Privacy Policy

Last updated: 22 October 2026

This Privacy Policy explains how Sebastian Kistner ("we", "us") collects, uses and protects personal data when you use Pulse (the "Service"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Controller

Sebastian Kistner
Schaafweide 1, 76467 Bietigheim, Germany
Email: support@pulse-business.app

2. What data we collect

• Account data: name, email address, and authentication details (including via Google, Apple or Microsoft sign-in if you choose it).
• Business data you enter: your business profile, clients, invoices, quotes, contracts, projects, time entries, expenses, appointments, documents and similar records you create in the app. Where this includes personal data of your own clients, you are the controller and we process it as your processor — the agreement for this (DPA under Art. 28 GDPR) is available at /dpa.
• Payment data: handled by our payment provider Paddle. We do not receive or store your full card details — only subscription status and identifiers needed to manage your plan.
• Technical data: basic technical information required to operate and secure the Service (e.g. log data). If a technical error occurs, the app records a crash diagnostic (error message, stack trace, the route you were on, and browser identifier) stored in our own infrastructure (Supabase) — not with any third-party tool — solely to detect and fix bugs. No business or account data is included. The legal basis is our legitimate interest in a stable, error-free service (Art. 6(1)(f) GDPR).
• Anonymous usage statistics: to improve the product, we collect anonymous, aggregate usage events (which features and pages are used, onboarding steps) in our own infrastructure (Supabase) — no cookies, no personal or business data, and no user or session identifier, so no individual can be identified. Legal basis: our legitimate interest in improving the Service (Art. 6(1)(f) GDPR).
• Anonymous reach measurement (Vercel Web Analytics): to measure page views anonymously we use Vercel Web Analytics, provided by our hosting provider Vercel Inc. It works without cookies and without recognising you across different websites: visitors are told apart only by a hash derived from the request, which according to Vercel is not stored permanently and is discarded after 24 hours. Per page view, the timestamp, requested URL, referrer, approximate geolocation (e.g. country, region or city), operating system, browser and device type may be recorded; the data is evaluated only in aggregate and anonymously. We do not use marketing, advertising or profiling trackers (no Google Analytics, Matomo, Plausible, PostHog or Sentry). Legal basis: our legitimate interest in measuring reach and improving the Service (Art. 6(1)(f) GDPR). We have a data processing agreement with Vercel (see section 5). More information: vercel.com/docs/analytics/privacy-policy.

3. How and why we use your data (legal bases)

• To provide the Service and your account — performance of a contract (Art. 6(1)(b) GDPR).
• To process subscriptions and payments — performance of a contract and legal obligation (e.g. tax/bookkeeping).
• To secure, maintain and improve the Service — legitimate interests (Art. 6(1)(f) GDPR).
• To send service-related communications — contract / legitimate interests.

4. Processors and third parties

We use carefully selected service providers who process data on our behalf under data-processing agreements. For the data you have processed with us on your behalf, we offer you a data processing agreement (DPA) that also describes our technical and organisational measures (Annex 2) and the sub-processors we use (Annex 3):

• Supabase — authentication, database and hosting of your account data.
• Vercel — hosting and delivery of the web application, and anonymous reach measurement (Vercel Web Analytics, see section 2).
• Paddle — payment processing as Merchant of Record (subject to Paddle's own privacy policy).
• Anthropic (Claude API) — only if cloud AI is not switched off and an AI feature is used (or, in “Automatic” mode, called automatically): the data needed for that feature is sent via a server-side proxy (Supabase Edge Function) to generate the requested output. Depending on the feature this can include the text of your request and chat history as well as the relevant business data — including the name and key details of the client concerned, project information (including your project description) and the contents of invoices or quotes; the Opportunity Radar additionally processes your search terms, the text of an enquiry you paste in (or the content of a link you name) and your short profile (profession, skills, minimum rate). Requests that can be handled locally in your browser are not sent externally. The legal basis is performance of a contract (Art. 6(1)(b) GDPR); AI use is optional. Per Anthropic's API terms, content sent via the API is, by its own account, not used to train its models by default. Details: see “AI features (Pulse AI)” below.
• Mailgun (optional) — only if the email intake of the Opportunity Radar has been set up and you use it: it receives the emails you send to your personal forwarding address and hands them to our database. Sender, subject and text are processed (attachments are discarded).
• GitHub (optional) — only if you use the GitHub integration to sync project files with a repository. File contents, paths and commit messages you actively transfer, plus your GitHub access token, go directly between your browser and GitHub; Pulse servers receive neither the token nor these file contents. GitHub is an independent service governed by its own privacy terms.
• Sign-in providers (Google, Apple, Microsoft) — only if you choose to sign in with them.

