Last updated: 16 October 2026

Privacy Policy

What data Pulbeat processes, why, and how long it is kept.

This document is published in English; the English version is binding.

1. Who we are

Pulbeat is provided by Serhii Artiushenko, a private individual residing in Ukraine, the controller of your personal data. Contact: [email protected].

Our guiding principle is to collect only what we need. Pulbeat counts leads; it does not read them.

This policy covers visitors of pulbeat.com and our customers. We do not receive personal data of the visitors of the websites you connect to Pulbeat.

2. What we collect and why

Identity and access. Your email address, the language you chose, sign-in sessions and the times you signed in — to give you access to your dashboard and send you notifications, invoices and essential service messages. Legal basis: performance of the contract. We never sell your personal information and never use your name or company in marketing without permission.

Connected websites. The site address; every 5 minutes, counters of form submissions, email delivery failures, spam-filtered submissions and WooCommerce orders; an anonymous identifier of each form (a hash, not its name); plugin, WordPress and PHP versions; whether the site responded. We do not receive names, phone numbers, email addresses, messages or IP addresses of your site's visitors. Legal basis: performance of the contract.

Notifications. If you connect Telegram, your chat identifier and the name or @username of the chat, so we can send alerts there.

Billing. Invoices and payments: plan, amount, date and payment method as reported by you or the payment provider. We never see or store card numbers. Legal basis: contract and legal obligations (accounting).

Website interactions. When you visit pulbeat.com we count the page address, the referring website or utm_source, and a daily anonymous visitor identifier — a hash of the IP address and browser with a random value that changes every day and is kept only in memory. The identifier is deleted after 2 days; we keep only daily totals. We do not use cookies for statistics. Legal basis: legitimate interest in understanding how the site is used.

Security logs. Our server records technical request logs, including IP addresses, to protect the Service against abuse. They are deleted after 30 days. Legal basis: legitimate interest in security.

Voluntary correspondence. When you email us, we keep the correspondence, including your email address, to answer you and to have a history of earlier conversations.

3. Cookies and local storage

We use one strictly necessary cookie, __Host-lh_session, to keep you signed in (up to 30 days; it ends after 7 days of inactivity or when you sign out). Your browser remembers your language choice in local storage. We do not use advertising or third-party tracking cookies and do not show ads.

4. When we access or disclose your information

  • To provide the Service. We use these providers, who process data on our behalf: Cloudflare (delivers the website and protects it against attacks), Resend (sends sign-in links, invoices and notifications by email), Telegram (delivers notifications if you connect it). When paid plans start, we will add our payment provider to this list before any payment is taken.
  • To help you when you ask. We look at your account only with your consent, as part of a support request.
  • To investigate, prevent or act on abuse and security incidents, using logs and metadata.
  • When required by law. We disclose data only in response to a legally binding request from a competent authority, and only the minimum required. Where allowed, we tell you about the request.
  • If the business changes hands. If Pulbeat is acquired by or merged with another company, we will notify you before your data becomes subject to a different privacy policy.

We do not sell personal data and do not share it for advertising.

5. Your rights

You can request access to your data, correction, deletion, restriction of processing, a copy in a portable format, or object to processing based on legitimate interest. Write to [email protected]; we answer within 30 days and may ask you to confirm the request from your account email. We will not discriminate against you for exercising these rights.

You also have the right to complain to a data protection authority — in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU or UK, the authority of your country.

6. How we secure your data

Data is transmitted only over HTTPS. Requests between your site and our cloud are signed with Ed25519 keys and protected against replay. Sign-in links and sessions are stored only as hashes. Staff access to the admin panel requires a one-time code (two-factor authentication) and is logged. Our server is not exposed to the internet directly; traffic reaches it only through Cloudflare.

7. Data retention and deletion

Site counters: 90 days. Visit statistics: daily totals for up to 400 days; anonymous identifiers for 2 days. Server logs: 30 days. Sign-in links: 15 minutes (records deleted within a day). Account data: while your account exists. Invoices and payments: as long as accounting law requires.

When you delete your account, your account, sites and statistics become inaccessible immediately and are deleted from active systems within 30 days and from backups within 60 days, except data we must keep by law.

8. Location of data and international transfers

Our servers are located in Ukraine. Cloudflare, Resend and Telegram may process data in other countries, including the USA. When personal data from the EU or UK is transferred to a country without an adequacy decision, the transfer relies on standard contractual clauses or equivalent safeguards offered by the provider.

9. Children

The Service is intended for businesses and is not directed at children under 16. We do not knowingly collect their data.

10. Changes and questions

We may update this policy. If we make a significant change, we update the date above and notify account owners by email. Questions: [email protected].

Adapted from the Basecamp open-source policies / CC BY 4.0.