Privacy Policy

This Privacy Policy explains how EraShift Studio LLC ("EraShift", "we", "us" or "our"), a Texas limited liability company, collects, uses, discloses and protects personal information in connection with our website at pitchlume.ai (the "Website") and our business software service, Pitchlume, at app.pitchlume.ai and related workspace addresses (the "Service").

Pitchlume is a business-to-business product. It is used by manufacturers of engineered products (our "Customers"), their staff ("Authorized Users") and the people a Customer invites or shares content with ("Guests"). It is not intended for consumers or for children.

Notice at collection (summary)

This table summarizes the personal information we collect as a business (controller). It does not cover Customer Data we process on behalf of Customers (see Section 3).

We do not collect sensitive personal information as defined by US state laws for the purpose of inferring characteristics about you. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising.

1. Who this policy covers

1. Website visitors, including people who request a demo, ask to get started or use the guest product preview on the Website.
2. Authorized Users of the Service: people who hold an account in a Customer's Workspace.
3. Guests: distributors, licensees, customers of our Customers and others invited to a Workspace or who open a share link, augmented reality (AR) link or embedded catalog.
4. Billing and business contacts at our Customers, prospects, vendors and partners.

2. Our two roles

We handle personal information in two different roles. This matters because it decides who you should contact about it.

(a) Data we control (EraShift as a "business" or "controller"). We decide why and how this information is used:

• Website visitor information and form submissions (leads).
• Account information about Authorized Users and Guests that we need to run, secure and bill for the Service (sign-in, account profile, security and audit logs).
• Billing contacts and payment records.
• Communications you send to us (for example, to info@pitchlume.ai or help@pitchlume.ai).

(b) Customer Data we process for our Customers (EraShift as a "service provider" or "processor"). Our Customers put information into their Workspaces. We process it only on the Customer's instructions, under our agreement with that Customer, and not for our own purposes. This includes:

• Customer Content: catalog material, drawings, CAD files, rating tables, data sheets and other files a Customer uploads, and the Output generated from them.
• CRM data: contacts the Customer enters or imports (name, email, phone, title, LinkedIn profile, notes, consent status), deals and activity, and, if the Customer turns on a website visitor identification integration, the visiting companies and people and the pages they viewed.
• Meeting recordings and transcripts a Customer uploads.
• Email that a Customer's people write and send through Pitchlume, and the delivery and open events for it.
• Guest and share-link activity the Customer sees about who viewed its content.

The Customer is responsible for having a lawful basis to collect this information and to give it to us, and for answering requests from the people it concerns. If your information is in a Customer's Workspace (for example, you are a contact in a Customer's CRM or you received an email from a Customer through Pitchlume), please contact that Customer. If you contact us, we will refer your request to the Customer or help the Customer respond, as our agreement with the Customer requires.

3. Personal information we collect

3.1 Information you give us

• Website forms (get started, book a demo, guest product preview): name, business email, company, role, industry, your message and the page you came from.
• Account profile: email address, name, title, phone number, avatar image, time zone and display theme.
• Communications: what you write when you email us or contact support.
• Billing: billing contact name and email, company and address. Payment card details go directly to Stripe; we receive and keep only the card brand, last four digits and expiry date.
• Meeting recordings: when an Authorized User uploads a meeting recording, the uploader must confirm that everyone in the recording agreed to be recorded. Recordings are stored encrypted and transcribed (see Section 5).

