Data Usage Policy
Updated Sept 14, 2026
Version 2.0
This policy describes how Pulse Insights, LLC ("Pulse Insights", "we", "us") collects, uses, and protects data from clients of our platform ("you") and from the end users of your websites and applications.
This policy is incorporated into and forms part of our Terms of Service. Where you and Pulse Insights have signed a master services agreement or statement of work, or a data processing addendum, those agreements control over this policy as to their subject matter, in accordance with the Order of Precedence set out in the Terms of Service.
Capitalized terms used but not defined here have the meanings given in the Terms of Service.
1. Roles of the Parties
With respect to data collected from the end users of your websites and applications, you are the controller or business and Pulse Insights is the processor or service provider.
Pulse Insights collects and processes that data solely on your behalf, at your direction, and for the purpose of providing the Services. We do not retain, use, or disclose it for any purpose other than performing the Services, except as permitted by applicable Data Protection Laws. We do not sell or share it, as those terms are defined under applicable Data Protection Laws.
You control the configuration of the Services, including which properties, pages, and data elements the Services may access, and the point at which the Services are permitted to begin collecting data relative to your consent management mechanism. You are responsible for providing all notices and obtaining all consents required by applicable law before Pulse Insights tags, scripts, or software development kits load or begin collecting data on your properties.
2. Information We Collect from Platform Users
When you register for a Services Account, we collect Account Information such as name, business email address, and company name. We use it for:
Account creation and authentication
Client support and communication
Billing and account administration
Service operation, security, and improvement
We do not sell or rent your Account Information. We share it with third parties only where necessary to provide the Services, as described in our Subprocessors list, or where required by law.
3. Information We Collect from End Users of Your Websites and Applications
When you deploy the Pulse Insights snippet or SDK on your properties, we collect technical and behavioral data from your end users for the purposes of survey and intervention targeting, delivery, and reporting. This includes:
Browser and operating system
Device type and screen characteristics
IP address, used for geographic inference and for abuse and bot prevention. Where our systems identify traffic as automated or abusive, the request is refused rather than served. IP addresses may be retained in allow and block lists maintained for security purposes, in some cases on a temporary basis
Page URL, including any completion URL
Timestamp
Interaction events required to determine survey and intervention eligibility
Survey and intervention responses
Custom metadata you choose to pass with a submission
We also record API and survey activity at the account level for usage analytics and billing.
Custom metadata. You determine what custom metadata is passed to the Services. You are responsible for ensuring that it does not include Sensitive Personal Data, and does not include Personal Data beyond what is permitted under your agreement with us and under applicable law.
We do not use this data to build profiles of individuals across clients, and we do not combine data collected on behalf of one client with data collected on behalf of another except in aggregated and de-identified form as described in Section 5.
4. How We Use Collected Data
Pulse Insights uses collected data to:
Target, deliver, and render surveys and interventions
Generate client-specific reporting, metrics, and alerts
Operate, maintain, secure, and support the Services
Investigate and address service, security, support, or technical issues
Comply with legal obligations
5. Aggregated and De-identified Data
Pulse Insights may use data in aggregated and de-identified form, from which no individual and no client organization can reasonably be identified, to improve the Services and to produce benchmark and industry-level analyses.
We will not use client data or Personal Data to train, fine-tune, or otherwise develop any machine learning model made available outside your Services Account, and we will not sell, license, or otherwise make client data available for our own independent commercial purposes or those of any third party.
We will not publish or share identifiable or client-specific data without your prior written permission.
6. Artificial Intelligence
Certain features of the Services use machine learning models, including large language models operated by third parties, to classify, summarize, and generate content and interventions. Our approach to that processing:
Third-party model providers used in the Services are OpenAI and Anthropic, as listed in our Subprocessors list.
These features operate on collected data after the fact. They do not run during a live end user session, and they do not generate or select the content shown to an end user. Surveys and interventions are delivered by deterministic rules using content approved in advance by the client.
We minimize the data sent to those providers to what is necessary for the feature to function, and we apply filtering intended to remove Personal Data and Sensitive Personal Data before transmission.
We do not permit third-party model providers to retain or train on data transmitted through the Services.
Data transmitted to those providers is encrypted in transit.
Outputs generated by these features are probabilistic and may be inaccurate. The contractual treatment of those outputs, including review responsibilities and restrictions on use, is set out in the Terms of Service.
Our broader principles for the use of artificial intelligence are described in our AI Policy, which is provided for information and is not incorporated into our Terms of Service.
7. Third-Party Integrations
The Services allow you to connect survey data to analytics and marketing tools such as Google Analytics and Adobe Analytics. Where you enable such an integration, client-side scripts transmit the data elements you have configured, directly from the end user's browser to that tool, on submission.
Pulse Insights does not receive or access data from those tools. We transmit only what your configuration specifies.
You are responsible for ensuring your configuration complies with the terms of the receiving platform and with applicable law. We prohibit use of the Services to transmit Personal Data to analytics platforms in violation of those terms or of applicable law.
8. Data Retention and Deletion
We retain client data for the duration of your Subscription Term and in accordance with any retention period specified in your agreement with us.
Following termination or expiration, we will make client data available for export for thirty (30) days on written request, and will delete it within ninety (90) days after that period. Copies held in routine backups are deleted on our ordinary backup cycle. We may retain data where required by law, and may retain aggregated and de-identified data as described in Section 5.
9. End User Rights Requests
Because Pulse Insights acts as a processor or service provider with respect to end user data, requests from individuals to access, correct, or delete their data should be directed to the client on whose properties the data was collected.
If we receive such a request directly, we will, where permitted by law, refer the individual to the relevant client and notify that client. We will provide reasonable assistance to clients responding to these requests, as set out in the applicable data processing addendum.
10. Data Security
We maintain physical, technical, and administrative safeguards designed to protect client and end user data, including:
Encryption in transit and at rest
Role-based access controls
Logging, monitoring, and alerting
Third-party penetration testing
Continuous control monitoring across the SOC 2, GDPR, US Data Privacy, HIPAA, and EU AI Act frameworks
We are currently undergoing a SOC 2 Type II examination. Current control status and available compliance reporting can be provided to clients and prospective clients on request under NDA.
11. Incident Response
We maintain an incident response plan. In the event of a security incident affecting your data, we will notify affected clients without undue delay, and within any period required by applicable law or by your agreement with us, and will provide information reasonably necessary for you to meet your own notification obligations.
12. International Transfers
Pulse Insights operates the Services from cloud infrastructure located in the United States. The Services and client data may be accessed or managed from other locations.
Pulse Insights LLC is certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework. Where a client requires an additional or alternative transfer mechanism, it is set out in our data processing addendum.
13. Policy Updates
We may revise this policy from time to time. The current version is always available at https://www.pulseinsights.com/legal/data-usage-policy and shows its effective date. For material changes, we will provide notice by email or in-app message before the change takes effect.
Questions about this policy can be directed to privacy@pulseinsights.com.