Privacy Policy

1. Overview

Pulse5 ("we", "us") operates pulse5.site. We collect the minimum information needed to run the product: your account details, the prompts and projects you create, and basic technical data needed to keep the service working and secure.

2. Information we collect

When you subscribe to a paid plan, billing is handled by a third-party, PCI-compliant payment processor (such as Stripe). We do not receive or store your full card number, CVV, or bank account details — only a tokenised reference that lets us manage your subscription. The payment processor may share with us: your email address, billing country, last-four card digits, subscription status, and transaction timestamps. We use this data solely to manage your account and comply with tax and financial record-keeping obligations. Lawful basis: performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest in fraud prevention (Art. 6(1)(f) GDPR).

3. How we use information

• To operate Pulse5: turn your prompts into a plan, images, and code, and show you a live preview;
• To save your projects and let you come back to them from any device;
• To secure accounts, prevent abuse, and enforce our Terms of Use;
• To understand usage patterns and improve reliability and quality;
• To communicate with you about your account or important changes to the service.

We do not sell your personal information, and we do not use your prompts or projects to train our own foundation models.

3a. Lawful basis for processing (EU/UK users)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following lawful bases under GDPR Article 6:

• Contract (Art. 6(1)(b)): Processing your account information, prompts, and project data is necessary to provide the Pulse5 service you signed up for.
• Legitimate interests (Art. 6(1)(f)): We process usage and technical data to maintain security, prevent abuse, and improve the service. Our legitimate interest in keeping the platform secure and functional outweighs the minimal privacy impact of this processing.
• Legal obligation (Art. 6(1)(c)): We may process or retain data where required by applicable law.

Where we rely on legitimate interests, you have the right to object to that processing. Contact us at contact@pulse5.site.

4. Who we share information with

Pulse5 is built on top of a small number of infrastructure and AI providers. To generate and store your sites, the following categories of data necessarily flow to them:

• AI model provider — your prompts, chat history, and existing project files are sent to a third-party large-language-model provider to generate plans and code.
• Image search provider — search terms derived from your prompt are sent to a third-party image-search service to find candidate photos (see also the image-copyright notice in our Terms of Use).
• Authentication & database provider (Supabase) — stores your account, session, and project data.
• Google — if you choose "Continue with Google," Google shares basic profile information (name, email) with us to create your account.
• Hosting provider — runs the Pulse5 web application itself.
• GitHub (optional) — if you choose to connect your GitHub account, we access repositories on your behalf, at your direction, to push your project's code to a repository you select or create.
• Supabase Management API (optional) — if you choose to connect a Supabase account separate from Pulse5's own, we access your Supabase projects and run the database changes you request, at your direction.
• Domain & hosting provider (Vercel) — if you connect a custom domain to a published site, we register it with our hosting provider to route traffic to it.

If you invite someone to collaborate on a project, their email address and your project's content become visible to each other for as long as they remain a collaborator on that project.

We don't share your information with advertisers, and we don't sell it to data brokers. We may disclose information if required by law, or to protect the rights, safety, or property of Pulse5 or our users.

5. Cookies and local storage

Pulse5 sets the following cookies and uses local storage:

We don't use cross-site advertising trackers, analytics cookies, or fingerprinting scripts. All cookies we set are strictly functional.

6. How long we keep information

We keep your account and project data for as long as your account is active, so you can keep returning to and editing your work. If you delete a project or your account, we remove it from active systems; residual copies may persist briefly in backups before they age out.

7. Your rights and choices

Depending on where you live, you have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate information in your account settings, or by contacting us.
• Erasure ("right to be forgotten"): Delete your account and all associated data directly from Settings → Account → Delete account. You can also contact us to request deletion.
• Restriction: Ask us to restrict processing of your data in certain circumstances.
• Data portability: Request an export of your project data in a machine-readable format.
• Objection: Object to processing based on legitimate interests. Contact us to do so.
• Complaint: Lodge a complaint with your local data protection authority. For EU/EEA users, find your authority at edpb.europa.eu.

To exercise any of these rights, email us at contact@pulse5.site. We will respond within 30 days.

California residents (CCPA/CPRA)

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. California residents have the right to know what personal information we collect, to delete it, and to correct it. To exercise these rights, contact us at contact@pulse5.site.

8. Security

We use industry-standard measures — including encrypted connections (HTTPS) and access-controlled databases — to protect your information. No method of transmission or storage is perfectly secure, and we can't guarantee absolute security.

9. Children's privacy

Pulse5 is not directed at children, and we don't knowingly collect personal information from children under 13 (or the relevant minimum age in your country). If you believe a child has provided us with personal information, contact us and we will delete it.

10. International data transfers

Because our infrastructure and AI providers operate internationally, your information may be processed in countries other than the one you live in, which may have different data-protection laws. Where required, we rely on appropriate safeguards offered by those providers for cross-border transfers.

11. Changes to this policy

We may update this Privacy Policy as Pulse5 evolves. We'll update the "Last updated" date above and, for material changes, provide a more prominent notice in the product.

12. Contact

Questions about this Privacy Policy, or want to exercise your data rights? Email us at contact@pulse5.site.