Some providers may process data outside the EU/EEA; where they do, appropriate safeguards (such as EU Standard Contractual Clauses) are in place.

AI features (Pulse AI)

Pulse offers AI features (assistant, drafts for quotes, contracts and reminders, analyses, forecasts, Opportunity Radar). Whether and when data is sent to an AI provider is decided by the owner or administrator of the organisation under “Settings → AI & privacy”, with three modes:

• Off: no data is sent to Anthropic; the AI features only use the local, rule-based sample AI in your browser. In this mode the server additionally rejects AI requests.
• Only on demand (default setting): data is sent only when an AI feature is actively triggered — e.g. the assistant, a quote, contract or reminder text, the Opportunity Radar or the “Improve with AI” button.
• Automatic: in addition, the dashboard, the Business Health Score and the project forecast call the AI by themselves when opened. This mode must be enabled explicitly.

• Storage by Pulse: Pulse does not store the requests sent to the AI or its responses on its own servers — the proxy only passes them through. Server-side, only a daily counter per user is kept to limit costs (no content).
• Retention at Anthropic: according to Anthropic (as of July 2026), inputs and outputs of API customers are deleted automatically within 30 days at the latest. They are kept longer only if Anthropic's automated safety systems flag a request as a possible violation of the usage policy (inputs and outputs up to 2 years, classification scores up to 7 years) or if a legal obligation applies. Source: privacy.claude.com.
• Voluntary: AI use is optional — in the “Off” and “Only on demand” modes, none of this data is sent to Anthropic unless an AI feature is triggered.

Opportunity Radar

The radar collects projects, public tenders and jobs from public sources (TED – Publications Office of the EU, We Work Remotely, Remotive and the career pages on Greenhouse and Lever that you select), rates them against your search profile and, on request, prepares an application or a quote.

• Public sources: our server (Supabase Edge Function) retrieves these listings. Only search terms and country codes from your search profile are sent — no client, invoice or other business data and nothing about you. Responses are cached briefly (between 30 minutes and 6 hours depending on the source) so the sources are not overloaded; this cache contains public listings only. freelance.de is not retrieved automatically: there, only search hits are shown as links via the AI web search.
• Search profile and opportunities: your search profile (skills, minimum rate, regions etc.) and the opportunities you save or check, including notes and drafts, are stored in your Pulse account like your other business data (Supabase). Radar results you do not save are not stored.
• “Check an enquiry”: on request, Pulse evaluates text, a link or a forwarded email that you paste in with AI (Anthropic, see above). The text — possibly including contact persons named in it — and your short profile are transmitted. For a plain link, the AI retrieves the page; freelance.de, Xing, LinkedIn and similar sites are excluded. With “Evaluate without AI” everything stays on your device.
• Personal forwarding address (optional): if an email intake has been set up for Pulse, you receive an address meant only for you that cannot be guessed. Emails you forward there are received by our email provider (Mailgun) and handed to our database; sender, subject and text are stored (no attachments). They stay in your radar inbox until you accept or discard them — at most 30 days. The legal basis is performance of a contract (Art. 6(1)(b) GDPR). For persons named in forwarded emails (e.g. contact persons) you are the controller; we process their data as a processor (see the DPA).

