Privacy policy

Last updated: June 2026

PitchBuilder Ltd ("we", "us", "our") is committed to protecting the privacy, security, and confidentiality of personal data and business materials. This Privacy Policy explains how we collect, use, and safeguard personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy is provided for transparency and does not seek your consent except where expressly stated; we process personal data on the lawful bases described in Section 4. PitchBuilder Ltd is the controller of the personal data described in this policy. We are a private limited company registered in England and Wales (Company Number 13817536), with our registered office at Exchange Building, 66 Church Street, Hartlepool, England, TS24 7DN. We can be contacted at hello@pitchbuilder.io.

1. Who This Policy Covers

This policy applies to: (a) visitors to pitchbuilder.io (the "Site"); (b) clients who purchase our products or engage our services; (c) individuals who contact us or sign up to receive communications from us; and (d) individuals whose professional information is featured in our investor databases and other data products (see Section 6, which applies specifically to those individuals).

2. Information We Collect

We restrict data collection to information required to deliver our products and services, process payments, maintain security, communicate with you, and meet our legal obligations:

  • Identity and contact data: name, business entity name, email addresses provided at checkout or via correspondence, billing addresses, and telephone numbers.
  • Transaction and billing data: records of digital downloads purchased, service packages booked, invoice tracking numbers, and historical payment statuses. All online payment processing is executed via secure, third-party PCI-DSS compliant gateways (Shopify Payments, Stripe, or PayPal). PitchBuilder Ltd never views, handles, or stores your raw credit card or bank account credentials.
  • Proprietary business materials (service data): strategic business assets shared by you during consulting engagements, including financial models, cap tables, draft pitch decks, growth metrics, and executive summaries.
  • Marketing data: email addresses provided when you sign up for reminders, updates or other communications, and your marketing preferences.
  • Technical data: information collected automatically when you use the Site, such as IP address, browser type and usage data, collected via cookies and similar technologies (see Section 8).

3. How We Use Personal Data and Our Lawful Bases

Under the UK GDPR, we process personal data on the following lawful bases:

  • Performance of a contract (Article 6(1)(b)): to process checkouts, deliver download links, fulfil consulting engagements, and provide customer support.
  • Legal obligation (Article 6(1)(c)): to comply with UK statutory accounting, VAT and tax record requirements administered by HMRC, and other regulatory obligations.
  • Legitimate interests (Article 6(1)(f)): to protect our platform against fraud, verify licence and usage limits, enforce our agreements, defend against invalid payment disputes, compile and maintain our investor databases (see Section 6), and send relevant marketing to business contacts and existing customers, in each case where our interests are not overridden by your rights and interests.
  • Consent (Article 6(1)(a)): where you sign up to receive email reminders or updates, and for non-essential cookies. You may withdraw consent at any time.

4. Marketing Communications

If you sign up to receive a reminder or updates from us, or purchase from us, we may send you emails about our products and services in accordance with the Privacy and Electronic Communications Regulations 2003. Every marketing email we send contains an unsubscribe link, and you can opt out at any time by using that link or contacting hello@pitchbuilder.io. We do not sell or share your details with third-party marketers.

5. How We Protect Your Business Data and Confidentiality

We understand the sensitive nature of early-stage fundraising and proprietary business ideas. We protect your materials through practical operational safeguards:

  • Access minimisation: internal access to your pitch files, metrics, and models is strictly limited to the members of our delivery team assigned to your specific project. Where that team includes specialist creative professionals, such as designers, they work under our direction and are bound by written confidentiality (NDA) obligations to us before receiving access to any client materials.
  • Secure storage: all documents, files, and deliverables are transmitted and stored securely within password-protected cloud storage platforms.
  • Confidentiality and NDAs: our Terms of Service contain contractual confidentiality obligations, and we are prepared to review and execute formal Non-Disclosure Agreements for service packages upon request prior to project kickoff.

6. Individuals Featured in Our Investor Databases

Our data products, including the UK Investor Database, contain information about investment firms and organisations. Where those products include information relating to identifiable individuals (for example, individual angel investors or named points of contact), this Section explains how we handle that data.

