🚀 Welcome to DataPulse Privacy
We believe privacy should be simple to understand. This policy explains exactly how DataPulse works, what data we collect, and your rights - in plain English.
Quick Facts:
✅ We don't sell your data to anyone
✅ You control what data is collected
✅ Website visitors can opt-out anytime
✅ We comply with GDPR, CCPA, and international privacy laws
1. Who We Are and How DataPulse Works
DataPulse is a privacy-focused website analytics service that sends push notifications to your phone when important events happen on your website - like signups, purchases, or high traffic spikes.
Here's the key thing to understand: When you use DataPulse on your website, you are in control of the data collection. We simply process the data on your behalf to provide analytics and notifications.
🎯 You (Website Owner)
Data Controller - You decide what to collect and are responsible for privacy compliance
⚙️ DataPulse
Data Processor - We process data according to your instructions and help with compliance
2. What Data We Collect (The Complete Picture)
Transparency is key - here's exactly what data DataPulse collects and why:
📱 Your DataPulse Account
When you sign up for DataPulse, we collect the basics needed to provide your service:
Email & Password: For login and account security
Name: To personalize your dashboard
Website Details: Name, URL, domain for tracking setup
Preferences: Dashboard settings, notification preferences
Device Token: To send push notifications to your phone
👥 Website Visitor Analytics
This is what we track automatically on your website (you control what gets collected):
Automatic Tracking (No Code Required)
📄 Page Views: Which pages visitors view, page titles, load times
📊 Scroll Behavior: How far visitors scroll (25%, 50%, 75%, 100% milestones)
⏱️ Session Activity: Time spent, pages per visit, entry/exit pages
💻 Device Info: Browser, operating system, device type, screen size
🌍 Location: Country only (from IP address, can be anonymized)
🔗 Interactions: Button clicks, form submissions (metadata only), link clicks
📈 Marketing Data: UTM parameters from your campaigns
Manual Events (You Control When These Fire)
👤 User Actions: Signups, logins, logouts, account deletions
🎯 Custom Events: Any additional data you choose to track
⚠️ Important: You Control Custom Data
Website owners can include unlimited custom data with events. You are fully responsible for what custom data you collect - this could include personal information if you choose to send it. DataPulse doesn't monitor or control this custom data.
2.3 Storage Methods
We use localStorage (not cookies) to store a unique visitor identifier on your device. This identifier helps us track your interactions across multiple visits to the same website.
3. How We Use Information
3.1 DataPulse Account Data
We use your account information to:
🔧 Service Provision: Provide and maintain our services
📊 Analytics: Send you analytics dashboards and reports
📱 Notifications: Deliver push notifications about website activity
💳 Payments: Process payments and manage subscriptions
📧 Communication: Communicate with you about service updates
🎧 Support: Provide customer support
3.2 Website Visitor Data
Visitor data is processed solely to provide analytics services to our customers. We:
📈 Reports: Generate analytics reports and dashboards
🔔 Alerts: Send push notifications when specified events occur
📊 Metrics: Calculate bounce rate, session duration, and page views
🎯 Patterns: Identify popular pages, referral sources, and user behavior patterns
4. Data Controller vs. Data Processor
For DataPulse Users: We are the data controller for information related to your DataPulse account.
For Website Visitors: We are a data processor. The website owner (our customer) is the data controller who determines what data to collect, how long to retain it, and what privacy settings to apply. Website owners are responsible for:
✅ Consent: Obtaining necessary consents from visitors
📋 Notices: Providing privacy notices to visitors
⚙️ Settings: Configuring appropriate privacy settings (IP anonymization, Do Not Track compliance)
🎯 Custom Data: Determining what custom data to collect through event properties
⚖️ Compliance: Complying with applicable privacy laws (GDPR, CCPA, etc.)
