Privacy Policy

This Privacy Policy explains how PitchGo ("we", "us") collects, uses and protects your personal information when you use the PitchGo website and app. PitchGo is a UK-based service and this policy is written to comply with the UK GDPR and the Data Protection Act 2018.

The data controller is PitchGo. For any privacy question or request, contact us at support@pitchgo.app.

1. Personal data we collect

• Account data: name / display name, email address, encrypted password, role (stallholder or organiser).
• Profile data: business name, stall category, town / region, phone number (optional), profile photo.
• Uploaded documents: certifications you choose to upload, such as food hygiene certificates and public liability insurance.
• Market and application data: markets you create or apply to, messages you send, reviews, reports and application history.
• Payment data: subscription status and Stripe customer / subscription IDs. Card details are entered directly on Stripe and are never stored on our servers.
• Location data: the postcode / address you enter for a market. This is sent to Mapbox to display the map.
• Technical data: IP address, browser type (Safari, Chrome, Firefox, etc.), device type, and basic log data used to keep the service running and secure.

2. Why we use your data (lawful basis)

• Contract: to create and run your account, list markets, take applications, host chat and process subscriptions.
• Legitimate interests: to keep PitchGo safe, prevent fraud, respond to reports of misuse, and improve the service.
• Consent: where required, for example if you upload sensitive certification documents you consent to us storing them and showing them only to organisers who have accepted your application.
• Legal obligation: to keep records we are legally required to keep (e.g. certain tax and payment records).

3. Third-party services that process your data

We only share personal data with the service providers that help us run PitchGo. They act as our data processors and are contractually required to protect your data and only use it on our instructions.

• Supabase — database, authentication and file storage. Hosts your account, profile, markets, messages and uploaded documents.
• Stripe — payment processing for Organiser Pro and Stall Holder Pro subscriptions. Stripe collects card details directly on their own systems; we only receive a customer ID and subscription status. See Stripe's privacy notice at stripe.com/privacy.
• Mapbox — displays the map on market pages. Mapbox receives the postcode / coordinates for a market and standard technical data (IP, browser) required to serve the map tiles. See mapbox.com/legal/privacy.
• Lovable Cloud — our hosting platform, which runs the PitchGo app.
• Email delivery provider — sends transactional emails (sign-in, password reset, service notices) from the support.pitchgo.app domain.

We do not sell personal data, and we do not use third-party advertising or cross-site tracking.

4. International transfers

Some of our providers (notably Stripe and Mapbox) are based outside the UK / EEA and may process data in the United States. Where personal data leaves the UK we rely on the UK's approved transfer safeguards — either an adequacy decision, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum. Copies of these safeguards are available on request from support@pitchgo.app.

5. How long we keep your data

• Account and profile: for as long as your account is open.
• Markets, applications and messages: retained while your account is open and for up to 12 months after the event, so both sides have a record of what was agreed.
• Uploaded documents: kept while your account is open; deleted when you delete the document or close your account.
• Payment records: retained for at least 6 years to meet UK tax and accounting law.
• Support emails: retained for up to 24 months.

When you close your account we delete or anonymise your personal data within a reasonable period, except where we are legally required to keep it.

6. Who can see your data on PitchGo

• Your public profile is visible to other signed-in users so the platform can do its job.
• Uploaded certification documents are private — only visible to organisers who have accepted one of your applications, and to you.
• Report submissions are only visible to PitchGo staff.
• Chat messages are visible to the participants of that conversation.

7. Your rights under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct anything that's wrong.
• Erasure — ask us to delete your account and personal data ("right to be forgotten").
• Portability — ask for a machine-readable copy of the data you provided to us.
• Restrict or object — limit how we use your data or object to certain uses.
• Withdraw consent — where we relied on consent, at any time.
• Complain — to the UK Information Commissioner's Office at ico.org.uk if you're not happy with our response.

To exercise any of these rights email support@pitchgo.app from the address on your PitchGo account. We'll respond within one month.

8. Security

Passwords are hashed. Data is transmitted over HTTPS. Uploaded documents are held in a private bucket and access is enforced by row-level security so only permitted users can read them. We regularly review our security controls.

9. Children

PitchGo is not intended for anyone under 18 and we do not knowingly collect data from under-18s.

10. Cookies

See our Cookie Policy for details of the cookies and local storage we use.

11. Changes

We may update this policy. If changes are material we'll notify you in the app or by email before they take effect.

12. Contact

Email support@pitchgo.app for any privacy question, subject access request, or data deletion request.