Privacy Policy

What we collect

The information you provide when you create an account: your name, email, bio, expertise, and the target lists / pitches / outreach you build inside the app. When you send pitches through us we also record delivery telemetry (sent / opened / replied timestamps) so your dashboard can show open and reply rates.

How we use it

To run the product you signed up for: generating AI-drafted pitches, sending them on your behalf via your SMTP provider, tracking responses, and surfacing analytics in your dashboard. We do not sell your data. We do not share it with advertisers.

Who we share it with

Our infrastructure subprocessors: Supabase (database + auth + file storage), Stripe (billing), Railway (hosting), OpenAI (AI pitch generation — we send only the prompt + your chosen context; OpenAI does not train on API traffic by default), Resend (transactional email), and the SMTP provider you configure yourself. The full, current list with regions and DPAs lives at /legal/subprocessors. We give enterprise customers 30 days' notice before adding a new subprocessor.

Your rights (GDPR / CCPA)

• Access: download everything we have on you from Settings → Privacy & data → "Download my data".
• Erasure: delete your account + all associated data from the same card. This is permanent and immediate.
• Correction: edit your profile directly in the app.
• Portability: the export is a standard JSON file; import it anywhere.
• Marketing email opt-out: toggle under Settings → Email → Preferences (or unsubscribe from any email).

Data retention

We keep your data for as long as your account is active. If you delete the account, we remove the underlying rows and auth record immediately. Backups roll off within 30 days.

Cookies

We use a single session cookie for login and a Stripe cookie during checkout. We do not run third-party analytics or advertising cookies.

For business customers (GDPR Article 28)

If you process Personal Data through Chuhching on behalf of others, our standard Data Processing Agreement applies by default. It covers purpose, subprocessors, security measures, data-subject rights, and international transfers (SCCs / UK IDTA / Swiss addendum). Enterprise customers can request a countersigned PDF copy from privacy@chuhching.com.

Contact

Privacy questions, deletion requests we couldn't handle automatically, or data-subject inquiries: email privacy@chuhching.com.