Privacy Policy

1. Information We Collect

When you visit PulsaSuite, we minimize data collection to what is essential for operation:

• Account Information: When you register, we collect your email address and basic profile information.
• Saved Business Profiles: If you explicitly choose Save in a supported business tool, we store the company, customer, supplier, employee, optional recurring salary defaults, or inventory-configuration details you select privately under your account. These may include contact, tax, and employee bank details entered by you. Profile names can be listed without loading the saved details. You can update or permanently delete profiles in the tool. Full documents, attendance marks, and stock rows are not saved by this feature. On downgrade, extra profiles remain stored but locked until you choose a Free profile, upgrade, or delete them.
• Optional Saved Workspace: Separately from reusable profiles, choosing Save can store document drafts or issued snapshots, AI conversations and writing presets, company brands, catalogue items, expenses, inventory and stock movements, attendance, or payroll records privately under your account. These may contain business, customer or employee information you enter. Saving is not automatic. Saved records remain until you delete them; archived records are still retained. On downgrade, records above Free limits remain readable and exportable but may be locked for editing and reuse. Stock movements and issued snapshots support recordkeeping and are not proof of payment or tax filing.
• Browser & System Data: Technical logs (IP address, user agent) collected solely for security, fraud prevention, and rate limiting.
• Billing Data: Subscription transaction histories. Payment processing is handled by compliant third-party gateways.

2. Client-Side Browser Processing

Our local utilities (such as QR Code Generator, JSON Formatter, Base64 Tools, Hash Generator, Text Diff, Calculators, and Image Compressor) execute 100% within your web browser using client-side JavaScript Web APIs.

Your inputs, files, and generated outputs remain inside your device's memory and are never uploaded to PulsaSuite servers.

3. Time-Limited Private Uploads

A small number of future authenticated features may need a file upload. Those files are stored in a private, owner-only area and are scheduled for hard deletion after 60 minutes.

Expired files are not listed or downloadable, and any signed download link is limited by the remaining retention time. This does not apply to browser-based tools, which do not upload files in the first place.

4. AI Utilities & Server Processing

For cloud-based AI tools (such as AI Assistant, Marketing Writer, Summarizer, Translator), prompt inputs are securely sent via TLS encryption to our API Gateway to return AI-generated responses.

Prompts and recent conversation context are processed by the configured AI provider. Provider handling is subject to its policies; do not include passwords or sensitive information. We keep a private generated-response copy for request recovery for up to 24 hours, removed by scheduled cleanup, and may cache a per-account response for up to 15 minutes to reduce repeat processing. This recovery storage applies even in Temporary chat; that setting prevents optional saved conversation history, not response recovery. Analytics record provider, model, token totals, cache status, and timing, not prompt content. Conversations and presets you explicitly save in the workspace remain until you delete them.

5. Advertising and Third-Party Data

If advertising is enabled on selected public pages, we may use Google AdSense. Google and other advertising partners may place or read cookies, use web beacons, IP addresses, and similar identifiers to serve, limit, measure, or personalize ads in line with a visitor's settings and applicable law.

PulsaSuite does not sell advertising data or use it to identify individual users. We may receive aggregate advertising reports. Active Pro subscribers receive an ad-free experience: ad code and ad placements are not loaded for them. Ads are not shown in account, billing, authentication, dashboard, or active tool-workspace areas.

Learn more about Google's advertising technologies at Google's Advertising Privacy & Terms page.

6. Automation Workflows & BYO API Key Vault Security

When you configure third-party SMS, WhatsApp, Email, or Webhook integration credentials (such as Twilio, Meta Cloud API, or custom API tokens) in Workflows and Reminders:

• Hardware-Grade AES-256-GCM Encryption: All authorization headers, bearer tokens, and custom API keys are encrypted at rest using AES-256-GCM authenticated encryption before being saved.
• Zero Plaintext Storage: Your raw API keys are never written in plaintext to persistent storage. Neither PulsaSuite system administrators nor database engineers have access to your raw credentials.
• Strict Tenant Isolation & Ephemeral In-Memory Execution: Encrypted credentials are strictly scoped to your account ID via Row Level Security (RLS) and are only decrypted in-memory during real-time automated HTTP dispatch execution.

7. Data Protection & Security

We employ industry-standard technical measures to protect your information, including HTTPS TLS 1.3 encryption, Row Level Security (RLS) on PostgreSQL databases, AES-256-GCM vault encryption for API keys, and SHA-256 security hashing.

8. Your Privacy Rights

Depending on your location, you have rights to access, correct, delete, or export your personal data. You may request account deletion at any time by contacting our privacy team.