3.2 Information collected automatically

• Sign-in and session data. Each new session requires your password and a 6-digit code we email to you. We store the code only in hashed form; it is valid for 10 minutes and deleted after 1 day. If you choose "remember this device", we store a hashed device token for 30 days, labeled with your browser's user agent so you can recognize it.
• Audit and security log. When you use the Service we record the action you took, what it applied to, the time, your IP address and your browser user agent. Sign-in events also record your email address, the referring page and an approximate location (country, region and city) derived from your IP address. Views, prints and exports of drawings and files are logged. Printed sealed drawings carry a watermark naming the Workspace, the person's company and the time, and exported files carry an embedded notice naming the Workspace, the time and an export ID that the audit trail ties to the person.
• Account activity: last seen time, the version of the user terms you accepted and when, your role, who invited you, and any suspension or access expiry set by your Workspace administrator.
• Website form security: a salted, one-way hash of your IP address (not the address itself) to limit abuse.
• Share links and AR links: when someone opens a share link we record an approximate location, the browser user agent, the device type and what was viewed. We do not store the IP address for share-link opens.
• Email events: for email sent through Pitchlume, we receive delivery, open, bounce and complaint events from our email provider. Opens are tracked, using a standard tracking image; clicks are not tracked. We keep unsubscribe and suppression lists so that we and our Customers keep honoring opt-outs.
• Errors and security reports: when something fails we collect error details, scrubbed of content, with internal user and Workspace identifiers. Browser security (Content-Security-Policy) reports keep only a hashed IP address.
• Problem reports you send. If you use the report button in the Service, we receive what you write, the page you were on and, unless that option is turned off for your Workspace, a screenshot of your screen at that moment.
• Cookies and browser storage: see Section 9 and our Cookie Notice.

3.3 Information from others

• Your Workspace administrator may create or invite your account and give us your name, email, role and company.
• Customers provide Customer Data, which may include your information (Section 2(b)).
• Customer-enabled integrations. A Customer may connect its own HubSpot account or a website visitor identification service (such as Lead Forensics). Those are the Customer's own vendors under the Customer's own contracts. Data that flows in from them is Customer Data.
• Our service providers, such as our hosting provider, which supplies approximate location for requests, and our email provider, which reports delivery events.

We do not buy personal information from data brokers.

4. How we use personal information

We use the personal information we control to:

1. Provide the Service: create and manage accounts, sign you in, show you your Workspace and remember your preferences.
2. Secure the Service: verify sign-ins, detect unusual activity, keep the audit trail, watermark exports, investigate abuse and enforce our Acceptable Use Policy.
3. Respond to you: answer demo and get-started requests, support requests and questions.
4. Bill and administer accounts: invoices, payments, credits and account notices.
5. Communicate with you about the Service, including security, legal and administrative notices. If we send marketing email, we do so under Section 12.
6. Maintain and improve the Service: fix errors, measure reliability and understand how features are used, using aggregated or de-identified information where we can.
7. Comply with law and protect our rights, our users and others.

We process Customer Data only to provide the Service to the Customer that owns it, as its agreement with us describes. We do not use Customer Data, including Customer Content, to train AI models, and we never use one Customer's data for another Customer.

We do not use personal information to make decisions that produce legal or similarly significant effects about individuals, and we do not profile people for advertising.

5. AI processing

Pitchlume uses artificial intelligence (AI) models to read catalog material, generate 3D models, drawings, renders, decks and text, transcribe meetings and help with research. How we handle it:

• US-based providers on business terms. We use AI providers based in the United States, under paid commercial terms that do not permit the provider to train its models on our customers' data.
• Customer files stay on approved routes. Drawings, CAD files, catalog uploads and other customer files are sent only through our direct accounts with OpenAI, Google Cloud Vertex AI and Anthropic, in US regions, under terms that do not allow training on that data. If an approved route is not available, the call does not fall back to another provider; it fails.
• Other AI calls. Calls that do not carry customer files, such as chat about public information, public-source research or metadata, may go through a US AI gateway (Vercel AI Gateway) set for no training and zero data retention, where a Workspace's AI pathway is set to it. Marketing video uses a separate video provider that receives only the prompts and images a person chooses for that video. Our current providers, their purposes and their regions are listed in the Subprocessor List at pitchlume.ai/legal/subprocessors.
• Retention by providers. We ask each AI provider for zero data retention. Until a provider confirms it for our account, that provider may keep inputs and outputs for a limited period (up to 30 days under the standard terms we have seen) for abuse monitoring, and not for training.
• A person confirms what is published. AI-generated content is labeled, and it goes live in a Workspace only after a person in that Workspace confirms it.
• One Workspace at a time. Each AI request carries only one Workspace's data.
• No model substitution. We do not let a provider route your data to a model or host we did not choose.

