Privacy Policy

This policy explains what personal data Pitched In collects, why, who can see it, how long we keep it, and your rights. It applies to pitchedin.app and its apps (the "Service"). Sections 11–13 add what European, Mexican and Californian law require.

1Who is responsible

Pitchedin App LLC, a Florida limited liability company in Miami, Florida, United States ("Pitched In", "we") is responsible for your personal data: the controller under European law, and the responsable under Mexican law.

• Contact for privacy questions and requests: support@pitchedin.app.

2What we collect

When you create an account

• your email address, which you sign in with (we email you a one-time code);
• your language, and a time zone setting used for email timing (New York time unless it's changed);
• if you set up two-step login, the secret your authenticator app uses.

If you request an invite (the form on our front page, for an A&R inbox)

• your name, the email you give, your role, and if you add them, your company and a link (credits or LinkedIn);
• your language, and the network address you send from, used only to stop repeated requests.

If someone invites you to an A&R inbox (by QR code or link)

• the invite you used, and the founding seat it gave you: its number and when you took it;
• the inbox you then create, as for any A&R (below).

If you're a composer

• your name, your roles (composer, producer, artist or other), your phone number (the country you pick is used to read the number and isn't saved), and a contact email (if you leave it blank, we use your sign-in email);
• the songs you send:
  • the audio file and its original filename, format and size;
  • the title, your note, who it's pitched for and the credits;
  • for songs sent as a Dropbox, Google Drive or Box link: the link, and a copy of the file we fetch from it;
• the collaborators you credit (name, role, and the phone and email you enter for them), which we save so you can reuse them;
• your list of A&Rs (when you first and last sent to each) and any groups of A&Rs you make.

If you're an A&R or a member of an A&R inbox

• the inbox's name, link, settings (for example, invite-only and the morning email), members (email and role) and pending invitations (the invitee's email and role);
• what you add:
  • folders, including the name, phone and email you enter for a composer you add by hand;
  • private notes, Favorite/Hold/Pass decisions, notes for composers, and briefs;
• the composers you block.

Activity in the Service

• Songs: when songs are sent and delivered, which account played which song and when, where you stopped in each song, songs marked as heard, and download requests, approvals (including "always allow") and downloads.
• Sign-ins: sign-ins, sign-outs and two-step changes. For these we record the IP address and the browser/device description (user agent). When anyone asks for a sign-in code, we also keep the IP address for one day to limit abuse.
• Changes: which account changed folders, decisions, sent songs, inbox members and settings, or composer profiles, and which fields changed.
• Emails: the emails we send you: sign-in codes, download requests and approvals, expiry warnings, and the morning email. When a composer deletes their account, the next morning email to each inbox they sent to mentions it, with their name.

Cookies. We use only cookies the Service needs:

• the sign-in session;
• the email a sign-in code was just sent to (pi_code, kept for 10 minutes), so the code screen stays open if the page reloads;
• your language choice (NEXT_LOCALE, kept for one year);
• Cloudflare's bot check on the sign-in page and the front page's invite form (Turnstile), which runs in a frame from challenges.cloudflare.com and can set cookies there, such as cf_clearance, to tell people from bots.

We don't use advertising or analytics cookies, and we don't track you across other websites. Our Cookie Policy has the details.

What we don't collect: payment details (the Service is free during its pilot), or sensitive data such as health, beliefs or ethnicity. Please don't put sensitive data in notes or songs' details.

3Why we use it, and on what legal basis

We don't sell personal data. We don't use it for advertising or profiling, and we don't use your songs to train artificial-intelligence models. We don't make decisions about you by automated means alone that have legal or similarly significant effects.

