We collect what we need to make your videos and bill your plan, we don't sell data, and we don't track you with advertising cookies. One thing to know first: videos are public in our gallery by default, with your name on them, and you can make any of them (or all future ones) private.
1. Who is responsible
The data controller is THE VIBECODING AGENCY, 5 rue de la Moselle, 75019 Paris, France (“pitchboom”, “we”). Contact for any privacy question or request: hello@pitchboom.io. No data protection officer is appointed; privacy requests are handled by the managing director.
2. What we collect
Account
Email address, sign-in method (email link, password or Google), display name, username, avatar, bio, preferences (default visibility, email preferences), and how you heard of us if you tell us.
Billing
Plan, subscription status and invoices. Card details are collected and stored by Stripe, never by us; we keep the Stripe customer and subscription identifiers.
Your content
URLs you paste and what we read from those pages (texts, screenshots, logos, colors, fonts), briefs, uploads, Brand Kits, storyboards, voice-overs, music, renders, assistant messages and version history.
Usage and security
Credit ledger and job history, the operations you run, error logs, and abuse-prevention signals (a hashed network identifier, sign-up attempts). We store hashes, not raw IP addresses, for rate limits and view counts.
Public pages
For public videos: likes (who liked what, visible only to the person who liked), reports (visible to the reporter and our moderators), and a daily-deduplicated view counter based on a keyed hash of the viewer's IP address and browser (kept 30 days, never the IP itself).
Measurement
We don't use advertising cookies or trackers. We count visits with cookieless first-party tools: Vercel Web Analytics and Speed Insights (aggregated, no cookies), and our own anonymous landing counter (page, referring website, utm parameters, country and device type, without any identifier). We also count visits from search engines and AI crawlers by their user agent.
3. Why we use it, and on what basis
- Providing the service (account, generation, storage, downloads, support): performance of our contract with you.
- Billing and accounting: contract and legal obligations (tax and accounting records).
- Public gallery pages: our contract with you (videos are public by default, and you choose per video and as an account default); you can make videos private at any time.
- Security, fraud and abuse prevention, moderation: our legitimate interest in a safe service.
- Service emails (sign-in, video ready, billing): contract. Optional emails follow your email preferences and can be turned off in settings or from any email.
- Anonymous measurement of the public site: our legitimate interest in understanding how the site is found, without identifying anyone.
4. Public videos
Videos are public by default: once ready, a video is listed in the gallery with an indexable page showing the video, its title, its on-screen texts and voice-over script, and your display name and username, with a link to your creator page (only shown when you have at least one public video). Search engines and AI assistants may index and cache these pages.
Make a video private in the editor, on the results page or from its public page; set “private” as your default in settings. A private video leaves the gallery and its page within minutes. Copies already indexed by search engines disappear when they recrawl the page. Nobody but you can download your videos; we protect the original files, but we can't prevent screen recording of a public video.
5. Who processes data for us
We share data only with providers that run parts of the service for us, under data processing agreements:
- Supabase: Database, authentication and file storage (accounts, projects, videos, uploads). Location: EU (Ireland).
- Vercel: Website hosting, serverless functions, cookieless traffic analytics and performance metrics. Location: Global edge network; functions in the EU (Dublin, Ireland).
- Railway: Rendering servers (storyboards, voice-over, music, video renders), and, when you connect source code, its filtering, analysis and the isolated rendering of the scenes rebuilt from it. Location: EU (Amsterdam, Netherlands).
- Stripe: Subscriptions, payments, invoices and tax calculation. Location: EU / US (Stripe's own safeguards).
- Resend: Transactional emails (sign-in links, video ready, billing notices). Location: EU sending region (Ireland); US company (standard contractual clauses).
- Anthropic and OpenAI: Language models (Anthropic Claude first) that analyse your page, write scripts and run the assistant; OpenAI as a fallback, plus text-to-speech and transcription, and, when you connect it, your source code (Anthropic only, never OpenAI; never used to train AI models). Location: US (standard contractual clauses).
- ElevenLabs: Voice-over generation with word timings. Location: US (standard contractual clauses).
- Google: “Continue with Google” sign-in, if you choose it; web fonts. Location: Global.
AI providers receive the content needed for each request (the page text, your brief, the script) to generate the output; they don't receive your billing data. Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses or an adequacy decision. We never sell personal data.
6. Source code you connect
You can connect your product's source code (a GitHub repository, a folder you upload, or from Claude Code) so your videos show your real interface. Connecting code is optional and needs your explicit consent each time; you must own the code or be allowed to share it.
What we read
Your design tokens (colors, fonts, spacing, motion curves), logos and icons, the words and facts of your product, its routes and the UI components worth showing. Folders such as node_modules, .git and build output are skipped, and environment files and private keys are never uploaded from your browser or by our packing command. Secrets found in the code (API keys, tokens, passwords) and personal data in sample files are removed before anything is read by an AI model.
Where it is stored and who processes it
The filtered code is encrypted with a key of its own (AES-256-GCM) in our storage in the EU (Supabase, Ireland); no pitchboom page or admin tool can open or download it. It is processed on our servers in the EU (Railway, Amsterdam: filtering, analysis and an isolated, offline renderer for the scenes rebuilt from it) and by Anthropic (United States, under the European Commission's standard contractual clauses), which writes the scenes. Code is never sent to any other AI provider and is never used to train AI models. It is never shown to anyone, never published, and used only to make your videos.
How long we keep it
You choose 1, 7, 30 (default) or 90 days when you connect it. On that date, or when you press “Delete now” (Settings → Connected code), its key is destroyed and the stored code is deleted. What stays: Brand Kits you saved, rendered videos, and, for videos with scenes rebuilt from your code, the compiled scenes needed to edit or re-render that video (minified, encrypted, deleted with the video). Deleting your account deletes everything at once. A GitHub connection is read-only, limited to the repositories you pick, and can be removed in Settings or on GitHub at any time.
Legal basis: your consent (withdraw it at any time by deleting the code) and our contract with you for the videos you order. Videos made from code start private.
7. How long we keep it
- Account and content: as long as your account is open. Deleting a video removes it from your library and the gallery; deleting your account deletes or anonymises your data, except what we must keep.
- Invoices and accounting records: as long as accounting law requires (typically 10 years).
- Security logs and rate-limit counters: up to 12 months. View-counter hashes: 30 days. Anonymous landing and crawler counts: up to 400 days.
- Moderation reports: as long as needed to handle them and defend against claims.
8. Your rights (GDPR)
You can access, correct, export (portability) and delete your data, object to processing based on legitimate interest, restrict processing, and withdraw any consent. Most of it is self-service: edit your profile and preferences in settings, make videos private, download your videos, and delete your account. For anything else, email hello@pitchboom.io; we answer within one month.
You can also complain to your data protection authority (in the EU, the authority of your country of residence or of our establishment: the CNIL, Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr).
9. Cookies and local storage
- Authentication cookies (Supabase session) to keep you signed in: strictly necessary.
- Local storage: the link or brief you type on the homepage before signing up (kept 24 hours so the sign-up page can continue it), and small flags so a view or a landing is counted once per session.
- No advertising or cross-site tracking cookies.
10. Security
Data is encrypted in transit; files are stored in private storage buckets and served through short-lived signed links. Access inside the company is limited to people who need it to run the service. If a breach affects your data, we notify you and the authority as the law requires.
11. Children
pitchboom is for professionals and adults. We don't knowingly collect data from anyone under 18.
12. Changes
We update this policy when the service changes; material changes are announced by email. See also the terms of service and the content policy.