6. Restricted Data

The Service is not designed for, and we do not encourage or allow, Restricted Data: export-controlled technical data (ITAR, or EAR items with an ECCN), Controlled Unclassified Information (CUI), classified information, certain nuclear information, protected critical infrastructure information, protected health information under HIPAA, and third-party material whose agreement prohibits cloud or AI processing. Please do not put personal information of this kind, or any government identifiers, health or financial account information, in the Service. Before files are processed, the Service asks the uploader whether they contain Restricted Data and records the answer, any consent given and who gave it. See the Restricted Data Policy at pitchlume.ai/legal/restricted-data.

7. How we disclose personal information

We disclose personal information only as described here:

1. Service providers (Subprocessors). Companies that host, store, transmit or process data for us under contracts that limit their use of it to providing services to us: hosting and functions (Vercel), database, authentication and file storage (Supabase, on Amazon Web Services), email delivery (Resend), our own mailboxes (Google Workspace), AI providers (Section 5), payments (Stripe, when billing is turned on) and error monitoring (Sentry, when turned on). The current list, with purposes and regions, is at pitchlume.ai/legal/subprocessors.
2. Within your Workspace. Your name, role, company and activity (for example, that you viewed, printed or exported a file) are visible to your Workspace's administrators and, in part, to other members, as the Workspace's settings allow. If you are a Guest, the Workspace that invited you can see what you viewed.
3. To the Customer that controls the data. Customer Data is available to the Customer, and we may disclose it to the Customer to answer its questions or requests.
4. Integrations a Customer turns on. When a Customer connects a third-party tool, data moves to that tool on the Customer's instruction.
5. Legal and safety. When we believe in good faith that the law requires it (for example, a valid subpoena or court order), or to protect the rights, property or safety of EraShift, our users or others. Where the law allows, we will tell the affected Customer before disclosing its data.
6. Business transfers. In a merger, acquisition, financing, reorganization or sale of assets, personal information may transfer to the successor, subject to this policy or a notice to you.
7. With your direction or consent.

No sale, no sharing for advertising. We do not sell personal information and we do not "share" it for cross-context behavioral advertising, as those terms are defined by California and other US state laws, and we have not done so in the past 12 months. We do not process personal information for targeted advertising. We do not knowingly sell or share personal information of anyone under 16.

8. Data location

We store and process data in the United States. Our database and file storage run in Amazon Web Services' us-west-2 (Oregon) region, and our application functions run in a US region (Oregon). AI processing is described in Section 5.

The Website and Service are offered to businesses in the United States. If you access them from outside the US, your information will be transferred to, stored and processed in the US, where privacy laws may differ from those where you live.

9. Cookies and similar technologies

We use only cookies and browser storage that are strictly necessary or functional: to keep you signed in, remember a trusted device, remember your light or dark theme, run the anonymous product preview and keep interface preferences. We do not use analytics, advertising or third-party cookies, tracking pixels or third-party scripts on the Website or in the Service, and our fonts are hosted by us. Email sent through the Service contains an open-tracking image (Section 3.2). Details are in our Cookie Notice at pitchlume.ai/legal/cookies.

Global Privacy Control. We treat a Global Privacy Control (GPC) signal as a valid request to opt out of the sale and sharing of personal information and of targeted advertising. Because we do none of these for anyone, our processing already matches that request and nothing further changes when your browser sends the signal. We do not respond to "Do Not Track" signals beyond this because there is no common standard for them.

10. How long we keep personal information

We keep personal information only as long as we need it for the purposes in this policy, then delete or de-identify it. Current periods:

Customer Data is kept for as long as the Customer's agreement and settings require. We may keep information longer where the law requires it or to resolve disputes and enforce our agreements.

11. Security

We protect personal information with administrative, technical and physical measures appropriate to a business software service, including:

• Encryption in transit (TLS with HSTS) and at rest (AES-256).
• Per-Workspace encryption keys for drawings, CAD files, exports, account files, meeting recordings and catalog uploads, in addition to storage encryption.
• Separation of each Workspace's data in the database, enforced by row-level security.
• Two-step sign-in (password plus an emailed code) on every new session.
• Audit logging of views, prints, exports and administrative actions, and watermarks or embedded notices on prints and exports.
• US hosting with established infrastructure providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you and regulators as the law requires. To report a vulnerability, contact help@pitchlume.ai. More detail is in our Security Overview at pitchlume.ai/legal/trust.

