Privacy Policy

When Hubpitch is the controller

• Website visits, demo requests, and marketing interactions on hubpitch.ai
• Account registration, billing, support, and product administration for workspace owners and members
• Security monitoring, fraud prevention, and service reliability
• Product analytics needed to operate and improve Hubpitch as a service

When Hubpitch is the processor

Our customers use Hubpitch to manage leads, send outbound email, publish personalized landing pages, and handle replies. In those workflows, the customer is typically the data controller and Hubpitch processes personal data on the customer’s documented instructions.

Customers remain responsible for having a lawful basis to collect and contact leads, honouring opt-out requests, and responding to data-subject rights for the data they upload or generate in their workspace.

A Data Processing Agreement (DPA) under Article 28 GDPR is available for business customers on request. Enterprise plans may include a custom DPA.

Website and marketing (hubpitch.ai)

• Contact details you submit in demo or inquiry forms (name, email, company, message content)
• Technical data such as IP address, browser type, device information, referrer, and page views
• Cookie and similar-technology data described in the Cookies section below

Account and workspace data (app.hubpitch.ai)

• Account profile data (name, email address, avatar where available)
• Workspace membership, role, invitations, and authentication/session data
• Billing contact details, subscription status, invoices, and payment references processed via Stripe
• Workspace settings, brand profile, sending identities, domains, and configuration metadata
• Product usage data such as feature activity, AI token consumption, send quotas, and audit events

Outbound workflow data processed for customers

• Lead and prospect records (names, email addresses, company details, tags, notes, import metadata)
• Campaign structure, sequence flows, message drafts, send status, and deliverability signals
• Personalized landing page content generated for individual leads
• Outbound and inbound email content, thread metadata, reply handling, and suppression status
• Recipient engagement on published pages (page visits, CTA clicks, block views, booking clicks, and related event metadata)
• AI prompts, completions, embeddings, and token accounting tied to workspace actions

Support, security, and operations

• Messages you send to support and records of those interactions
• Diagnostic, error, and performance telemetry where needed to keep the service secure and reliable
• Immutable audit and erasure logs required for accountability and legal retention

Service delivery

• Provide, operate, and maintain the Hubpitch website and application
• Authenticate users, manage workspaces, and enforce role-based access
• Send and receive email, render personalized landing pages, and run campaign workflows
• Generate AI-assisted drafts, personalization, embeddings, and in-product assistance
• Track page engagement and campaign performance for workspace operators

Billing, compliance, and trust

• Process subscriptions, invoices, and plan limits
• Provide workspace-level and lead-level GDPR export and erasure tooling
• Maintain audit trails, suppression lists, and legally required send records
• Detect abuse, protect deliverability, and keep the platform secure
• Respond to support requests and communicate product or security updates

Legal bases (GDPR)

Where GDPR applies, we rely on one or more of the following legal bases: performance of a contract (Art. 6(1)(b)), legitimate interests in operating and securing a B2B SaaS platform (Art. 6(1)(f)), compliance with legal obligations (Art. 6(1)(c)), and consent where required (Art. 6(1)(a)).

Customers are responsible for determining and documenting the lawful basis for processing the lead and prospect data they upload into Hubpitch.

Marketing website

• Essential cookies and local storage needed for theme preference and basic site functionality
• Vercel Web Analytics on hubpitch.ai to understand aggregate traffic and page performance without third-party advertising cookies

Application

• Authentication and session cookies required to keep you signed in to app.hubpitch.ai
• Functional storage used for product preferences and in-app state

Published landing pages

Pages published by Hubpitch customers may record page visits and in-page engagement events so operators can measure performance. These events are scoped to the relevant workspace and published page context.

Public unsubscribe pages are designed to work without marketing trackers and without requiring recipients to create a Hubpitch account.

International transfers

Some subprocessors may process data outside the European Economic Area. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and vendor contractual commitments.

Choosing an email sending region in Hubpitch can improve delivery paths for recipients but does not by itself guarantee that all data stays in the EU. Customers with strict data-residency requirements should contact us before rollout so we can align hosting, subprocessors, and contractual terms.

Exercising your rights

• Hubpitch account holders: contact contact@hubpitch.ai or use in-product privacy controls where available
• Workspace owners and admins: export workspace data from Settings → Privacy & data
• Lead-level access or erasure requests for data controlled by a customer: contact the organization that contacted you; Hubpitch assists our customers in fulfilling those requests through workspace tooling and support
• Marketing contacts: email contact@hubpitch.ai to update or delete demo or newsletter details