Privacy Policy
This Privacy Policy describes how PulseForm ("we", "our") collects, uses and protects information from platform users, in line with applicable data protection laws such as GDPR and Brazilian LGPD.
1. Data we collect
We only collect data needed to operate the platform:
- Account data: name, email, and password (stored as a BCrypt hash).
- Usage data: projects created, surveys, collected responses, and settings.
- Billing data: subscription and transaction history processed by the payment gateway. We do not store credit card data.
- Widget visitor data: anonymous session identifier (UUID generated in the browser), page URL, and survey answers. We do not collect personally identifiable visitor data without explicit consent configured by the survey operator.
- Access logs: IP address, user-agent, and timestamps, retained for up to 90 days.
2. How we use data
- Service delivery and improvement.
- Authentication and access control.
- Account-related communications (email verification, plan alerts, support).
- Billing and subscription management.
- Abuse detection and prevention.
We do not sell, rent, or share your data with third parties for marketing.
3. Legal basis
Data processing is performed under:
- Contract performance: data needed to operate the contracted service.
- Legitimate interest: security, fraud prevention, and product improvement.
- Consent: marketing communications, when applicable.
4. Sub-processors and data sharing
To operate the service, we share personal data with the following sub-processors:
| Vendor | Purpose | Country | DPA |
|---|---|---|---|
| Stripe Payments, Inc. | International payment processing | USA | DPA |
| AbacatePay | Payment processing (Brazil, PIX) | Brazil | Terms |
| Google LLC | Optional Google Sheets integration (OAuth2) | USA | CDPA |
| DeepSeek (Hangzhou DeepSeek AI) | AI features (text generation/analysis) | China | Privacy |
A full record of the Data Processing Agreements and mitigation measures is maintained in our internal document Vendor Data Processing Agreements, available upon request to the DPO. Changes to this list are notified to active customers 15 days in advance.
5. Your rights
You have the following rights regarding your data:
- Confirm processing exists;
- Access the data we hold about you;
- Correct incomplete, inaccurate, or outdated data;
- Request anonymization, blocking, or deletion of unnecessary data;
- Data portability to another provider;
- Withdraw consent at any time.
To exercise your rights, contact: privacy@pulsex.com.br
6. Data retention
We keep your data while your account is active. When you close your account, data is deleted within 30 days, except where retention is required by law.
7. Security
We adopt technical and organizational measures to protect your data, including encryption in transit (TLS), password hashing (BCrypt), JWT authentication, and per-tenant access controls.
8. Cookies and local storage
The survey widget uses localStorage and sessionStorage to control display frequency (e.g., "show once per session"). No third-party tracking cookies are used by default.
9. Changes to this policy
We may update this policy periodically. We will notify active users by email of material changes at least 15 days in advance.
10. Data Protection Officer (DPO)
In compliance with Art. 41 of the LGPD, the Data Protection Officer is:
- Name: Rodrigo Felix
- Email: dpo@pulseform.com.br
11. Contact
Questions or requests related to privacy:
Email: privacy@pulsex.com.br
DPO: dpo@pulseform.com.br