4Who can see what inside Pitched In

• When a composer sends a song, the A&R inbox receives:
  • the song and its details;
  • the composer's name, phone and contact email;
  • the credits, including collaborators' contact details.
  All members of that inbox see it. A&Rs in other inboxes don't.
• Composers see:
  • the names and links of the A&Rs they send to, and of A&Rs who added them by email before they sent anything;
  • for each copy of a song: whether it was received and heard, Hold or Pass with any note the A&R wrote for them, and whether and when it left the inbox (removed, expired or taken back).
  Composers never see an A&R's Favorites, private notes, who a song is held for, or any A&R's or assistant's email address.
• An inbox's owner sees which member played which song (by the member's sign-in email), for the last 100 plays.
• When a song goes to several A&Rs, each A&R sees only their own copy and doesn't learn who else received it.
• The Pitched In team can see account details (email, account type, plan, storage used and activity dates) to run the Service and help you, for example after a lost phone. We never open your songs, notes or messages to do that.
• Invite requests from the front page are seen only by the Pitched In team, in our support mailbox, to decide on them. A&Rs and composers don't see them.
• Founding seats: the person who invited you sees your seat number, when you took it, and your inbox's name once you've named it (an inbox's name and link are public anyway). The person who invited you doesn't see your email. Each inviter sees only their own invites.

5Service providers and other recipients

We use these providers to run the Service. They process data on our behalf, under contract:

Links you paste: when you send a song as a link, we fetch the file from Dropbox, Google Drive or Box using that link. They see our request, not your account. A Google API key may be used for Drive links.

Other recipients: we may also disclose personal data:

• to the parties to a dispute about a song, limited to the relevant records (for example, when it was sent, delivered, played or downloaded);
• to authorities or courts when the law requires it, or to protect someone's safety or rights;
• to a company that takes over the Service, which must keep this policy's promises or tell you first.

6International transfers

The Service is run from the United States, so your data is stored and processed there.

• For people in the European Economic Area and the UK: we rely on the European Commission's Standard Contractual Clauses with our providers. Where a provider is certified under the EU-US Data Privacy Framework, we rely on that too. Contact us for a copy of the safeguards.
• For people in Mexico: sending data to the providers above is processing on our behalf (remisión) and doesn't need your consent.

7How long we keep data

• Account and profile: while your account exists. When you delete your account in Settings, we delete your profile and songs, and your songs leave every inbox. An inbox keeps the folder it had for you, with the name it shows for you and its own notes, and our record of the deletion keeps your name. If you're the only owner of an A&R inbox, deleting your account closes the inbox and deletes what's in it. Composers who sent songs there keep their record of sending them.
• Your sent history: the record of where you sent each song (the A&R, the title and the dates) stays in your account while it exists, even after a song leaves an inbox.
• Songs in an A&R's inbox:
  • Standard: 90 days after they arrive, unless the A&R keeps them longer.
  • Favorites and holds: they stay until the A&R removes them.
  • Deleting: an A&R may delete them at any time.
  When no inbox has a song any more, we delete the file.
• Copies an A&R downloaded with your approval are outside our control.
• Security and activity records (the audit log): 2 years, then deleted. Records about a deleted account may be kept for that period to protect against abuse and to resolve disputes.
• Sign-in code requests: the IP address is kept for one day.
• Invite requests: kept for up to 12 months, including the copy in our support mailbox, then deleted.
• Invites to an A&R inbox: kept while the inviter's account exists.
• Founding seats: the record of your seat (its number, when you took it and the invite it came from) is kept while your account exists. If you delete your account, the number stays retired and the record no longer points to you. If you don't finish setting up your inbox within 7 days of taking a seat, the seat goes back and its record is deleted.
• Unsent uploads: files that are uploaded but never sent are deleted within two days.
• Backups: up to 7 days.
• Email delivery logs at our email provider: kept for their standard period of 30 days.

8Your rights

You can see, correct, export and delete your data:

• In the Service: you can see and edit most of it in Settings, and delete your account there.
• By email: write to support@pitchedin.app for anything else. That includes a copy of your data, objecting to or restricting a use, or withdrawing consent where we rely on it.

We answer within one month (sections 11 and 12 have the exact deadlines). We may need to confirm it's you first.

