Privacy policy
This policy explains what personal data Pulsify collects, why, who we share it with and what you can ask us to do with it. In this policy, "Pulsify" and "we" mean the team behind the Pulsify client portal and the pages it hosts for clients. For any privacy question, email [email protected].
Who this covers
- Clients: coaches and businesses who use the Pulsify client portal.
- Visitors to client pages: people who view or fill in a landing page or opt-in form that Pulsify hosts for a client.
- Prospects: people Pulsify contacts about its own services.
What we collect
- Account data: name, email address and, if you sign in with Google, the basic profile Google shares (name, email, profile picture). We do not receive your Google password.
- Workspace content: what you save in the portal, such as drafts, story sequences, video packages, brand and business context, proof images and captions, to-dos and notes.
- Connected services: when you connect a service (Kit, Cal.com, Calendly, Whop, Stripe, YouTube, Instagram, Canva, Zapier, or your own Claude, ChatGPT or Gemini key), we store the credentials or tokens needed to reach it, encrypted, and the data we read from it, such as bookings, payments, subscriber counts, channel statistics and message threads.
- Performance data: metrics you or we log about your content, such as views per slide, DMs and profile visits.
- Lead data from client pages: what a visitor enters into a form (usually name, email and answers to questions) and basic page activity such as views and which step they reached.
- Technical data: IP address, browser and device details, and timestamps, which our hosting provider processes to deliver and secure the service.
How we use it
- To run the portal and the pages we host for clients, and to sign you in.
- To deliver the services a client has agreed to, including writing, content planning and reporting.
- To generate drafts and suggestions with AI models from your saved context. Your content is sent to the model provider only to produce that output.
- To send service emails, such as sign-in links and notices about your account.
- To keep the service secure, prevent abuse and fix problems.
We do not sell personal data and we do not use it for third-party advertising.
Legal basis
Where data protection law requires a legal basis, we rely on performing our contract with clients, our legitimate interest in running and securing the service, and consent where we ask for it (for example, when you connect a service).
Google user data
If you sign in with Google, we use your name, email address and profile picture only to create and identify your account. If you connect YouTube, we use the YouTube data you authorise only to show your channel and content performance inside your workspace. Pulsify's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube data is accessed through YouTube API Services; see the YouTube Terms of Service and the Google Privacy Policy. You can revoke access at any time from your Google account permissions.
Who we share it with
We share data only with providers that run parts of the service for us, and only what they need:
- Cloudflare: hosting, database, file storage, search and some AI processing.
- PropelAuth: sign-in for clients and the Pulsify team.
- Google: sign-in with Google, when you choose it.
- Anthropic, OpenAI and Google: AI drafting and suggestions, only when you connect your own key, and Anthropic for work Pulsify runs for you.
- Zernio: publishing a post to your Instagram account, only when you press Post.
- Canva: opening your carousel in your own Canva account, only when you press Edit in Canva (see below).
- Resend: sending service emails.
- Sentry (EU region): error reports when a page crashes or a request fails on our side. Reports carry no names, emails, IP addresses or cookies, and web addresses are stripped of their query strings.
- DocuSign: contract signing, for clients who sign with us.
- Stripe and Whop: payment records, when a client connects them.
- Fathom and Supadata: call and video transcripts, when used for a client's work.
- The services a client connects (listed above), which receive requests on the client's behalf.
We may also disclose data when the law requires it.
Canva
If you connect Canva, Pulsify can open your carousels in your own Canva account and bring the finished slides back. We ask Canva for two permissions only: to read your designs and to create or change designs. When you press Edit in Canva, we send that one carousel to Canva as a file. When you press Return in Canva, or Bring back in Pulsify, we fetch the finished slides as images. We never see your Canva password and we do not read your other Canva designs. Your Canva access tokens are stored encrypted, and you can disconnect Canva at any time from your workspace, which deletes the stored tokens on our side. You can also remove Pulsify's access from your Canva account settings.
International transfers
Our providers may process data outside your country, including in the United States. Where the law requires it, we rely on the safeguards those providers offer, such as standard contractual clauses.
How long we keep it
We keep client data while the client's workspace is active. When a client asks us to delete their workspace, we delete its content, connected-service credentials, stored media and lead data. Sign-in sessions expire on their own.
Cookies and storage
We use a strictly necessary cookie to keep you signed in to the portal. The app also stores small preferences in your browser, such as the light or dark theme. We do not use advertising cookies.
Your rights
You can ask us to access, correct, export or delete your personal data, or object to how we use it. Email [email protected] and we will reply within 30 days. If you are a visitor to a client's page, we will pass your request to that client, who decides how your data is used. You also have the right to complain to your data protection authority. In Turkey that is the Personal Data Protection Authority (KVKK).
Security
Data is encrypted in transit. Connected-service credentials are encrypted at rest. Access to client data is limited to the client and to Pulsify operators who need it to deliver the service.
Children
Pulsify is for businesses and is not meant for anyone under 18.
Changes
If we change this policy, we will update the date above, and tell clients by email when the change is significant.