Privacy Policy

This is the first section because it is the question that matters most here. The one-line idea you type, the reference images you upload, the angles that come back, and the concept frames that are generated for you are not used to train, fine-tune, retrain or otherwise improve any machine learning model, whether ours or a third party's.

We instruct every processor we use to apply the same restriction. Where a provider's standard consumer terms would permit training on submitted content, we do not use that provider on the consumer terms; we use the arrangement that excludes it. If we could not obtain that restriction from a provider, we would not send your content to them.

An unreleased creative idea is commercially sensitive. We treat it that way. We do not publish, sell, license, or share your ideas or your generated frames for any promotional purpose, and nothing you create appears in our marketing. Every example shown on this site was written and generated by us for that purpose.

GALLUS PROJECTS LIMITED is the controller of the personal data described in this policy, operating the Pitchface service at gallusprojectsuk.com.

Postal address: 13 West Montrose Street, Helensburgh, Scotland, G84 9PF.

Email: support@gallusprojectsuk.com. Telephone: +44 7916634708.

If you have a question about this policy, or you want to exercise any of the rights set out below, that email address reaches a person who can act on it.

We collect four kinds of information, and nothing beyond them.

• a.Account data: your email address, a hashed password or the identifier from the sign-in provider you chose, your display name if you set one, and the date you accepted these terms.
• b.Content you submit: the one-line ideas you enter, any reference images you upload, and the concept frames and mood boards generated in response.
• c.Subscription and usage data: your plan, billing period, renewal date, the credits issued to you in the current period, and a timestamped record of each pass you run and what it cost. Card details are never received or stored by us; they are handled by our payment provider.
• d.Technical data: IP address, browser and device type, pages requested, and error diagnostics. This is used to keep the service running and secure, and to detect abuse.

• a.To provide the service you asked for — splitting your idea into angles, generating frames, storing your work, and letting you export it. Legal basis: performance of our contract with you.
• b.To take payment, issue each period’s allowance, and keep an accurate usage ledger. Legal basis: performance of our contract, and compliance with our legal obligations for financial records.
• c.To keep the service secure, prevent abuse, and investigate misuse of the acceptable use rules. Legal basis: our legitimate interests in running a service that is not abused.
• d.To answer your support messages. Legal basis: performance of our contract, and our legitimate interests in responding to you.
• e.To send you service messages you cannot opt out of, such as a renewal reminder, a failed payment notice, or a change to these terms. Legal basis: performance of our contract.
• f.To send optional product updates, only if you asked for them. Legal basis: your consent, which you can withdraw at any time.

• a.Ideas, reference images, generated frames and mood boards: kept while your account is open so you can return to your work. Deleted within 30 days of you deleting them or closing your account.
• b.Reference images held in the generation cache: deleted within 30 days of upload in every case, whether or not you delete them sooner.
• c.Account data: kept while your account is open, then deleted within 30 days of closure.
• d.Subscription and payment records: kept for six years after the end of the relationship, because financial records must be retained for that period.
• e.Support correspondence: kept for two years from the last message in the thread.
• f.Technical logs: kept for 90 days, then deleted or irreversibly aggregated.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We use a small number of processors, each doing one job under a written agreement that binds them to our instructions:

• a.Hosting and content delivery, to serve the site and store your files.
• b.Our payment provider, to take payment and manage subscriptions. They receive your email address and the amount charged; we never receive your full card number.
• c.Our model providers, to split your idea into angles and generate frames, on terms that exclude training on your content.
• d.Email delivery, to send account and support messages.
• e.Error and performance monitoring, to find faults.

The service is offered worldwide, so your data may be processed outside the country you live in, including by processors based elsewhere.

Where personal data is transferred out of the United Kingdom or the European Economic Area, we rely on an adequacy decision covering the destination, or on the UK International Data Transfer Addendum to the European Commission Standard Contractual Clauses, together with an assessment of the protections available in the destination. You may ask us for a copy of the safeguards we rely on.

Under the UK GDPR and the Data Protection Act 2018, and under the EU GDPR where it applies to you, you have the right to:

• a.Ask what personal data we hold about you and get a copy of it.
• b.Have inaccurate data corrected.
• c.Have your data erased, subject to records we must keep by law.
• d.Restrict or object to how we use data we hold on the basis of legitimate interests.
• e.Receive the data you gave us in a portable, machine-readable form.
• f.Withdraw consent at any time where we relied on consent, without affecting what was done before you withdrew it.
• g.Complain to a supervisory authority. In the United Kingdom that is the Information Commissioner’s Office, at ico.org.uk. If you are in the European Economic Area you may complain to the authority where you live.

To exercise any of these rights, email support@gallusprojectsuk.com. We answer within one month. If a request is complex we may take up to two further months, and we will tell you if that happens and why.

The California Consumer Privacy Act, as amended, gives you the right to know what personal information we collect and why, the right to a copy of it, the right to have it deleted, the right to correct it, and the right not to be discriminated against for exercising any of those rights.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing for you to opt out of. We honour Global Privacy Control signals sent by your browser as a valid request in respect of any future sharing.

Use support@gallusprojectsuk.com to make a request. We will verify it against the email address on the account before acting.

We use a small number of cookies and similar technologies. What they are, how long they last, and how to refuse them is set out in full in the Cookie Policy. Refusing is exactly as easy as accepting: the banner presents both as equal choices, and nothing beyond strictly necessary cookies is set until you accept.

Traffic is encrypted in transit. Files are encrypted at rest. Access to production data is limited to the people who need it to run the service, and is logged. Passwords, where you set one, are stored only as a salted hash.

No service can promise that a breach is impossible. If one happens and it is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and tell you directly where the risk to you is high.

This service is not for people under 18. We do not knowingly collect personal data from anyone under 18, and accounts must not be created by them. If you believe a person under 18 has created an account, tell us at the support address and we will close it and delete the data.

If we change this policy in a way that materially affects you, we will email the address on your account at least 14 days before the change takes effect, and update the date below. Continuing to use the service after that date means the updated policy applies.

Effective date: 20 August 2026.