Privacy Policy

Effective date: 13 October 2026. Version: 1.0.

1. Who is responsible

Pulse is operated by Babak Eivazi Adli, Ukraine ("we", "us"). This policy covers the Pulse desktop application, the Pulse website, and our hosted connector authorization service. Contact info@pulseera.ai about this policy or your data.

This policy describes the local desktop product and its hosted OAuth service. A future cloud workspace, shared memory service, or customer account platform will require additional disclosures before it processes your data.

2. Information processed

Pulse processes the messages, files, task instructions, business context, and configuration you provide. Business context can include your company, contacts, responsibilities, priorities, and descriptions of work. Sessions may contain agent responses, source excerpts, tool results, downloaded files, and attachments.

If you connect Google, the relevant integration can access your Google account email address and the data covered by the permissions you approve: documents, spreadsheets, Drive files and metadata, Gmail messages and threads, or calendar information. A particular file or resource must also be accessible to your Google account. Pulse does not receive your Google password.

If you connect Zoom, the integration can read authorized user information, meetings, and cloud recording metadata under its approved permissions. Availability depends on your Zoom plan, account permissions, and recording settings.

Our OAuth service processes authorization codes, access tokens, refresh tokens, temporary flow identifiers, and signed refresh receipts. It uses network addresses for request limits. Hosting and network providers necessarily process connection metadata to deliver HTTPS traffic.

If you contact support, we process your contact details and the information you choose to include. Do not send passwords, API keys, or unnecessary customer data in support requests.

3. Purposes and permission

We process information to perform the tasks you request, maintain source connections, produce agent responses, and provide support and operational security. Google access is optional and requested when you connect the relevant source. Current Google connectors use read-only permissions.

Authorizing a Google source grants permission to access that source. It does not authorize undisclosed uses of its data. When connected information is used with an external AI service, the relevant data-use disclosure must be shown and your affirmative consent obtained before that transfer.

Where applicable, processing is based on performance of the service you request, your consent for optional connections and transfers, necessary security and support interests, or legal obligations. Applicable rights and legal requirements depend on your location and the circumstances of processing.

4. AI processing and other recipients

An agent's model request can include your prompt, conversation history, attachments, business context, and results returned by connected tools. Google content used in a task can therefore be transmitted to the AI endpoint selected for that session. Summaries and other derived information can also remain in the conversation and be used as later context.

You choose the AI provider and model endpoint through your Pulse connection settings; Pulse does not assign one mandatory AI provider. The service receiving task context is the provider or endpoint selected for the session, including any intermediary you configure. Its retention, processing locations, security, and account-specific terms can differ between providers and subscription or API products. Review those terms before using connected information. Choosing a provider does not waive Google-data restrictions. Use of a Google connection does not authorize undisclosed transfers or prohibited uses by a selected AI provider.

The hosted authorization service uses server and network infrastructure to provide HTTPS connections. Infrastructure services process connection metadata needed to deliver and secure these connections. The broker does not proxy business data from Google or Zoom.

Diagnostics may be sent to Sentry if an ingest endpoint is configured. Such reports can include errors, application version, configuration tags, and a persistent machine hash. Sensitive-header and field redaction is partial and is not a guarantee that every personal detail is removed. Whether reporting is enabled depends on the application build and configured endpoint. The operator processes reports received through its configured services for troubleshooting and security; third-party retention depends on the receiving service and account terms.

Update delivery endpoints, if configured, process network requests for version checks and downloads. Any optional integration, custom model endpoint, or user-requested export may introduce additional recipients. A user-selected or custom endpoint must still satisfy the Google-data restrictions for the requested processing; selection alone does not establish compliance.

5. Google data commitments

We handle Google API data under the Google API Services User Data Policy, including its Limited Use restrictions. Google-derived data is used only for the disclosed, user-facing productivity features you request. We do not sell Google user data, use it for advertising or credit decisions, or transfer it to data brokers.

Pulse does not provide a feature to train generalized AI models on your Google Workspace data. Google-derived data must not be used or retained to create, train, or improve generalized or non-personalized AI or machine-learning models. This restriction also applies to external processing services. Do not select a service or account whose applicable terms permit such use of the Google-derived content you send. We do not represent that every custom endpoint you can configure has been evaluated or approved for this purpose.

Human access to Google-derived data is limited to cases permitted by Google's policies: your affirmative agreement to access specific data, necessary security work, legal requirements, or permitted aggregated internal operations. Any transfer in a business transaction must meet Google's prior-consent requirements. We do not claim that your content is inaccessible to a provider under its security or legal obligations.

6. Storage, retention, and security

Credentials in the standard local credential vault are encrypted. Conversation history, attachments, tool-result files, and business records are stored locally and are not all encrypted by Pulse. Your operating-system permissions, disk encryption, and backups also affect their protection.

Authorization flows expire after five minutes. Pending state and uncollected token results are held in memory and removed after successful collection or cancellation; expired entries are cleared on a subsequent request or the periodic cleanup, normally within 30 seconds of expiry. A restart also removes pending flows. During refresh, a refresh token and signed receipt are processed to obtain renewed credentials; the broker does not maintain a durable account-token database.

The server stores common OAuth application credentials and the signing key as operational secrets. These are separate from your account credentials. Callback access logs are disabled in the current proxy configuration. The deployed containers use bounded rotating operational logs (up to three 10 MiB files per container). This size limit does not establish a fixed number of retention days. Other system or infrastructure records may have separate retention. Operational secret backups do not constitute a central backup of your documents, emails, or conversations.

Local session information remains until you delete the relevant records or files. Support correspondence is kept as needed to resolve your request, maintain necessary records, and meet applicable legal obligations; you may request its deletion where applicable. External AI providers and your own backups may keep separate copies. Provider-side retention is not controlled by deleting a local session.

HTTPS protects OAuth-service traffic. No transmission or storage system is risk-free; we do not promise absolute security, secure erasure, or end-to-end encryption of all application data.

7. Your choices and deletion

You can choose whether to connect a source, decline a task, change a model connection, remove local sessions, and revoke Google or Zoom access in your provider account settings. Revocation prevents further authorized API access as enforced by the provider. It does not remove source excerpts already saved in session history or copies already processed by another provider.

In the current implementation, deleting a source entry is not a guarantee that its credential is removed from the local vault or revoked with the provider. Use provider-side revocation and the steps in Disconnect and Delete Data. Removing a connection and deleting saved content are separate operations.

Contact info@pulseera.ai for requests concerning information held by the operator, including access, correction, deletion, or other rights available under applicable law. Identity verification may be needed. We cannot remotely erase local files or your personal backups. Requests concerning third-party provider copies may also need to be directed to that provider.

8. International processing

Your computer and selected service providers may be in different countries. The processing locations of external AI services depend on the provider, endpoint, and account you select. The operator is based in Ukraine. A domain suffix or registration record does not establish where every service processes data. Applicable legal safeguards for an international transfer depend on the parties, locations, and processing arrangement; this policy does not assert that all processing is confined to one country.

9. Website, children, and changes

These public pages include no analytics scripts or tracking cookies. Hosting still processes network requests. Additional website features will require updated disclosures if their data practices differ.

Pulse is a business productivity service intended for adults and is not directed to children. Do not provide information about children unless you have lawful authority and the service is suitable for that use.

We will publish material policy changes here. Where a new Google-data purpose or transfer requires renewed consent, we will obtain it before that new processing begins. The effective date identifies the applicable published version.