What this notice covers
This notice explains how Bougainvillea Technologies LLP ("Pulse", "we", "us") handles personal data about:
- people who visit pulsecorp.co, including the blog at pulsecorp.co/blog;
- people who ask us for a demo or a free study through a form on the site;
- the people who work for our customers and use their Pulse account.
It does not cover the people who take part in interviews run on Pulse. They have their own notice for interview participants, which is also shown at the start of every interview.
For the personal data in this notice, Pulse decides why and how it is used. Under India's Digital Personal Data Protection Act 2023 that makes us the data fiduciary, and under the GDPR the controller. Our registered address is available on request from privacy@pulsecorp.co.
What we collect
When you visit the site.
- If you click Okay in the cookie banner: the pages you view, how you arrived, your approximate location derived from your IP address, and your device and browser type, collected through Google Analytics and PostHog.
- If you click Okay, PostHog also records how you move through a page: where you scroll and click, what appears on screen, and what you type into our calculators and search boxes. What you type into a field that asks for your details, such as your name, email address or phone number, is hidden from these recordings, and so is any password. We use them to find where pages confuse or stop people.
- Until you click Okay, Google Analytics and PostHog receive a signal for each page view, with no identifier stored on your device. PostHog counts these visits with a code calculated on its own servers, which cannot be used to follow you from site to site.
- Your choice itself, stored in a cookie on your device. The cookie policy lists every cookie.
When you fill in a form.
- The demo form asks for your email address and first name. The one on the home page also asks for your last name.
- The free-study form asks for your first name, last name and email address.
- With each, we record which page you sent it from, and the campaign tag in the link that brought you there, if it had one.
- Our CRM, HubSpot, also records the approximate location (country, region, city, timezone) that your internet connection reports.
When you read the blog.
- Reading the blog needs no account and collects nothing from you. Loading it sends your IP address to the public code network that delivers its search tool.
When you use a Pulse account.
- Your name, work email, company and role.
- The billing details for the account.
- Records of how you use the service, kept to run it, support it and keep it secure.
- The interviews your studies run: an audio recording and a written transcript of each one, and the name, email address or phone number of a participant if your study asks for them. We process these on your behalf, as your service provider, and your organisation decides why they are collected. The participant notice explains this to every participant.
- Which pages of the service were opened, and whether an interview started or finished. The analytics providers never receive a recording, a transcript, or a participant's name, email, phone number or IP address.
We don't ask for sensitive data, and we ask you not to include it in a form.
Why we process it
| Purpose | Data | Basis |
|---|---|---|
| Replying to a demo or free-study request, and setting up the study | Form data | You asked us to (DPDP s.7(a); GDPR Art. 6(1)(b)) |
| Understanding which pages help people and which do not, including where people get stuck on a page | Analytics data, including session recordings | Your consent, given in the banner (DPDP s.6; GDPR Art. 6(1)(a)) |
| Counting visits anonymously before you click Okay, to know how many people use the site | Page views with no identifier | Our legitimate interest in knowing how many people use the site (GDPR Art. 6(1)(f)) |
| Running your account and providing the service | Account data | Our contract with your employer |
| Keeping the site and service secure, and meeting legal duties | Any of the above, as needed | Legal obligation and legitimate uses |
We do not sell personal data. We do not use it for advertising, and no advertising tags run on the site.
Who we share it with
We share personal data only with the service providers who help us run Pulse. Each processes it on our instructions:
- HubSpot (United States): our CRM, where form submissions are stored.
- Google (Google Analytics): analytics on this website, only after you click Okay, and in the service.
- Amazon Web Services: hosting for the website (United States), and storage for interview recordings and transcripts (India).
- Ghost (self-hosted on our own server, in the United States): the blog.
- jsDelivr: delivers the blog's search code. It receives your IP address.
- ElevenLabs: runs the voice conversation in an interview.
- Anthropic: analyses interview transcripts.
- OpenAI: runs the voice or text conversation in an interview, or analyses its transcript, when a study uses its models.
- PostHog (United States): analytics on this website, including anonymous counting before you click Okay and session recordings after; and product analytics in the service, meaning which pages were opened and whether an interview started or finished.
We will disclose personal data to authorities where the law requires us to.
Where it is held
The website, including the blog, is hosted in the United States. Interview recordings and transcripts are stored in India. HubSpot holds form submissions in the United States. PostHog holds website analytics and session recordings in the United States. Google processes analytics data on its global infrastructure. Where personal data of people in the European Economic Area or the UK leaves those regions, it goes to service providers certified under the EU-US Data Privacy Framework (and its UK Extension), and we also rely on the Standard Contractual Clauses in our contracts with them.
How long we keep it
| Data | Kept for |
|---|---|
| Form submissions | Until you ask us to delete them, and never longer than 120 months after our last contact with you |
| Analytics data | Until you ask us to delete it, or the law requires us to. Google Analytics itself deletes it 14 months after your last visit |
| Session recordings | 1 year, then PostHog deletes them automatically. We keep them this long to compare how people use the site across releases and through a full year. If you ask us to delete your data, we delete your recordings too |
| Your consent choice | 12 months, then we ask again |
| Account data | For the life of the account. After it closes, until you ask us to delete it, and never longer than 120 months after it closes |
Your rights
Depending on where you are, you can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct or complete it;
- delete it;
- stop using it, or withdraw a consent you gave;
- (GDPR) object to our use of it, restrict it, or give you a copy in a portable form;
- (DPDP) name someone to exercise these rights for you if you die or can no longer act.
To withdraw your analytics consent at any time, click "Cookie settings" at the bottom of any page, then "Turn off".
We reply within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India, or to your local data protection authority in the EEA or the UK.
How to contact us
Write to privacy@pulsecorp.co. Our grievance officer is Khyati Ojha. To raise a grievance about how we handle your personal data, write to privacy@pulsecorp.co.
We will update this notice when what we do changes. When we do, the date at the top changes, and the banner asks for your choice again.