← Back to Pulse

Privacy Policy

This privacy policy explains how Pulse Monitoring Ltd ("we", "us", "our") collects, uses, and protects your personal data when you use Pulse commercial services, including self-hosted Relay/Pro plans and Pulse Cloud or Pulse MSP.

What Data We Collect

We collect the minimum data necessary to provide our services:

Email address: Used to deliver your license or activation key and important service updates.
Name: Collected during checkout for invoice generation.
Billing address: Required for payment processing and invoicing.
Company name & VAT ID: Optional, collected if you provide them for business invoices.
License or activation key: A unique identifier generated for your purchase or migration.
Pulse MSP evaluation: An optional evaluation contact request stores your email and a fixed signup-source label. The separate licence issuance stores the public half of the signing key generated on your host, the evaluation licence ID, its expiry, and any setup-stage marker supplied by that setup version. An email is optional, not required for evaluation issuance. The private key, client inventory, infrastructure credentials, and raw client monitoring data are never sent.
MSP platform licence check-ins: For a platform with an evaluation licence or paid binding, the licence service can retain its first and last verified check-in times and a check-in count, keyed by the platform's public signing key. These records identify a platform and can be linked to its evaluation licence or paid binding; they are not anonymous aggregate telemetry.
Pseudonymous Pulse usage telemetry: A rotating pseudonymous install ID, release and runtime details, coarse deployment and lifecycle buckets, aggregate resource and outcome counts, coarse feature flags, and content-free Patrol, Assistant, and capability-API usage counters sent by self-hosted Pulse when outbound usage telemetry is enabled. The payload does not include hostnames, credentials, infrastructure identifiers, URLs, paths, locale, browser events, prompts, chat messages, command text, action output, token values, names, email addresses, or IP addresses. Request IP addresses may be used transiently for rate limiting and abuse prevention but are not stored in telemetry rows.
Cookieless website funnel measurement: The public website creates a random identifier in browser session storage and records content-free events such as page view, pricing view, plan click, demo click, and checkout start. We retain the page path, landing-page version, selected plan, referring hostname, and campaign labels when present. We do not store a full referrer URL, browser fingerprint, or IP address in these rows. Request IP addresses are used transiently for abuse prevention only.

Terminology correction (July 2026): An earlier version of this page used a stronger anonymity label for the Pulse usage payload. That was imprecise because the payload includes a rotating pseudonymous installation ID. We corrected the wording before telemetry schema v2 reached a public Pulse release; the identifier is not tied to a customer account or person and rotates every 30 days.

How We Use Your Data

License delivery: We email your license or activation key to the address you provide.
Invoice generation: Your billing details are used to create invoices.
License validation: Pulse validates your license or activation key against our server.
Aggregate product health: Pseudonymous usage telemetry helps us understand active installations, release uptake, lifecycle progress, and product outcomes without collecting direct customer or infrastructure identifiers in the telemetry payload.
Website and checkout improvement: Cookieless funnel measurements show whether visitors reach pricing and complete checkout, and which referring site or campaign produced the visit.
Support: We use your email to respond to support requests.
MSP evaluation and upgrade support: We use evaluation contact details to help when setup stalls. Where a setup version lets the operator supply them, its optional email, source label, and licence ID can join activation to a later assisted upgrade. Otherwise those records remain separate.
MSP evaluation activity: We use key-linked licence check-ins to count evaluation platforms that have started and those seen within the last seven days. A check-in is evidence of contact with the licence service, not proof that client monitoring is healthy or continuously available.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Third-Party Services

We use the following GDPR-compliant services to operate Pulse commercial services:

Stripe: Payment processing. Stripe handles all payment card data securely. See Stripe's Privacy Policy.
Resend: Email delivery for license and activation keys. See Resend's Privacy Policy.
Cloudflare: Website hosting and analytics. We use Cloudflare Web Analytics, which is cookieless and privacy-friendly. See Cloudflare's Privacy Policy.

