Privacy Policy

01. Introduction

Pulsewise Ltd (“Company,” “we,” “us,” or “our”) operates Pulsewise (“the Service”), a software-as-a-service platform for infrastructure monitoring and AI-assisted incident diagnostics. This Privacy Policy describes how we collect, use, store, share, and protect your information when you use our website and the Pulsewise platform, including the monitoring agent installed on your servers.

By creating an account or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, you must not use the Service.

02. Account Data

When you register for Pulsewise, we collect:

• Identity information — full name, email address, and optionally a profile photo or display name.
• Authentication credentials — hashed password (bcrypt) or OAuth tokens if you sign in via a third-party provider (Google, GitHub).
• Organization details — workspace name, team member email addresses, and assigned roles (owner, admin, member).
• Communication preferences — notification settings, alert channel configuration, and timezone.

We use this data to operate your account, authenticate sessions, deliver alerts, and provide customer support. Account data is retained for the lifetime of your account plus 30 days after deletion.

03. Billing Data

Payment processing is handled entirely by Stripe, Inc. We do not receive, store, or have access to your full credit card number, CVV, or bank account details. Stripe is a PCI DSS Level 1 certified payment processor.

We receive and store the following billing-related data from Stripe:

• Card brand and last four digits (e.g., “Visa ending in 4242”)
• Billing name and address
• Subscription plan, billing cycle, and payment history
• Stripe customer ID and subscription ID

We use this information to manage your subscription, generate invoices, process upgrades and downgrades, and handle refund requests.

04. Server & Monitoring Data

The Pulsewise agent, installed on your Linux servers, collects infrastructure telemetry. This is the core data that powers monitoring, alerting, and AI diagnostics. The agent collects:

• System metrics — CPU usage, memory utilization, disk I/O, network throughput, load averages, and swap usage, sampled at 10-second intervals.
• Process information — top processes by CPU and memory consumption, process counts, and zombie process detection.
• Service health — status of monitored services (e.g., nginx, PostgreSQL, Docker), port availability, and HTTP endpoint checks.
• System metadata — hostname, operating system, kernel version, uptime, and installed agent version.
• Log snippets — when AI diagnostics are triggered, the agent may collect recent syslog, journald, or application log entries relevant to the detected anomaly. Log collection is scoped and does not perform continuous full-log ingestion.
• SSL/TLS certificate metadata — domain, issuer, expiration date, and protocol version for monitored endpoints.

What we do not collect: The agent does not access application databases, user data stored on your servers, environment variables, secrets, SSH keys, source code, file contents (other than scoped log snippets), or any personally identifiable information belonging to your end users.

05. How We Use Your Data

We process the data described above for the following purposes:

• Service delivery — displaying dashboards, generating alerts, running AI diagnostics, and producing incident reports.
• Anomaly detection — analyzing telemetry patterns to identify unusual behavior and predict potential incidents before they escalate.
• AI-assisted diagnostics — correlating metrics, logs, and events to generate root-cause analysis summaries and remediation suggestions.
• Billing and account management — processing payments, managing subscriptions, and enforcing plan limits.
• Product improvement — analyzing aggregated, anonymized usage patterns to improve the Service’s features, performance, and reliability.
• Communication — sending transactional emails (alerts, password resets, billing receipts), and occasional product updates. You may opt out of non-essential communications at any time.
• Legal compliance — responding to legal requests and enforcing our Terms of Service.

We do not use your server telemetry data to train general-purpose AI models. AI diagnostics operate on your data in isolation and results are not shared across accounts.

06. Data Retention

We retain data according to the following schedule:

Upon account deletion, we initiate permanent deletion of your personal and telemetry data within 30 days. Billing records required for tax compliance may be retained in anonymized form for the legally mandated period.

07. Security Practices

We implement industry-standard security measures to protect your data:

• Encryption in transit — all data transmitted between the agent, your browser, and our servers uses TLS 1.2 or higher.
• Encryption at rest — all stored data, including telemetry and account information, is encrypted using AES-256.
• Access controls — internal access to production systems requires multi-factor authentication and is restricted to authorized personnel on a least-privilege basis.
• Infrastructure isolation — customer data is logically isolated. No telemetry from one account is accessible to another.
• Regular audits — we conduct periodic security reviews, dependency vulnerability scanning, and penetration testing.
• Incident response — we maintain an internal incident response plan and will notify affected customers within 72 hours of confirming a data breach.

08. Third-Party Processors

We use the following third-party service providers to operate Pulsewise. Each processor handles data only as necessary to perform the services described:

We do not sell, rent, or trade your data to any third party for advertising or marketing purposes.

09. Cookies & Analytics

Pulsewise uses a minimal set of cookies strictly necessary to operate the Service:

• Session cookie — a secure, HTTP-only cookie used to maintain your authenticated session. Expires when you log out or after 7 days of inactivity.
• Preferences cookie — stores dashboard layout preferences and timezone setting. First-party, no tracking.

We do not use third-party tracking cookies, advertising pixels, or fingerprinting technologies. Our website analytics are powered by Plausible Analytics, which is cookieless and does not collect personally identifiable information.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your account and associated personal data.
• Data portability — request an export of your data in a machine-readable format (JSON or CSV).
• Restriction — request that we limit processing of your data in certain circumstances.
• Objection — object to processing of your data for specific purposes.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at support@pulsewise.io with your request. We will respond within 30 days. You may also export your telemetry data and account information directly from the Pulsewise dashboard at any time.

11. Children’s Privacy

Pulsewise is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at support@pulsewise.io.

12. International Data Transfers

Pulsewise is operated from the United States. If you access the Service from outside the U.S., your data may be transferred to and processed in the United States. By using the Service, you consent to this transfer. We take appropriate safeguards to ensure that your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact Information

For questions, concerns, or requests related to this Privacy Policy, contact us at:

Pulsewise Ltd · 24-26 Arcadia Avenue Fin009/Govonly, London, England, N3 2JU, United Kingdom · Email: support@pulsewise.io · Phone: +44 7988 524057