12. Email and your choices

• Service and security email. Pitchlume sends account email on its own only to account holders: sign-in codes, invitations a Workspace admin starts, password resets you ask for, and Workspace notifications that are turned on (which you or your admin can turn off). We may also send billing, security and legal notices; you cannot opt out of these while you have an account. Pitchlume never emails a Customer's customers or prospects automatically.
• Marketing email. If we send marketing email, it identifies EraShift, includes our postal address and a working unsubscribe link, and we honor unsubscribe requests within 10 business days, as the CAN-SPAM Act requires. We do not email prospects automatically; a person sends each message.
• Email from our Customers. Customers' people can send email through Pitchlume to contacts they have verified. Each message includes one-click unsubscribe and the sender's postal address. To stop email from a Customer, use the unsubscribe link or contact that Customer.

13. Your US state privacy rights

Depending on where you live, US state privacy laws (including the California Consumer Privacy Act as amended by the CPRA, and the comprehensive privacy laws of Texas, Virginia, Colorado, Connecticut, Oregon, Utah, Montana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska and other states) give you rights over personal information we control. We extend the following rights to everyone in the United States, whether or not their state requires it:

1. Access / know: confirm whether we process your personal information and get the categories and specific pieces we hold, the sources, the purposes and the categories of recipients.
2. Delete: ask us to delete personal information we collected from you, subject to legal exceptions (for example, security logs we must keep, or records needed to complete a transaction).
3. Correct: ask us to correct inaccurate personal information. You can also update much of your profile in the Service.
4. Portability: receive a copy of your personal information in a portable, commonly used format.
5. Opt out of the sale or sharing of personal information, targeted advertising and profiling for significant decisions. We do none of these, so there is nothing to opt out of today, but you may still submit a request.
6. Limit use of sensitive personal information. We do not use sensitive personal information for purposes that would give rise to this right.
7. Non-discrimination: we will not deny you service, charge you a different price or give you a lower quality of service for exercising your rights.

How to make a request. Email info@pitchlume.ai with the subject "Privacy request", tell us which right you are exercising and give the email address associated with your account or form submission. Requests are handled manually by our team today; there is no self-service tool yet.

Verification. We will verify your request by confirming control of the email address associated with your information (for example, by sending a code or link to it) and, where needed, by asking for information we already hold. We will only use information you give us for verification to verify the request. If we cannot verify you, we will explain why.

Authorized agents. You may use an authorized agent. We will ask the agent for proof of your signed permission, and we may ask you to verify your identity directly or confirm you gave the agent permission, unless the agent holds a valid power of attorney.

Timing. We will confirm receipt within 10 business days and respond within 45 days. If we need more time (up to a further 45 days where the law allows), we will tell you why within the first 45 days. We will not charge a fee unless requests are manifestly unfounded or excessive.

Customer Data. If your request concerns information a Customer put in its Workspace, we will refer you to that Customer or forward the request, as described in Section 2.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing info@pitchlume.ai with the subject "Privacy appeal" within 60 days. We will respond in writing within 60 days (or the period your state law sets) and explain our decision. If you are not satisfied, you may contact your state attorney general (for Texas residents, the Office of the Attorney General of Texas at https://www.texasattorneygeneral.gov; for Colorado, Connecticut, Virginia and other states, your state attorney general's website).

California disclosures. In the past 12 months we have collected the categories listed in the Notice at collection table, from the sources in Section 3, for the purposes in Section 4, and disclosed them for business purposes to the categories of recipients in Section 7. We have not sold or shared personal information. California residents may also request information under California Civil Code Section 1798.83 ("Shine the Light"); we do not disclose personal information to third parties for their direct marketing.

14. Children

The Website and Service are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16, and the Service is intended for people 18 and older. If you believe a child has given us personal information, contact info@pitchlume.ai and we will delete it.

15. Third-party links and services

The Website and Service may link to other websites or let a Customer connect third-party tools. Their privacy practices are governed by their own policies, not this one.

16. Changes to this policy

We may update this policy as our practices or the law change. We will post the new version with a new "Last updated" date. If a change is material, we will give notice before it takes effect, for example by email to account holders or a notice in the Service. Previous versions are available on request.

17. Contact us

EraShift Studio LLC

Privacy requests and questions: info@pitchlume.ai (subject "Privacy request"). Security reports and support: help@pitchlume.ai.

Change log