Privacy Policy

Pulsido is a product of ByteYeti, a sole proprietorship based in India ("Pulsido", "we", "us"). This policy explains how we handle personal information on pulsido.com, help.pulsido.com, app.pulsido.com, and in the Pulsido apps for Slack and Microsoft Teams (together, the "Services").

We wrote it to be read. If something isn't clear, email privacy@pulsido.com.

The short version

• Companies use Pulsido to recognize their people, run pulse surveys and other surveys, and hold confidential feedback conversations. The company that signs up decides what goes into Pulsido, and we process that information on its behalf.
• We don't sell personal information, we don't show ads, and the marketing site has no analytics or tracking cookies.
• Confidential pulse answers and feedback are stored without a name attached, and nobody at your company can see who wrote them. Scores only show when three or more people are behind them.
• Your data is stored in Singapore (database) and on Cloudflare's network, and you can ask us to delete it.

1. Two roles: your company's data, and ours

Customer Data. When a company (our "Customer") uses Pulsido, everything its people put in, such as kudos, survey answers, feedback, and member details, is the Customer's data. The Customer is the controller (under the GDPR) or data fiduciary (under India's Digital Personal Data Protection Act, 2023), and we are its processor. We use Customer Data only to provide the Services under our Terms of Service and Data Processing Addendum. If you use Pulsido through your employer and want to see, change, or delete your information, start with your company's Pulsido admin. We'll help them.

Our own data. For account details we need to run our business (such as who signed up and how to bill a Customer), visitors to our websites, and people who contact us, we are the controller. This policy describes both, and is the full story for the second.

2. What we collect

Information people and companies give us

• Account details: name, work email, password (stored only as a one-way hash), profile photo, and the company you belong to. If you sign in with Google, Microsoft, or Slack, we receive your name, email, and photo from that provider.
• Member details your company adds: job title, department, teams and managers, start date, birthday (day and month only, never the year), role in Pulsido, and any custom properties an admin creates. These can come from an admin, a CSV upload, or your company's HR system if it's connected.
• What you create in Pulsido: kudos and their messages, comments, reactions, GIFs you choose, coins, rewards requests, challenge claims and their evidence, award nominations, survey and pulse answers, feedback messages, and notification preferences.
• Shipping details, only if your company sends you swag and you enter an address to receive it.
• Guest notes: someone who thanks a person through a Pulsido QR code can write a note and, if they want, sign it with a name.
• Billing contacts: for paid plans, the name and email of whoever manages billing. Card details go to Paddle, our payment provider, and never reach us.
• Messages to us: what you send to our support or sales emails.

Information from connected services

When a Customer connects another service, we receive what's needed to make it work:

• Slack or Microsoft Teams: workspace or team names, channel names, user ids, and the names and emails of members, so kudos, the pulse, and notifications reach the right people.
• HR systems (through Merge): employees' names, work emails, start dates, birthdays (we keep the day and month only), job titles, departments, managers, team membership, and employment status.
• Tremendous (gift cards, from the Customer's own account): order status and the reward details needed to deliver it.

Information collected automatically

• Security and operations logs: IP address, browser type, and request details, used to keep the Services running and to stop abuse (for example, rate-limiting sign-in attempts). These logs are short-lived.
• Cookies: see section 8. We don't use analytics, advertising, or tracking cookies.

We don't ask for special categories of personal data (such as health, religion, or ethnicity), and we ask Customers not to put them in custom member properties or open-text questions unless they have a lawful basis to do so.