  • What we collect: professional information only, such as name, firm or syndicate, contact details that investors have themselves published or made public, LinkedIn profile URL, investment focus, stage, sector and cheque-size preferences, and application or pitch submission details. We do not collect special category data, and we do not knowingly include private or non-professional information.
  • Where it comes from: publicly available sources, including investors’ own websites, public LinkedIn profiles, published portfolio and fund information, and other materials investors have made public, typically for the express purpose of receiving approaches from founders. Each entry is periodically re-verified.
  • Why we process it (lawful basis): our legitimate interests, and those of our customers, in connecting founders with investors who publicly invite pitches and applications (Article 6(1)(f)). We have assessed that this processing is within the reasonable expectations of individuals who publish their professional investment criteria and contact routes, and that it does not override their rights and interests.
  • Who receives it: purchasers of our data products, under licence terms that limit use to investor research and fundraising outreach, prohibit redistribution and resale, and require purchasers to comply with applicable law in any outreach. Each purchaser is an independent controller of the data it receives and is responsible for its own compliance with the UK GDPR, the Privacy and Electronic Communications Regulations 2003 and other applicable laws.
  • Your rights and removal: if you are featured in one of our databases, you may object to the processing, request a copy of the data we hold about you, ask us to correct it, or ask to be removed. Contact hello@pitchbuilder.io. Following a validated removal request or objection, we will remove your details from the versions of the relevant product supplied to new purchasers within one month, and from all subsequent releases. We are not able to recall copies already supplied to purchasers, but those purchasers are subject to the licence restrictions described above and to their own legal obligations.
  • Why we have not contacted you directly: the UK GDPR (Article 14(5)(b)) recognises that directly notifying every individual in a compiled dataset of publicly available professional information may involve disproportionate effort. We instead provide the information required by Article 14 through this published policy.

7. Sharing Personal Data

PitchBuilder Ltd does not sell, lease, trade, or share your personal data with third-party marketing brokers. Personal data is shared only with service providers that support our operations and are bound by appropriate data protection obligations, including:

  • Our e-commerce platform (Shopify);
  • Our payment processors (Shopify Payments, Stripe, PayPal);
  • Our cloud storage, email and hosting infrastructure providers;
  • Specialist professionals working as part of our delivery team on your project (such as designers), in each case under our direction and written confidentiality and data protection obligations;
  • Our professional advisers, and courts, regulators or authorities where disclosure is required by law.

For clarity, this Section does not apply to the investor information contained within our data products, the supply of which is described in Section 6.

8. Cookies

The Site uses cookies and similar technologies. Essential cookies are required for the Site and checkout to function. We also use analytics cookies, and may use marketing cookies set by our e-commerce platform and advertising partners, to understand how the Site is used and to measure our marketing. You can manage or delete cookies at any time through your browser settings, and can opt out of interest-based advertising through the controls offered by the relevant platforms; blocking essential cookies may affect how the Site and checkout function.

9. International Transfers

Some of our service providers, including Shopify and certain cloud infrastructure providers, process data outside the UK, including in the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

  • Transaction, billing and tax records: six (6) years from the end of the relevant financial year, to meet HMRC requirements.
  • Client project materials: for the duration of the engagement and a reasonable period thereafter to support the deliverables, resolve queries and defend legal claims, after which they are deleted on request or in our routine cycles.
  • Marketing data: until you unsubscribe or, typically, after twenty-four (24) months without engagement from you.
  • Investor database entries: for as long as the individual remains an active, publicly listed investor, subject to periodic re-verification and the removal process in Section 6.

Where you request erasure, we will comply unless and to the extent that retention is necessary for compliance with a legal obligation (such as the six-year tax record requirement) or for the establishment, exercise or defence of legal claims, in accordance with the exemptions in the Data Protection Act 2018. In those cases we retain only the data necessary for that purpose, for example transaction records, download confirmation logs and core correspondence relevant to a payment dispute.

11. Your Rights

Under the UK GDPR you have the right to: (a) access the personal data we hold about you; (b) have inaccurate data corrected; (c) have your data erased, subject to the exemptions described in Section 10; (d) restrict our processing; (e) object to processing based on legitimate interests, including the database processing described in Section 6; (f) object to direct marketing at any time; (g) data portability; and (h) withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact hello@pitchbuilder.io. We may need to verify your identity before acting on a request. We will respond within one month, which may be extended by up to two further months where permitted by law for complex or numerous requests, in which case we will tell you within the first month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113. We would appreciate the opportunity to address your concerns first, so please consider contacting us before approaching the ICO.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The current version will always be published on the Site with its last updated date. Material changes affecting how we use your personal data will be notified where practicable.

13. Contact

Questions about this policy or our data practices should be directed to hello@pitchbuilder.io, or by post to PitchBuilder Ltd, Exchange Building, 66 Church Street, Hartlepool, England, TS24 7DN.