encryption in transit, encrypted storage at rest, access controls limiting who can view stored data, and encrypted off-site backups (rclone crypt to GDrive). Despite these measures, no method of transmission or storage is 100% secure; we cannot guarantee absolute security.

7. Recipients (sub-processors)

We share the minimum necessary data with the following providers, under data-processing agreements (Art. 28 GDPR):

• Stripe Payments Europe, Ltd. — payment processing and invoicing. Stripe Privacy Policy.
• Anthropic, PBC (Claude API) — AI analysis. Anthropic does not use API inputs for model training. Anthropic Privacy Policy.
• Resend (Plus Five Five, Inc.) — transactional email delivery. Resend Privacy Policy.
• Umami Software, Inc. — privacy-first analytics, loaded only if analytics consent is granted. Umami Privacy Policy.
• Google Ireland Ltd. — optional analytics, Google Ads conversion measurement, and campaign performance measurement, loaded only according to your analytics and marketing consent choices. Google Privacy Policy.
• Cloudflare, Inc. — DNS, CDN, and DDoS protection. Cloudflare Privacy Policy.

Google Ireland Ltd. also provides the YouTube player on our blog posts. It is loaded only when you press play, and Google acts there as a separate controller, not as our processor (see Section 9).

We do not sell, rent, or share your personal data for any marketing purposes.

Investor intros (only at your request). On your Free Deck Review result page you can ask to be considered for an intro. If you do, we may send your deck - and, if you chose it, the review summary - to an investor or fund we work with. Decks are selected by hand and there is no guarantee of contact. The investor receives the material as a separate controller under its own privacy terms. We do not add your email address; contact details already in your deck travel with it. Nothing is shared without this consent. You can withdraw it on the result page at any time; withdrawal stops further sharing but cannot recall a copy already sent.

Matched investors (paid analyses, only if you opt in).When you upload a deck for a paid analysis you can tick “Let matching investors see this report”, or switch the same option on later in your dashboard once the report is ready. It is off by default and never required. Analyses submitted through an accelerator programme or by an investor are not eligible. If you opt in and the report scores 70 or more, the analysis can appear in the dashboard of investors (funds and angels with an investor account on pitchera.ai) whose stated focus - sector and stage - matches your company. They see the company name, sector, stage, one-line summary, score and cover image, and can open your full report through its link, including any contact details your deck contains. We do not show them your email address and we do not notify you when your analysis appears in a feed. An investor who opens the report acts as a separate controller for what it does with it. You can switch visibility off at any time in your dashboard; this stops further access but cannot undo what an investor has already seen.

AI assistants connected by investors.The holder of an investor account can connect an AI assistant of its choice (for example Claude or ChatGPT) to its own pitchera.ai dashboard, read-only. The assistant then reads only that investor's dashboard: analyses of decks the investor uploaded or received through its submission form, with scores, due diligence, notes and pipeline stages. This can include information from the decks, including personal data of the company's team, and - for decks sent through the investor's submission form - the sender's name, email address and message. It reaches the assistant's provider on the investor's instruction; the investor and its provider act as separate controllers for it. Analyses an investor sees only as matched investors (above) are not included. On our side we keep a record of the connection (who connected which assistant and when), access tokens only as cryptographic hashes, and a security log: for each read the tool, which startup or document, the time, the person who connected the assistant, the IP address and the client identifier (user agent), kept for 90 days; sign-in and revocation events are kept for up to 365 days like other activity records. We do not receive the conversation with the assistant. The investor can disconnect an assistant at any time in the dashboard settings.

8. International transfers

Some of our providers (Stripe, Anthropic, Resend, Cloudflare) are based in the United States. Transfers outside the EEA are protected by Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 and, where applicable, by the recipient's participation in the EU–US Data Privacy Framework (Commission decision of 10 July 2023).

9. Cookies and analytics

We use a consent manager for optional analytics and marketing technologies. You can accept, reject, or change your choices at any time using the “Cookie settings” link in the website footer.

• Essential cookies — required for the service to function (e.g. your Stripe checkout session). Set only when you actively use that functionality.
• Analytics — optional aggregate measurement of page views, referrers, campaign performance, and product usage. Analytics is disabled unless you grant consent.
• Marketing — optional conversion measurement and advertising signals, such as Google Ads conversion tracking, used only if you grant marketing consent.
• Films on blog posts (YouTube) - some articles offer a film version. The page shows only a picture stored on our own server; nothing is requested from YouTube until you press play. When you do, the player is loaded from YouTube's privacy-enhanced domain (youtube-nocookie.com), operated by Google Ireland Ltd. From that moment Google receives your IP address and technical data about your browser and device, learns that the player was opened on pitchera.ai, and may store data on your device, as it would if you opened the film on YouTube. Pressing play is your consent to that connection (Art. 6(1)(a) GDPR). Google processes this data as a separate controller under the Google Privacy Policy. This does not depend on your analytics or marketing choices: if you do not press play, no connection to YouTube is made.
• Product data separation — your deck files, briefing answers, AI reports, founder/company details, and payment data are not sold and are not used for ad targeting.

10. Your rights

Under the GDPR you have the rights of:

• access (Art. 15),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing based on legitimate interests (Art. 21),
• withdrawal of consent at any time, where processing is based on consent (Art. 7(3); withdrawal does not affect lawfulness of prior processing).

To exercise the right of erasure you can delete your data directly. For all other rights, email [email protected] — we will respond within 30 days.

11. Right to lodge a complaint

You have the right to lodge a complaint with the Polish supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, Polska (uodo.gov.pl), or with the supervisory authority in your country of residence within the EEA.

12. Automated decision-making

Your pitch deck content is analyzed by an AI model (Anthropic Claude). The output is advisory and informational — it does not constitute a decision that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22(1) GDPR. Each report is a document for further evaluation by you; the controller does not make automated decisions about you on its basis.

13. Children's privacy

Our service is not directed at individuals under 18. We do not knowingly collect personal data from minors. If we become aware of such data, we will delete it promptly.

14. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. If the changes materially affect your rights, we will notify you by email at the address provided with your order.

15. Contact

Questions about this Privacy Policy can be sent to [email protected], by phone at +48 573 895 100 or in writing to the address of business: ul. Racławicka 100/19, 53-146 Wrocław, Poland.