Privacy Policy

1. Who we are

Pitch Back (pitch-back.com) is operated by Sovereign Data Solutions SARL, a company incorporated under the laws of France, which acts as data controller for the personal data described below. Contact: mohand@kreezalid.com.

2. What we collect, and why

We only process what the service needs to work:

• Account data — your email address, provided by your Google account at sign-in, and a display name (prefilled from your email address, editable at any time). Purpose: identifying you and your mailbox. We deliberately do not request access to your Google profile.
• Encrypted OAuth access and refresh tokens — the credentials Google issues after your explicit consent, stored encrypted at rest (AES-256-GCM). Purpose: reading incoming mail, sending your replies, archiving threads. They are never shared and are revoked on account deletion.
• Your reply template — the text you wrote. Purpose: sending it, verbatim.
• Detection records — for each email classified as prospecting: sender name and address, subject line, score, triggered rules, status and dates. We never store the bodies of your emails : message content is held in memory only for the time needed to analyze it, and legitimate mail leaves no trace in our database.
• Local reputation data — sender addresses you whitelist and domains that were pitched back. Purpose: never contacting your real correspondents, and catching repeat prospectors.

Legal bases under GDPR: performance of the service you signed up for (art. 6(1)(b)) and your explicit consent for mailbox access (art. 6(1)(a)), which you can withdraw at any time.

3. Google user data & Limited Use

Pitch Back's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: Gmail data is used solely to provide the features described above ; it is never sold, never used for advertising, never used to train AI or machine-learning models, and never read by humans except with your explicit permission for support, for security purposes, or where required by law.

4. How long we keep data

• Detection records, template, whitelist, tagged domains — until you delete them or your account.
• OAuth tokens — until you disconnect your mailbox or delete your account.
• Technical server logs (errors, sync activity) — rotated and deleted after 14 days. They may contain email addresses of senders, never email bodies.

Account deletion (the “Danger Zone” on your Account page) is immediate and permanent : all the data above is erased and our access to your mailbox is revoked.

5. Who can access your data

Nobody but you and the infrastructure that runs the service. We do not sell or share personal data. Our processors: OVH (hosting, France/EU) and Google LLC (Gmail APIs — transfers covered by the EU–US Data Privacy Framework and standard contractual clauses). No analytics or advertising trackers are used, on the site or in the app.

6. Cookies

Pitch Back uses exactly two cookies, both strictly technical : a session cookie to keep you signed in, and a CSRF token to protect forms. No tracking, advertising or third-party cookies — which is why there is no cookie banner.

7. Security

All traffic is encrypted in transit (TLS), and OAuth tokens are encrypted at rest (AES-256-GCM, dedicated key). Access to production systems is restricted and key-based. Mailbox access uses OAuth exclusively — we never see or store your Google password, and you can revoke our access at any time from your Google security settings.

8. Your rights

Under GDPR you have the right to access, rectify, export and erase your personal data, to restrict or object to its processing, and to withdraw consent at any time. Most of these are self-service : your data is visible in the app, your name is editable, and deletion is one confirmation away in the Danger Zone. For anything else, email mohand@kreezalid.com — we answer within 30 days. You may also lodge a complaint with your supervisory authority (in France : the CNIL).

9. Age

Pitch Back is not directed at children and requires users to be at least 16 years old. We do not knowingly process data of anyone younger; if you believe we do, contact us and we will delete it.

10. Changes

We will update this policy as the product evolves (for example when Outlook support ships) and announce material changes on this page with an updated date above.