Privacy Policy

1. Definitions

• Service refers to the Pulspace voice feedback platform and related services.
• You means the individual or organization accessing or using the Service.
• Personal Data is any information that can be used to identify you, such as your name, email address, or voice recordings.
• Organization refers to a business account that creates surveys and collects feedback.
• Respondent refers to an individual who provides voice or text feedback through the Service.

2. Data Controller

The data controller responsible for your personal information is:

Pulspace
[Registered company name and number to be added]
[Registered address to be added]
Email: [email protected]

Pulspace is established in the European Union. For data protection inquiries, contact us at [email protected].

Learn more about our voice feedback platform and how it helps businesses gather customer insights.

3. What Data We Collect

Voice Recordings

When you provide feedback through our platform:

• Voice Audio: Audio is streamed directly to our transcription provider's API in real time. Voice audio is never stored on Pulspace servers. The transcription provider processes audio transiently and does not retain it after transcription is complete.
• Consent: By clicking “Start Recording,” you consent to voice recording and AI-powered transcription and analysis.
• Legal Basis: Consent (GDPR Article 6(1)(a)) — you explicitly consent before any recording begins. You may withdraw consent at any time by closing the feedback page.

Transcribed Feedback

• Text Transcripts: Text versions of your feedback, stored securely
• AI Analysis: Sentiment scores, summaries, and categorization
• Metadata: Timestamp, survey ID, optional ratings

Account Information

• Organization Details: Business name, email address
• Authentication: Encrypted passwords (we never store plain text)
• Billing Info: Processed securely by Stripe (we do not store credit cards)

Image Uploads (Pro Tier)

• Image Files: Photos uploaded to accompany voice feedback (JPEG, PNG, WebP)
• AI Moderation: Images analyzed for safety using industry-standard AI moderation
• AI Analysis: Caption generation using enterprise vision AI
• Storage: Securely stored in Supabase Storage with encrypted transmission
• Content Policy: Inappropriate content blocked per our Content Moderation Policy

Cookies and Tracking

• Essential Cookies: Authentication tokens (org_token) - required for service
• Analytics: We may use anonymized usage data to improve the service
• Your Control: You can delete cookies anytime via browser settings

4. How We Use Your Data

We process your data for the following purposes:

• Service Delivery: Transcribe audio, analyze sentiment, generate insights (Legal basis: Contract performance)
• Service Improvement: Improve platform features based on aggregated, anonymized usage patterns. We do not use your data to train AI models. (Legal basis: Legitimate interest)
• Billing: Process payments via Stripe (Legal basis: Contract performance)
• Security: Prevent fraud and abuse (Legal basis: Legitimate interest)
• Content Safety: AI moderation to detect inappropriate content (Legal basis: Legitimate interest)
• Communication: Service updates and support (Legal basis: Legitimate interest)

5. Third-Party Services

We use the following third-party providers to process your data:

AI Processing Provider (USA)

• Purpose: Speech-to-text transcription, sentiment analysis, image moderation, image captioning
• Data: Voice audio (temporary), text transcripts, uploaded images
• Audio is not stored after processing
• Enterprise API tier with Data Processing Addendum (DPA) for GDPR compliance
• Customer data explicitly excluded from AI model training

Supabase (USA/EU)

• Purpose: Database, authentication, and file storage
• Data: Account information, transcripts, images, analytics
• ISO 27001 certified. Data encrypted at rest and in transit.
• Supabase Privacy Policy

Vercel (USA)

• Purpose: Hosting and deployment
• Data: Server logs, request metadata
• GDPR compliant
• Vercel Privacy Policy

Stripe (USA/EU)

• Purpose: Payment processing
• Data: Billing information (we never see your credit card details)
• PCI DSS Level 1 compliant
• Stripe Privacy Policy

Sentry (USA)

• Purpose: Error monitoring and performance tracking
• Data: Error logs, performance metrics, anonymized session data
• SOC 2 Type II certified. GDPR compliant.
• Sentry Privacy Policy

Microsoft Clarity (USA)

• Purpose: Session recordings and heatmaps for UX improvement
• Data: Anonymized interaction data, click patterns, scroll behavior
• Only active with your cookie consent
• Microsoft Privacy Statement

We never sell your data to third parties.

