Privacy Policy

This Privacy Policy is issued by PITCHME Pte. Ltd. ("pitchMe", "we", "us", or "our") and applies to our website (pitchmesg.com), web applications, dashboards, and any associated digital platforms (together, the "Services"). It explains how we collect, use, disclose, and safeguard personal data in compliance with the Personal Data Protection Act 2012 (PDPA) of Singapore, and, as required under section 11 of the PDPA, we maintain internal policies and practices to meet our data protection obligations.

Age of users

The Services are intended for users aged 13 and above. Consistent with guidance from Singapore's Personal Data Protection Commission (PDPC), users aged 13 or older may give consent on their own behalf where they understand what they are consenting to. For that reason we write our notices, including this one, in plain language. We do not offer individual accounts to children under 13 and do not knowingly collect their personal data; if you believe a child under 13 has created an account, contact us and we will delete it.

Students using pitchMe through a school

Where an educational institution provides pitchMe to its students, the institution is responsible for obtaining any consents required on its side. This includes parental or guardian consent where the students' age or local law requires it. pitchMe supports these programmes with consent templates and records.

We have appointed a Data Protection Officer (DPO) to oversee our data protection practices and PDPA compliance. For any question or request relating to your personal data or this policy:

Email

privacy@pitchmesg.com

Postal address

60 Paya Lebar Road, #07-54 Paya Lebar Square, Singapore 409051

DPO

Chia Zhi Feng

Personal data is any information that identifies you, whether you provide it directly or it is generated through your use of the Services. We collect:

a. Identification and account information

• Full name, email address, and school or institution name
• User IDs, account credentials (stored as cryptographic hashes, never in plain text), and authentication logs

b. Multimedia content

• Videos, audio recordings, and scripts you upload or record for analysis
• Generated transcripts, AI feedback reports, and grading data

Presentation recordings contain your face, voice, and manner of speaking. We treat this content as personal data at every stage and apply heightened care to it (see sections 5 and 7).

c. Usage and technical data

• Device details (model, operating system, browser type)
• IP address, interaction logs, and session duration
• Cookies and similar technologies. The app uses cookies necessary for sign-in and session security. On our public website, analytics cookies are optional and are set only if you choose Accept in our cookie banner. We remember your choice in your browser's local storage.
  • Google Analytics 4 (Google LLC): cookies named _ga and _ga_*, expiring after up to 2 years. Helps us count visits and understand which pages are useful.
  • Microsoft Clarity (Microsoft Corporation): cookies named _clck and _clsk, expiring after up to 1 year, plus anonymised session replays and heatmaps. Text you type into forms is masked and is not recorded.
  • If you decline: no analytics cookies are set and Clarity does not run at all. Google Analytics still receives aggregate, cookie-free signals (pages viewed, country, traffic source) that are not linked to you.
  • Changing your mind: use Cookie settings in the footer at any time. Withdrawing is as easy as accepting.
  • Google and Microsoft act as our data intermediaries for this data. See Google's and Microsoft's privacy policies for how they handle it.

d. Derived and analytical data

• AI-generated feedback and scores (for example Confidence, Clarity, Delivery), engagement metrics, and improvement suggestions

We collect and process personal data only for specified, legitimate purposes:

• To deliver and personalise your public-speaking training experience
• To generate feedback, transcripts, performance analytics, and progress reports
• To manage accounts, subscriptions, and billing
• To respond to support requests and fix technical issues
• To comply with legal, regulatory, and audit obligations
• To monitor for misuse, fraud, and security threats

pitchMe builds its own coaching models. These models improve by learning from real practice videos, because a range of different faces, accents, and speaking styles is what makes feedback fair and accurate for everyone. If you choose to contribute, this is what it means.

Your consent is opt-in, separate, and optional

• We ask you inside the app, for example after your first analysis, and you can also decide at any time in Settings → Privacy. Consent is never bundled into account sign-up or the Terms of Use.
• Saying no (or nothing) changes nothing: the Services work exactly the same, and your scores are never affected by your choice.
• If you consent, your practice videos, audio, transcripts, and scores may be used to train, evaluate, and improve pitchMe's own coaching models.

How we protect contributed recordings

A recording of your face and voice can identify you. For that reason we do not claim to anonymise the video itself. We treat contributed recordings as personal data throughout, and we protect them with strict safeguards:

• Access is limited to a small pitchMe research team and vetted annotators bound by confidentiality obligations, and access is logged.
• Account metadata (your name, email, and school) is separated from training data and replaced with pseudonymous IDs. Transcripts and aggregate statistics are additionally de-identified where feasible.
• Contributed recordings are never sold, published, shown to your teachers or classmates, or shared with third parties for their own purposes.

Withdrawing consent

• Turn it off in Settings → Privacy or email privacy@pitchmesg.com. Withdrawal is as easy as consenting.
• After withdrawal, no new content from your account is used, and your existing content is removed from our training datasets within 30 days.
• Models trained before your withdrawal cannot "unlearn", but they do not contain a retrievable copy of your video, and your content will not appear in any future training run.