5. Hosting, US data transfer and international transfers

Our web app is hosted and delivered via Vercel Inc. (USA) through its content delivery network (CDN). Vercel therefore processes data also in the United States, i.e. outside the EU/EEA.

Data processed by Vercel: when the pages are accessed, technical connection and server log data are processed, in particular IP address, requested URL/resource, date and time, referrer, browser type and version, operating system and HTTP status codes. This data is required to deliver the application and ensure its stability and security. The legal basis is our legitimate interest in secure, stable provision (Art. 6(1)(f) GDPR) and performance of the contract (Art. 6(1)(b) GDPR).

Vercel's data protection options: we have a data processing agreement (Data Processing Addendum) with Vercel. Data is transmitted encrypted via TLS/HTTPS; Vercel applies access controls and — depending on configuration — allows the selection of server/function regions. For details, see Vercel's privacy policy at vercel.com/legal/privacy-policy.

How the transfer is safeguarded: the transfer to the USA is safeguarded by the EU Standard Contractual Clauses (Art. 46 GDPR) contained in the data processing agreement. Where Vercel is certified under the EU-U.S. Data Privacy Framework, the transfer is additionally based on the European Commission's adequacy decision of 10 July 2023. Despite these safeguards, a level of data protection fully equivalent to the EU cannot be guaranteed in third countries.

6. Local storage in your browser

Pulse stores some data (including your session and, in local mode, your app data) in your browser's local storage so the app works and remembers your settings. This is essential to the functioning of the Service. Paddle's checkout may set cookies necessary to process payments.

GitHub integration (optional): if you link a GitHub account to a project, the app stores your personal access token only in the local storage of this browser — not in your Pulse account, not in cloud sync and not on our servers. Requests (loading files, commit & push) go directly from your browser to the GitHub API. Choosing “Disconnect” in the app removes the token from this device. Only which repository (owner/name/branch/folder) is linked to a project, and the path and version (SHA) of linked files, are stored in your Pulse account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR), as you actively use the feature.

7. Data retention

We keep your data for as long as your account exists. When you delete your account, we delete the associated business data, subject to statutory retention obligations (e.g. invoicing/tax records that must be retained by law).

Backups: to protect against data loss, Pulse automatically creates backup copies of your business data (usually once a day when there are changes, and before larger deletions) and keeps them for up to 30 days, after which they are deleted automatically. Deleting your account also deletes these backup copies. Database backups of our infrastructure provider may still contain deleted data until their own retention period expires.

Opportunity Radar: unprocessed emails in the radar inbox are deleted after 30 days at the latest; once you accept or discard one, it is removed from the inbox immediately. Saved opportunities remain until you delete them or your account.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, and to object to certain processing. You can exercise these rights via the in-app settings (including account deletion and data export) or by contacting us at support@pulse-business.app. You also have the right to lodge a complaint with a data protection supervisory authority.

9. Security

We use appropriate technical and organizational measures to protect your data, in particular:

• Encryption in transit (TLS/HTTPS) with HSTS and strict security headers.
• Access controls: only members of an organisation can access that organisation's data — enforced by database rules (row-level security), not just in the interface. Within an organisation, role-based permissions apply (owner, administrator, accountant, employee, viewer).
• Backups with restore: daily backups with checksums that owners and administrators can restore in the settings (see section 7); the restore function is covered by automated tests.
• Abuse protection for the AI features (sign-in required, server-side daily limit per user).

A detailed description of the measures is contained in Annex 2 of the data processing agreement. No method of transmission or storage is completely secure, but we work to protect your information.

10. Children

The Service is not directed to individuals under 18, and we do not knowingly collect their data.

11. Changes

We may update this Policy from time to time. Material changes will be communicated by reasonable means. The "last updated" date above reflects the current version.