5. Privacy Controls and Settings
Website owners can configure the following privacy settings:
🔒 IP Anonymization: Remove the last octet of visitor IP addresses
🚫 Do Not Track: Honor visitors' browser DNT preferences
🎯 Event Selection: Choose which visitor actions to track
📊 Custom Data Collection: Define what additional information to collect through event properties
6. Information Sharing and Disclosure
We do not sell, rent, or trade personal information. We may share data in these limited circumstances:
👤 With Website Owners: We provide analytics data to the website owners who installed our tracking code
🔧 Service Providers: We may use third-party services for hosting, payment processing, and email delivery
⚖️ Legal Requirements: We may disclose information if required by law or to protect our rights
🏢 Business Transfers: Information may be transferred if we are acquired or merge with another company
7. Data Retention
We retain data based on the following criteria:
7.1 DataPulse Account Data
✅ Active Accounts: Until you delete your account or request data deletion
📅 Inactive Accounts: May be deleted after 3 years of inactivity with 30 days notice
⚖️ Legal Hold: May be retained longer if required by legal obligations
7.2 Website Visitor Analytics Data
📈 Raw Analytics Data: Retained for 26 months from collection (configurable by customer)
📊 Aggregated Statistics: May be retained indefinitely in anonymized form
🎯 Custom Event Properties: Same retention period as other analytics data
⚙️ Customer Control: Website owners can configure shorter retention periods
7.3 Deletion Process
⏰ Automated Deletion: Data is automatically deleted when retention periods expire
🚑 Manual Deletion: Available upon customer request or when exercising privacy rights
💾 Backup Recovery: Data may remain in encrypted backups for up to 90 days after deletion
8. International Data Transfers
Our services are hosted in the United States. When you use our services, your data may be transferred to, stored, and processed in the United States.
8.1 Transfer Safeguards
For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland, we implement appropriate safeguards:
✅ Adequacy Decisions: We rely on adequacy decisions where available
📜 Standard Contractual Clauses (SCCs): We use EU-approved SCCs for data transfers
🔒 Technical and Organizational Measures: We implement supplementary measures including encryption, access controls, and data minimization
8.2 Data Localization
Some jurisdictions may require data to be stored locally. We work with customers to ensure compliance with local data residency requirements where legally required.
9. Your Privacy Rights
Your privacy rights depend on your relationship with DataPulse and applicable laws in your jurisdiction:
9.1 For DataPulse Account Holders
Under GDPR (EU residents):
📜 Access (Article 15): Request copies of your personal data and information about how it's processed
✏️ Rectification (Article 16): Correct inaccurate or incomplete data
🗑️ Erasure/Right to be Forgotten (Article 17): Request deletion of your personal data
📦 Data Portability (Article 20): Receive your data in a structured, machine-readable format
⏸️ Restriction of Processing (Article 18): Limit how we process your data in certain circumstances
🚫 Objection (Article 21): Object to processing based on legitimate interests
❌ Withdraw Consent: Withdraw consent for processing where consent is the legal basis
Under CCPA (California residents):
📊 Right to Know: Request information about personal information collected, used, or shared
🗑️ Right to Delete: Request deletion of personal information
🚫 Right to Opt-Out: Opt-out of sale/sharing of personal information (we do not sell personal information)
⚖️ Right to Non-Discrimination: Not be discriminated against for exercising privacy rights
🌐 Global Privacy Control (GPC): We recognize and honor GPC signals
Under PIPEDA (Canada residents):
📜 Access: Request access to personal information and how it's used
✏️ Correction: Request correction of inaccurate personal information
❌ Consent Withdrawal: Withdraw consent for collection, use, or disclosure
9.2 For Website Visitors
If you are a visitor to a website using DataPulse, the website owner is the data controller responsible for your rights. However, you have these options:
🚫 Do Not Track: Enable "Do Not Track" in your browser (honored if website owner has enabled DNT respect)
🗑️ Data Deletion: Clear your browser's localStorage to remove our visitor identifier
🏢 Contact Website Owner: Exercise your rights directly with the website owner per their privacy policy
📧 Contact DataPulse: Email support@thedatapulseapp.com for assistance or questions
9.3 How to Exercise Your Rights
📧 Email: support@thedatapulseapp.com
⏰ Response Time: Within 30 days (GDPR), 45 days (CCPA), or as required by applicable law
🔒 Identity Verification: We may request identity verification to protect your personal data
🎆 No Fees: Rights requests are generally free (reasonable administrative fees may apply for excessive requests)
10. Data Security
We implement industry-standard security measures including:
🔒 Encryption: Encryption of data in transit and at rest
🔍 Monitoring: Regular security audits and monitoring
🔑 Access Control: Access controls and authentication mechanisms
🛡️ Secure Development: Secure coding practices and vulnerability testing
11. Children's Privacy
Our services are not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it immediately.