Students and school programmes

For school-managed programmes, contribution is off by default and is enabled only where the institution has put the required approvals in place (including parental consent where applicable). Even then, each student sees a clear notice and can individually decline, and a student's decision to decline always takes precedence.

We do not sell or rent personal data. We disclose it only in the following circumstances:

a. Your educational institution

If you use pitchMe through a school or organisation that has licensed the platform, we share your performance data (scores, transcripts, progress reports) with that institution for academic tracking and educational purposes. For core service delivery pitchMe acts as a data controller; where the institution directs the processing, pitchMe may act as a data intermediary under the PDPA, and the institution is responsible for its own use of the data.

b. Service providers

We use a small set of providers to run the Services. They process personal data under data-processing terms that impose confidentiality, security, and use-limitation obligations consistent with the PDPA:

• Google Cloud Platform and Firebase for hosting, storage, databases, and authentication
• Google (Gemini models) for AI analysis of uploaded presentations (United States)
• OpenAI for AI feedback generation (United States)
• Deepgram for speech-to-text transcription (United States)
• Zoho ZeptoMail for transactional email, such as verification codes
• Payment processors for subscription billing. We do not store your full card details on our systems.

Our AI providers process your content to deliver analysis to us; we do not permit them to use your content to train their own models.

c. Legal and regulatory authorities

We may disclose personal data to governmental or legal authorities where required or permitted under Singapore law: in response to a lawful request, court order, or legal process; to prevent or investigate suspected fraud, security threats, or illegal activity; or to protect the rights, property, or safety of pitchMe, our users, or the public, as permitted by the PDPA.

We implement technical and organisational measures appropriate to our size and the sensitivity of the data we hold, in line with the PDPA's Protection Obligation (section 24):

• All traffic is encrypted in transit (HTTPS/TLS)
• Data is encrypted at rest on Google Cloud infrastructure, whose data centres hold independent certifications such as ISO 27001 and SOC 2
• Role-based access control on a least-privilege basis, so staff see only what their role requires
• Cloud audit logging of access to production systems
• Credential hashing, secret management, and periodic review of access rights

No internet service can guarantee perfect security, and we make no such guarantee. We review and strengthen these measures as the platform grows, and we maintain an internal data-breach response process aligned with the PDPA's Data Breach Notification Obligation. If a notifiable breach affects you, we will inform you and the PDPC as the law requires.

We keep personal data only as long as needed for the purposes it was collected for, or as required by law:

• Active accounts: personal data is retained while your account remains active.
• Account deletion: when you delete your account (or ask us to), we erase your personal data, typically within 30 days, and within 90 days for backup systems, unless a specific legal, regulatory, or audit obligation requires longer retention.
• Derived data: you may request deletion of AI-generated scores, transcripts, and analytics tied to you.
• Training data: if you had consented to AI model training, deletion of your account also removes your content from our training datasets within 30 days (see section 5).
• Confirmation: on request, we will confirm what has been deleted, including from training datasets, to the extent technically feasible.

We maintain documented retention schedules for each category of personal data and review them periodically.

The Services run on Google Cloud Platform. Some processing takes place outside Singapore, primarily in the United States. This includes AI analysis, feedback generation, and transcription by the providers listed in section 6. This section is our notice to you that content you upload may be processed overseas.

In line with the PDPA's Transfer Limitation Obligation (section 26), we ensure overseas recipients are bound to protection standards comparable to the PDPA:

• Data is encrypted in transit and at rest
• Our providers' data-processing terms incorporate recognised contractual safeguards (such as standard/model contractual clauses) and restrict use of your data to the services they perform for us

With respect to your personal data, you may:

• Access it. You may request a copy of the personal data we hold about you and how it has been used or disclosed in the past year. We respond within 30 calendar days.
• Correct it. You may ask us to fix inaccurate or incomplete data. We respond within 30 calendar days.
• Delete it. You may request deletion, subject to legal or contractual retention obligations (section 8).
• Withdraw consent. You may withdraw consent for any specific processing (such as AI model training) at any time, on reasonable notice. Withdrawal does not affect processing that happened lawfully before it. If you withdraw consent needed for core features, this may limit what we can provide, and we will tell you the consequences before acting on your request.
• Complain. If you believe we have mishandled your data, contact our DPO first so that we can put it right. You may also lodge a complaint with Singapore's Personal Data Protection Commission (PDPC).

Refusals and fees

We may refuse access in the limited circumstances the PDPA allows, for example where a request would reveal another person's personal data or is subject to legal privilege. We do not charge for reasonable access or correction requests; where the PDPA permits a fee for an unusually burdensome request, we will tell you the amount in advance.

To exercise any right in this policy, or to ask about our privacy practices:

Email

privacy@pitchmesg.com

Postal address

60 Paya Lebar Road, #07-54 Paya Lebar Square, Singapore 409051

DPO

Chia Zhi Feng

We may update this policy to reflect changes in our practices, technology, or legal requirements. For material changes we will notify you by email or in-app notice and update the "Last updated" date above.

New purposes need new consent. If a change involves using your personal data for a purpose you have not consented to, we will ask for your consent before doing so. Continued use of the Services alone is not treated as agreement to a new purpose.