Data Retention

Retention depends on the record type and the legal or operational reason for keeping it:

License and activation records: Kept while needed to provide access, support migrations, honour lifetime or legacy entitlements, prevent fraud, or process a verified deletion request.
Invoices: Retained as required by tax and accounting laws (typically 7 years).
Support emails: Retained for 2 years after your last interaction.
MSP evaluation licences: Retained while needed to operate the evaluation, prevent repeated abuse, support an upgrade, or process a verified deletion request.
MSP platform check-in records: These per-platform records currently have no automatic expiry. The seven-day running measure is a reporting window, not a deletion period, and the 90-day telemetry rule below does not apply. For access or deletion requests about key-linked platform activity, contact [email protected].
Pseudonymous telemetry rows: Purged after 90 days.
Cookieless website funnel events: Purged after 90 days. Checkout session records are retained with the related commercial transaction for accounting, support, and fraud prevention.

Your Rights (GDPR)

If you're in the EU/EEA, you have the following rights under GDPR:

Right to access: Request a copy of all data we hold about you.
Right to rectification: Request correction of inaccurate data.
Right to erasure: Request deletion of your data ("right to be forgotten").
Right to portability: Receive your data in a machine-readable format.
Right to object: Object to processing of your data.

To exercise these rights, use our self-serve data request page to request and confirm export or deletion by email verification. Alternatively, email [email protected] with "Data Request" in the subject line.

Data Deletion

You can request deletion using our self-serve data request page, or email [email protected]. After email verification, deletion will:

Permanently remove your license records from our systems
Immediately revoke your license or activation key

For Stripe payment data deletion, email us and we will submit a deletion request on your behalf.

Note: We may retain certain data as required by law (e.g., invoice records for tax purposes).

Cookies

We do not use cookies for tracking or advertising. Cloudflare Web Analytics is cookieless. The public website uses session storage for one random, per-tab funnel identifier, which disappears when the browser session ends.

The Pulse Application

The Pulse desktop/server application:

Does not include third-party analytics SDKs or advertising trackers.
May send pseudonymous outbound usage telemetry to the Pulse license server on startup and daily heartbeat. Operators can disable telemetry, preview the exact payload, or reset the local telemetry ID in Pulse settings.
Contacts our license server for license or activation validation, update/service checks, and pseudonymous usage telemetry when enabled.
Pulse intelligence features (Pulse Assistant and Pulse Patrol) communicate directly with your chosen LLM provider (OpenAI, Anthropic, etc.) using your own API keys. We do not proxy, store, or have access to these communications.

Provider-hosted Pulse MSP

The provider platform runs on your infrastructure. Its setup can request an evaluation licence using the locally generated public signing key, a setup-stage marker, and an optional email and fixed signup-source label when supplied. From the v6.5.0 provider bundle onwards, the control plane checks its licence with Pulse two minutes after startup and every six hours, including during an evaluation. Plan also contacts Pulse when you buy or manage billing. Verified check-ins can be retained as the key-linked activity records described above; no private signing key or client inventory is sent.

Each client workspace separately sends Pulse's pseudonymous usage telemetry by default: release details, aggregate counts, and feature flags, not raw metrics, logs, alerts, reports, hostnames, IPs, or names. Switch that telemetry off per workspace in Settings, General. This does not stop the control plane's licence checks or their activity records. Client monitoring data stays on your infrastructure.

The Pulse Mobile App

Supported Pulse Mobile releases connect to your self-hosted Pulse instance via Pulse Relay:

End-to-end encryption: All communication between Pulse Mobile and your Pulse instance is encrypted using X25519 key exchange and AES-256-GCM. The relay server routes encrypted frames and cannot read your data.
Device tokens: If you enable push notifications, your device token (Apple APNs or Google FCM) is stored on the relay server to deliver alerts. No other device identifiers are collected.
Camera access: Used solely to scan QR codes when pairing with a Pulse instance. No photos or videos are captured or stored.
Biometric data: Face ID, Touch ID, and fingerprint authentication are processed entirely on your device by the operating system. We never receive or store biometric data.
Local storage: Connection credentials and encryption keys are stored in your device's secure keychain (iOS) or keystore (Android). They are not transmitted to our servers.
No analytics or tracking: Pulse Mobile does not include any analytics SDKs, advertising identifiers, or usage tracking.

Security

We protect your data using:

HTTPS encryption for all communications
Ed25519 cryptographic signatures for license and activation tokens
Secure, isolated infrastructure
Access controls and regular security reviews

Contact

For privacy-related questions or data requests, contact us at:

Email: [email protected]

Last updated: August 2026
Pulse Monitoring Ltd (Company No. 16939106, England & Wales)