PitchWar Privacy Policy

Who we are

PitchWar is the consumer product. The legal data controller is Reply Intelligence Group Ltd (Company No. 17040048), the same controller for other processing by that company. PitchWar is a trading name, not a separate data controller. We do not publish an ICO registration number here because it has not been verified in this codebase.

Privacy contact: support@pitchwar.co.uk

What we process

• Anonymous play identity. A Supabase anonymous user ID and session, used so rooms, quota, and purchases can work without a login wall.
• Optional saved identity. If you Secure or Restore a Game Night, a verified email and related authentication metadata.
• Game content. Nicknames, room codes, pitches, round state, investments, War Chest totals, AI judgements, and results. Local play also keeps a short session in your browser.
• Payments. Stripe Checkout references, purchaser email, entitlement type, start/expiry, and related metadata. Full card details stay with Stripe.
• Transactional email. Purchase confirmation and authentication mail. We do not add these addresses to marketing lists.
• Security. Hashed IP hints for some rate limits, abuse signals, usage events, and server logs. We do not keep a public profile.
• Safety reports. Category, description, optional contact email, and any room or pitch references you give us.
• Teams interest. Optional name and work email if you ask to hear about PitchWar for Teams, which is not on sale yet.

Why we use it

We use this information to run the game you asked for, take payment, prevent abuse, send transactional mail you requested, publish optional anonymous homepage roast snippets from judged rounds, and handle safety reports. The usual lawful bases are contract (play and paid access), legitimate interests (security, limited product events, homepage entertainment snippets), legal obligation (tax, safety, and similar duties), and consent where you choose to leave an email for Teams interest or a report response.

Who receives it

Current processors and infrastructure used by PitchWar include Supabase (database and authentication), Stripe (payments), Vercel (hosting and logs), Resend (transactional email), and Vercel AI Gateway with an underlying model provider for judging. The current default judge model path is a Google Gemini Flash-class model via the gateway. Model providers can change; user pitch text is sent to whichever judge path is configured so the round can be scored.

These providers are not all in the UK. Transfers rely on the provider contracts and, where needed, appropriate UK transfer tools. We do not claim that data never leaves the UK.

How long we keep it

PitchWar does not currently run an automatic deletion job for rooms, pitches, entitlements, or product events. Payment and accounting records may need to be kept for legal retention. Safety reports and related evidence may be held longer than ordinary game data if a serious report requires it. If you want a specific record deleted, contact us. We may need to keep information where the law or an active safety investigation requires it.

Your rights

UK data protection law gives you rights including access, correction, deletion, restriction, objection, and portability in the situations those rights apply. They are not always absolute. You do not need a permanent PitchWar account to contact us, but we can only act where we can reasonably identify the relevant records.

You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

Children

PitchWar is a party game that a teenager could plausibly open. We do not use behavioural advertising, do not require a real name, and do not try to profile children. See also Cookies & Device Storage.