9Security

• Accounts: sign-in uses one-time email codes, a bot check, and two-step login (required for A&Rs).
• Files: stored privately and only reachable through short-lived signed links.
• Database: access rules let each person see only what they should.
• Connections: encrypted in transit.
• Records: we log sensitive actions.

No system is perfectly secure. If a breach affects you, we'll tell you as the law requires.

10Age

The Service is only for people 18 and over. If we learn we have data about someone under 18, we delete it.

11People in the European Union and Spain

• Who and how: we process your data as described above, on the legal bases in section 3.
• Your rights under the GDPR: you have the rights of access, rectification, erasure, restriction, objection and portability, and the right not to be subject to solely automated decisions.
• No EU representative or DPO: we don't currently offer the Service in the European Union, so we haven't appointed an EU representative, and we haven't appointed a data protection officer.
• Complaints: you may complain to your data protection authority. In Spain that's the Agencia Española de Protección de Datos (www.aepd.es).
• Deadline: we answer requests within one month. We may extend that by two more months for complex requests, and we'll tell you if we do.
• What's required: your email is required to create an account. To send songs, your name, at least one role and your phone number (with its country) are required, so A&Rs know who sent them; without them you can't send songs. Everything else is optional.

12People in Mexico (aviso de privacidad)

This section and the rest of this policy form our integral privacy notice under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (2025):

• Responsible party: Pitchedin App LLC, Miami, Florida, United States. Email: support@pitchedin.app.
• Data processed: see section 2. We don't process sensitive data.
• Purposes:
  • Primary: the purposes in section 3. They're necessary for the Service.
  • Secondary: we have none, so there's nothing to opt out of.
• Transfers: we don't transfer your data to third parties for their own use. The exceptions are those allowed by law without consent (for example, to authorities, or to protect rights in a legal process) and those in section 5. Providers that process data for us receive remisiones.
• ARCO rights: to access, rectify, cancel or oppose, or to limit use or disclosure or revoke consent, email support@pitchedin.app. Include:
  • your name and email;
  • a document proving your identity, or that of your representative;
  • a clear description of the data and the right you're exercising;
  • anything that helps us find the data.
  What happens next: we answer within 20 business days, and if your request is granted, we act on it within 15 business days after answering. If a request needs more time, we may extend either period once, by the same length, and we'll tell you.
• Changes: we announce changes to this notice in the Service and by email, as described in section 15.
• Authority: you may contact the authority responsible for personal data protection in Mexico, the Secretaría Anticorrupción y Buen Gobierno.

13People in California

• Categories: section 2 lists the categories of personal information we collect, and section 5 the categories of parties we share it with.
• Corrections: you can review and correct your information as described in section 8.
• No sale or sharing: in the past 12 months we haven't sold or shared personal information, as California law defines those words, and we don't. We don't knowingly collect personal information about anyone under 16.
• Sensitive information: the only sensitive personal information we hold is what you sign in with (your two-step secret), and we use it only to sign you in.
• Your rights: you can ask to know, correct or delete your information (section 8). We won't treat you differently for using these rights.
• Requests: email support@pitchedin.app. We confirm it's you, usually with a code sent to your account's email. An authorised agent can ask for you if they show your signed permission, and we may still confirm your identity with you.
• Do Not Track: we don't track users across websites, and no third party tracks you on our Service. So we treat Do Not Track signals no differently.

14People you credit, and people A&Rs add by hand

If a composer credits you on a song, or an A&R adds you as a composer by hand, we may hold your name, role, phone or email without having collected them from you. The composer or A&R provided them. We use them to show the credit or folder to the inboxes involved. If an A&R adds you by email and you later sign in with that email, that A&R appears in your list of A&Rs. Our legal basis is the legitimate interest of the composer, the A&R and us in showing who worked on a song and who sent it. We keep these details as long as the song or folder is in the Service.

You have the same rights as any other user (sections 8, 11 and 12). Contact us at support@pitchedin.app.

15Changes to this policy

We'll update this policy when the Service or the law changes. For a change that matters, we tell you in advance by email or in the Service. The date and version at the top always show the current policy.