6. Data Retention

• Voice Audio: Never stored on Pulspace servers — streamed directly to the transcription provider and discarded after processing
• Feedback Transcripts: Retained while your account is active, or until you request deletion
• Account Data: Deleted within 30 days of account closure
• Billing Records: Retained for 7 years for tax compliance (legal requirement)
• Anonymized Analytics: May be retained indefinitely for service improvement

7. Your Rights Under GDPR

If you are in the EU/UK, you have the following rights:

• Right to Access - Request a copy of your data
• Right to Rectification - Correct inaccurate data
• Right to Erasure - Request deletion of your data ("Right to be Forgotten")
• Right to Data Portability - Export your data in CSV format
• Right to Object - Object to certain types of processing
• Right to Withdraw Consent - Withdraw consent for voice recording at any time
• Right to Restrict Processing - Limit how we process your data
• Right to Lodge a Complaint - Contact your local Data Protection Authority

To exercise these rights, email [email protected]. We will respond within 30 days.

8. Data Security

We implement industry-standard security measures:

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Secure authentication with HTTP-only cookies
• Regular security audits and penetration testing
• Access controls and least-privilege principles
• Bot detection and rate limiting to prevent abuse
• PII redaction in transcripts (emails, phone numbers, addresses)

No system is 100% secure. While we implement industry-standard security measures, we continuously work to improve our security practices.

9. International Data Transfers

Your data may be transferred to and processed in the United States. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) with all US-based processors
• Data Processing Agreements with all service providers (Supabase, Vercel, Stripe, AI providers)
• Encryption during transit and at rest

10. Children's Privacy

Pulspace is not intended for use by individuals under 16 years old. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately at [email protected].

11. AI-Powered Processing

Pulspace uses artificial intelligence systems to process your feedback. We are committed to transparency about how AI is used in our service.

How AI Is Used

• Speech-to-Text Transcription: Your voice feedback is converted to text using AI transcription services
• Sentiment Analysis: AI determines the overall tone of your feedback (positive, negative, or neutral)
• Clarity Scoring: AI assesses how specific and actionable your feedback is
• Topic Extraction: AI identifies key themes and topics in your feedback
• Content Moderation: AI screens feedback and images for inappropriate content
• Image Analysis: AI generates captions for uploaded images (Pro tier)

Human Oversight

AI-generated insights are provided as supplementary information for organizations. No automated decisions with legal or similarly significant effects are made about respondents based solely on AI analysis. Organizations retain full control over how AI-generated insights are interpreted and used.

Your Rights Regarding AI Processing

• You have the right to be informed that AI is processing your data (this section)
• You may contest decisions influenced by AI analysis by contacting the organization that collected your feedback
• You may request human review of any AI-generated analysis by contacting us at [email protected]

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Article 33)
• If the breach is likely to result in a high risk to your rights and freedoms, we will notify affected individuals without undue delay (GDPR Article 34)
• Notifications will include: the nature of the breach, likely consequences, measures taken to address and mitigate the breach, and contact details for further information

13. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights:

• Right to Know - What personal information we collect
• Right to Delete - Request deletion of your personal information
• Right to Opt-Out - Opt out of data sales (we do not sell data)
• Right to Non-Discrimination - Equal service regardless of exercising your rights

14. Changes to This Policy

We may update this Privacy Policy as we improve our service. Changes will be posted on this page with an updated "Last updated" date. For material changes, we will notify you via email.

15. Contact Us

For privacy questions, data requests, or concerns:

Email: [email protected]
Subject Line: "Data Privacy Request"
Response Time: Within 30 days

For questions about service terms, billing, or account issues, see our Terms of Service.