12. Legal Basis for Processing (GDPR)
For EU residents, we process personal data based on the following legal grounds:
📝 Contract Performance (Article 6(1)(b)): To provide our analytics services to you as a DataPulse customer
⚖️ Legitimate Interest (Article 6(1)(f)): To improve our services, ensure security, and conduct business operations
✅ Consent (Article 6(1)(a)): For marketing communications and non-essential cookies (where required)
📄 Legal Obligation (Article 6(1)(c)): To comply with legal requirements such as tax obligations
13. Data Processing Agreement (DPA)
For customers acting as data controllers, this privacy policy incorporates our Data Processing Agreement terms:
📝 Processor Obligations: We process personal data only on documented instructions from you
🔒 Security Measures: We implement appropriate technical and organizational measures
📄 Sub-processors: We maintain a list of approved sub-processors and notify you of changes
👤 Data Subject Rights: We assist you in responding to data subject requests
🚨 Breach Notification: We notify you of personal data breaches without undue delay
🔍 Audit Rights: You may audit our compliance with data protection obligations
🗑️ Data Return/Deletion: We return or delete personal data at the end of service provision
14. Breach Notification
In the event of a personal data breach:
🛡️ Internal Response: We have procedures to detect, investigate, and respond to breaches
🏢 Authority Notification: We notify relevant supervisory authorities within 72 hours where required
💬 Customer Notification: We notify affected customers without undue delay
👤 Individual Notification: We notify affected individuals when required by law
15. Third-Party Services
We use the following categories of third-party services that may process personal data:
☁️ Cloud Hosting: For secure data storage and processing
📱 Push Notification Services: To deliver real-time notifications to iOS devices
🌍 IP Geolocation Services: To determine country-level location from IP addresses
💳 Payment Processors: For subscription billing and payment processing
📧 Email Services: For transactional and marketing communications
All third-party processors are contractually bound to protect personal data and process it only for specified purposes.
16. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of significant changes by:
🌐 Website Updates: Posting the updated policy on our website
📧 Email Notifications: Sending email notifications for material changes
📅 Date Updates: Updating the "Last updated" date at the top of this policy
17. Customer Data Collection Responsibilities
IMPORTANT: Website owners using DataPulse have full control over what data they collect through custom event properties. This creates important responsibilities and limitations:
17.1 Customer Responsibilities
⚖️ Legal Compliance: Ensure all data collection complies with applicable privacy laws (GDPR, CCPA, PIPEDA, LGPD, etc.)
✅ Consent Management: Obtain necessary consents before collecting personal data through custom properties
🎯 Data Minimization: Collect only data necessary for legitimate business purposes
📋 Privacy Notices: Provide clear privacy notices to website visitors about data collection
⚠️ Sensitive Data: Do not collect sensitive personal data (health, financial, biometric, etc.) without explicit consent and legal justification
17.2 DataPulse Limitations
🙅 No Content Monitoring: We do not monitor or validate the content of custom event properties
⚖️ Customer Liability: Customers are solely responsible for the legality and appropriateness of custom data they collect
📜 No Legal Advice: DataPulse does not provide legal advice regarding data collection practices
🔧 Compliance Support: While we provide privacy tools (IP anonymization, DNT support), customers must ensure their specific use complies with applicable laws
17.3 Prohibited Data Collection
Customers must not use DataPulse to collect:
💳 Payment card information (PCI DSS protected data)
🆔 Government identification numbers (SSN, passport numbers, etc.)
🔍 Biometric data or genetic information
🏥 Health or medical information without proper legal basis
👶 Data from children under 13 without parental consent
⛔ Any data that violates applicable privacy laws
18. International Compliance
DataPulse supports compliance with major international privacy regulations:
18.1 Supported Regulations
🇪🇺 GDPR (EU/EEA): General Data Protection Regulation
🇬🇧 UK GDPR: United Kingdom data protection laws
🇺🇸 CCPA/CPRA (California): California Consumer Privacy Act and amendments
🇨🇦 PIPEDA (Canada): Personal Information Protection and Electronic Documents Act
🇧🇷 LGPD (Brazil): Lei Geral de Proteção de Dados
🇸🇬 PDPA (Singapore): Personal Data Protection Act
🇦🇺 Privacy Act (Australia): Australian Privacy Principles
18.2 Compliance Features
✅ Consent Management: Tools for obtaining and managing visitor consent
👤 Data Subject Rights: Support for access, deletion, and portability requests
🌐 Cross-Border Transfers: Appropriate safeguards for international data transfers
🚨 Breach Notification: Procedures for timely breach notification
📝 Data Processing Agreements: Built-in DPA terms for controller-processor relationships
19. Contact Information
For privacy-related questions or to exercise your rights:
Response Times:
🇪🇺 GDPR Requests: Within 30 days (may be extended by 60 days for complex requests)
🇺🇸 CCPA Requests: Within 45 days (may be extended by 45 days with notice)
🌍 Other Jurisdictions: As required by applicable law