Privacy Policy

1. Who we are

Gareth Bradley, a sole trader trading as Pulse Training("Pulse", "we", "us"), of 34 Daffodil Wynd, Blyth NE24 4UF, United Kingdom, operates the Pulse live training platform. This policy explains what personal data we collect, why, and how we handle it.

2. What we collect

Host/account data: when you or your organization sign up, we collect your name, email address, and organization name. Pulse is passwordless — we don't collect or store a password, only either an emailed one-time sign-in code (never stored in plain text and expires within minutes) or the public key of a passkey you register.

Participant data: when someone joins a training session using a session code, we collect their display name, email address, and their responses (poll answers, scenario choices, discussion text, word-cloud entries) to that session's content, on the hosting organization's instruction. On plans with AI coaching enabled, we also generate and store AI-written coaching notes and a personalized end-of-session report based on those responses.

Payment data: if your organization upgrades to a paid plan, payment is collected and processed entirely by Paddle, our payment provider and Merchant of Record. We never see or store your card details — we only receive confirmation that a subscription is active, its plan, and its renewal date.

Usage/operational data: standard technical data needed to run the service (IP address for rate-limiting and abuse prevention, browser/device type, session timestamps).

3. How we use it

• to run live training sessions and keep every participant's view in sync;
• to generate AI coaching notes and end-of-session reports, where enabled on your plan;
• to send transactional email (sign-in codes, invitations, session recaps, billing receipts);
• to process payment and manage subscriptions, via Paddle;
• to prevent abuse (e.g. rate-limiting sign-in attempts); and
• to maintain and improve Pulse itself.

4. Our legal basis

For host/account data, we process it under contract necessity — we need it to provide you the service you've signed up for. For participant data, Pulse acts as a data processor: the host organization that runs a session is the data controller and is responsible for having a lawful basis to collect their participants' information. See our Data Processing Addendum for the terms governing that relationship.

5. Who we share data with (subprocessors)

We use the following subprocessors to run Pulse. None of them can use your data for their own purposes.

• OpenAI — generates AI coaching notes and end-of-session reports (Team/Enterprise plans only).
• Resend — sends transactional email (sign-in codes, invitations, session reports).
• Paddle — processes payments and acts as Merchant of Record for paid plans.
• Upstash — short-lived rate-limiting counters (IP address/email, auto-expiring); never used for anything else.
• PostHog — product analytics and crash/error reporting, covering both host/account activity and session/participant activity.
• Railway — hosts the application, database, and uploaded images (object storage).

6. Data retention

We keep session and participant data for as long as your organization's account is active, so hosts can review past sessions and participants can revisit their recap. If you close your account, or ask us to delete specific data, we'll delete it within a reasonable time except where we're required to keep it for legal or accounting purposes (e.g. payment records). Sign-in codes and internal auth tokens are single-use and short-lived by design, regardless of account status.

7. International data transfers

Railway (hosting, database, and object storage) and PostHog (analytics) run on EU infrastructure. Other subprocessors, including OpenAI, Paddle, and Resend, may process data outside your country. For any subprocessor whose infrastructure sits outside your country, we rely on appropriate safeguards, such as Standard Contractual Clauses or an applicable adequacy decision.

8. Security

Pulse is passwordless by design — there's no password to leak or reuse elsewhere. Sign-in codes are hashed at rest and expire after a short window; passkeys never leave your device. Data is encrypted in transit (HTTPS) and at rest via our infrastructure providers.

9. Your rights

Depending on where you're located, you may have rights to access, correct, export, or delete your personal data, or to object to certain processing. To exercise any of these, contact us at support@usepulse.training. If you're a training participant and want to exercise these rights, we'll direct your request to the organization that hosted your session, since they control that data.

10. Children's privacy

Pulse is a workplace training tool and isn't directed at, or knowingly used by, anyone under 16.

11. Cookies

The Pulse app uses a single session cookie to keep you signed in — no third-party advertising or tracking cookies. See our marketing site for its own cookie notice, if different.

12. Changes to this policy

We may update this policy from time to time; we'll post the updated version here with a new "Last updated" date.

13. Contact

Gareth Bradley, trading as Pulse Training, 34 Daffodil Wynd, Blyth NE24 4UF, United Kingdom. Privacy questions: support@usepulse.training.