Effective date 17 September 2026Last updated 17 September 2026
PitchLab (“we”, “us”) provides a service that helps students contact university faculty about research opportunities. This policy explains what we collect, why, and what we do with it. If you have questions, email hello@pitchlab.me.
Who we are
PitchLab is operated from California, United States. We can be reached at hello@pitchlab.me.
What we collect
Account information. Your email address and password credentials, handled by our authentication provider. We never see or store your password in readable form.
Profile information you give us. Your first and last name, the school you attend, and your year of study. We use these to write your outreach emails and to sign them.
Outreach preferences. The university you want to contact, the research areas you are interested in, and the tone you want your emails written in.
Google account data. See the dedicated section below.
Payment information. Payments are processed by Stripe. We never receive or store your card number. We store a payment identifier, the amount, and what you purchased, so we can credit your account and answer billing questions.
Usage information. Basic technical logs generated when you use the site, such as timestamps and error records. We use these to keep the service running.
We do not collect health information, government identifiers, or any special category of personal data.
How we use Google user data
This section describes our use of data obtained through Google APIs.
The permission we request. When you connect your Gmail account, we request a single scope: https://www.googleapis.com/auth/gmail.send. Google describes this as “Send email on your behalf.” We also receive your email address so we can show you which account is connected and confirm it belongs to you.
What that permission allows. It allows us to send a message from your account. Nothing else.
What we do with it. We send the outreach emails you have reviewed and approved, to the faculty members you selected, from your address. Sent messages appear in your own Gmail Sent folder. Replies go directly to your inbox and are never routed through us.
What we explicitly do not do. We do not read, search, list, download, modify, label, archive, or delete any message in your mailbox. We do not access drafts, contacts, calendar, files, or any other Google service. We cannot do these things even if we wanted to, because the permission you grant does not allow it.
How we store your credentials. Google issues us a token representing your permission. We encrypt that token using AES-256-GCM before storing it, so it is not readable from the database alone. We never log it and never transmit it to anyone.
Revoking access. You can disconnect at any time from your PitchLab dashboard, which revokes our permission with Google and deletes the stored token. You can also revoke it directly at myaccount.google.com/permissions.
Limited Use disclosure
PitchLab’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, we affirm that we:
- use Google user data only to provide and improve the features you requested;
- do not transfer Google user data to others except as necessary to provide the service, comply with applicable law, or as part of a merger or acquisition with your prior notice;
- do not use Google user data for advertising, and do not sell it;
- do not allow humans to read your Google user data, except with your explicit consent for a support issue you raised, where required by law, or on aggregated anonymised data used for security or to comply with the law.
Who we share information with
We use a small number of service providers, each of which handles only what it needs to:
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase | Database and account authentication | Your account and profile data |
| Vercel | Website hosting | Technical request logs |
| Stripe | Payment processing | Your email and payment details |
| Anthropic | Writing your outreach emails | Your name, school, year, research interests, and the faculty member’s published work |
| Sending your email | The message content and recipient |
We do not sell your personal information, and we do not share it with advertisers.
About the email-writing step: to write each message, the details you provided in your profile are sent to Anthropic’s API along with information about the faculty member’s published research. This content is used to generate your draft and is not used to train models.
Faculty contact information
Our service maintains a database of university faculty who publish academic research, including their names, institutions, research topics, and the contact addresses those researchers have published in their own academic papers.
This information is drawn from public scholarly sources, principally OpenAlex and PubMed. Contact addresses are ones the researcher chose to publish in their own work for the purpose of being contacted about it.
If you are a faculty member and would like your information removed from our database, email hello@pitchlab.me and we will remove it.
How long we keep things
We keep your account information while your account is open. Sent-email records are kept so you have a record of your outreach. Your Google token is kept until you disconnect or your account is closed, whichever comes first.
If you close your account, we delete your personal data within 30 days, except where we are required to retain records for tax or legal reasons. See How to delete your data and revoke Gmail access for the steps.
How to delete your data and revoke Gmail access
Revoke Gmail access. Open your PitchLab dashboard and use Disconnect on the Gmail panel. That immediately revokes PitchLab’s permission with Google, deletes the stored access and refresh tokens from our database, and stops any outreach that has not yet been sent. You can also revoke it directly from Google at myaccount.google.com/permissions, which has the same effect on our ability to send.
Delete your account and data. Email hello@pitchlab.me from the address on your account and ask us to delete it. We confirm, then delete your profile, your outreach records, and any stored Google tokens within 30 days, except where tax or legal rules require us to retain a payment record. You do not need a reason, and there is no charge.
Data obtained through Google APIs is deleted when you disconnect Gmail or when your account is deleted, whichever happens first. We do not retain copies of it elsewhere.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to certain processing. California residents have rights under the CCPA, including the right to know what we collect and the right to delete it. We do not sell personal information, so there is nothing to opt out of on that front.
To exercise any of these, email hello@pitchlab.me. We will respond within 30 days.
Security
We encrypt data in transit. Google tokens are encrypted at rest. Access to the production database is restricted, and per-user access rules prevent any account from reading another account’s data.
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you promptly.
Children
PitchLab is not intended for anyone under 16, and we do not knowingly collect information from anyone under 16. If you believe a child has given us information, email hello@pitchlab.me and we will delete it.
Changes
If we change this policy materially, we will update the date at the top and notify account holders by email before the change takes effect.