Legal
Privacy policy
Last updated: 2026-10-25
WorthPitching is run by D. Smidstrup Holding ApS (CVR 45751937), trading as Random Code, Havnegade 12, 3. 1, 5000 Odense C, Denmark. We are the data controller for the personal data described here under the EU General Data Protection Regulation (GDPR). Questions or requests: daniel@danielsmidstrup.com.
1. What we collect about you
- Account: your email address and a password (stored hashed by our authentication provider). If you sign in with Google, we receive your name, email address and profile picture from Google.
- What you put in: the description of your ideal customer (ICP), the companies you look up and watch, webhook URLs and notification settings.
- Usage and billing: lookups you run, credits used and granted, API keys (we store only a hash and a short prefix), and your plan and payment status.
- Signup and attribution: when you start a trial we record your email, the plan you picked, the first company you tried, the page you first landed on, the referring site, and campaign tags (UTM parameters and ad click IDs such as fbclid) if the link you came from had them.
- Technical data: IP address and browser information in our hosting provider's logs. For the free lookup on our homepage we use your IP address to limit it to one per day; it is kept in memory only and not stored in our database.
We do not see or store your card number. Payments are handled by our payment processor.
2. Why we use it, and on what legal basis
- To provide the service you signed up for: your account, lookups, fit scores, watchlist alerts and API access (contract).
- To bill you and keep accounting records (contract and legal obligation).
- To send service emails such as sign-in links, password resets and alerts you turned on (contract).
- To prevent abuse, such as limiting free lookups and protecting accounts (legitimate interest).
- To understand which pages and campaigns bring customers, using the signup and attribution data above (legitimate interest).
We do not sell your personal data, and we do not use it to train AI models.
3. Data about companies (and the people in it)
WorthPitching researches companies, not people. For a looked-up domain we collect public information from the company's own website and DNS records, public job boards (such as Greenhouse, Lever and Ashby), public ad libraries (Meta Ad Library, LinkedIn Ad Library and Google Ads Transparency Center), public LinkedIn company pages, and search-traffic estimates.
This is mostly company data. It can sometimes include personal data, for example the name of a sole trader, a person mentioned in a job post or company post, or text in an ad. We process it on the basis of legitimate interest: helping sellers decide which companies are relevant to contact. We do not build contact lists of individuals, and we do not sell email addresses or phone numbers.
If information about you appears in WorthPitching, you can object or ask us to correct or remove it at daniel@danielsmidstrup.com. We store dated snapshots of company data to detect changes over time; we remove a company's data on request.
4. Who we share data with
We use these service providers (processors) to run WorthPitching. They only process data on our instructions.
| Provider | What for |
|---|---|
| Supabase | Database and sign-in (hosted in the EU, Ireland) |
| Vercel | Website and API hosting |
| TypeSafe (Jev) | AI scoring: receives your ICP description and public company information to compute fit scores and summaries |
| DataForSEO, ScrapeCreators | Public company data (search estimates, ads, LinkedIn company pages). They receive company domains and names, not your account data |
| Stripe | Payments, when you pay for a plan |
| PostHog | Product analytics and session recordings (form inputs are masked), only if you accept cookies. EU cloud |
| Meta Platforms | Measuring our Facebook and Instagram ads (Meta Pixel and Conversions API), only if you accept cookies. Receives page views, a hashed email when you start a trial, and Meta cookie IDs |
| Email provider | Sending account and alert emails |
Some providers are based in or process data in the United States. Where personal data leaves the EEA, we rely on the safeguards the GDPR requires, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
5. Cookies
The first table lists the cookies we need to run the site. Analytics and advertising cookies (second table) are only set with your consent. In the EU, the UK and most other countries we ask first, in a cookie banner. In the United States, Australia and Canada (outside Quebec), where the law allows it, they are on by default and you can turn them off. If your browser sends a Global Privacy Control signal, we treat it as a no. You can change your choice at any time with "Your privacy choices" at the bottom of every page.
| Cookie | Purpose | Kept for |
|---|---|---|
| sb-… (Supabase) | Keeps you signed in | Your session |
| wp_vid | A random visitor ID used to apply free-lookup limits | 90 days |
| wp_attr | Remembers the first page you landed on, the referring site and campaign tags (UTM, fbclid), so we know which channels bring customers | 90 days |
| wp_free_used | Remembers that you used the free homepage lookup | 30 days |
| wp_tools | Counts free tool uses per day | 2 days |
| wp_consent | Remembers your cookie choice | 180 days |
Only after you accept:
| Cookie | Purpose | Kept for |
|---|---|---|
| _fbc, _fbp (Meta) | Connect an ad click to a later trial, so we can measure which ads work | 90 days |
| wp_st | Remembers that your trial start was already reported to Meta, so it is only sent once | 30 days |
| ph_… (PostHog) | Product analytics: which pages and features are used | 1 year |
6. How long we keep it
- Account data, lookups, watchlist and settings: while your account is open. When you delete your account, we delete or anonymize it within 30 days.
- Billing and accounting records: as long as Danish bookkeeping law requires (currently 5 years).
- Signup records of people who did not finish creating an account: until you ask us to delete them.
- Hosting logs: for the short period our hosting provider keeps them.
7. Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Email daniel@danielsmidstrup.com; we answer within 30 days. You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or your local authority.
8. Security
Data is encrypted in transit. Access to each account's data is restricted at the database level, API keys are stored only as hashes, and only a small number of people can access production systems.
9. Children
WorthPitching is a business tool and is not meant for anyone under 16. We do not knowingly collect their data.
10. Changes
We will post changes here with a new date. For material changes we will also tell account holders by email at least 30 days before they apply. See also our terms of service.