3. How confidential answers and feedback are protected

These protections are built into how Pulsido stores data, not just how screens display it:

• Pulse answers are stored against a keyed pseudonym instead of your user id, with the date only and no time. Scores, eNPS, and results only appear when three or more people are behind them. Nobody, including your admins, managers, and executives, can see your individual answers or whether you've answered.
• Confidential feedback and comments are stored without your name. Managers see them under the name of the team they went to, never your name, and only the week they were written. Confidential feedback from a team of fewer than five people skips that team's managers and goes to owners and executives under your company's name, with no team named.
• Anonymous surveys hold back anonymous answers from results until at least three exist, so nobody can work them out from totals.
• Our own access: to send you a notification when someone replies to your confidential feedback, our servers can match a pseudonym back to your account. That match happens automatically, is never shown to anyone at your company, and we don't look it up or disclose it, except where a law or court order compels us to.

If you choose Show my name on a comment, or answer a survey that says it isn't anonymous, your name is visible to the people the screen tells you about.

4. How we use information

We use personal information to:

1. Provide the Services: show kudos, run surveys and the pulse, deliver feedback conversations, post to Slack or Teams, send emails and notifications, sync HR data, and fulfil rewards through the providers a Customer chooses.
2. Keep them secure and working: authenticate people, prevent fraud and abuse, debug problems, and back up data.
3. Support Customers: answer questions and fix issues people report.
4. Bill Customers for paid plans, through Paddle.
5. Improve Pulsido, using counts and other aggregated information about how features are used (for example, how many kudos were sent in a week). This never includes the content of kudos, answers, or feedback, and never identifies a person or company.
6. Meet legal obligations and enforce our terms.

We don't use Customer Data to train AI models, and we don't use it for advertising.

Optional AI drafting. If a company's owner turns on "Help me reply", a manager can ask for a draft reply to feedback. The text of that conversation, its topic, and the manager's note are sent to Anthropic. Pulsido doesn't add profile details such as names, teams, or dates, but the conversation itself may contain personal information that people wrote in it, and Pulsido doesn't remove it. Employees in the conversation are told that replies may be drafted this way. Under Anthropic's commercial terms, inputs sent through its API aren't used to train its models. The draft is only a suggestion, and nothing is sent unless the manager sends it. This feature is off unless a Customer's owner switches it on.

Legal bases (EEA and UK)

For Customer Data, the Customer determines the legal basis. For our own processing we rely on contract (to provide the Services you or your company signed up for), legitimate interests (security, support, improving the Services, and running our business, balanced against your rights), legal obligation, and consent where we ask for it.

5. Who we share it with

• People at your company, as Pulsido's features and your company's settings determine. For example, public kudos are visible to your colleagues, and team results go to that team's managers.
• Service providers (sub-processors) that host and run Pulsido, such as Cloudflare and Neon, under contracts that require them to protect the data and use it only for us. The current list, with what each does and where, is on our Sub-processors page.
• Services a Customer connects, such as Slack, Microsoft Teams, Merge, or Tremendous. Those services handle data under their own terms with the Customer.
• Paddle, which sells Pulsido subscriptions as our merchant of record and handles payment, tax, and invoicing.
• Legal and safety: if the law requires it, to respond to valid legal process, or to protect the rights, property, or safety of our users, the public, or us. Where we can, we'll tell the affected Customer first.
• A business transfer: if Pulsido is sold or merged, information would move to the new owner under this policy, and we'd tell Customers beforehand.

We don't sell personal information, and we don't share it for cross-context behavioral advertising.

6. Where data is stored and transferred

Pulsido's database runs on Neon, hosted on Amazon Web Services in Singapore (ap-southeast-1). Our application, files, caches, and queues run on Cloudflare's global network, which serves each request from a data center near the person making it. We operate from India, and some sub-processors are in the United States, so personal information may be accessed from or transferred to countries other than your own.

For personal data from the EEA, UK, or Switzerland, we use the European Commission's Standard Contractual Clauses (and the UK and Swiss addenda) in our Data Processing Addendum, along with the safeguards our sub-processors provide.

7. How long we keep it

• Customer Data stays while the Customer's account is active. Removing a member stops their access, and the kudos and history they were part of stay in the company's record unless the company asks us to remove them.
• Deleting your account (Account settings) erases your name and email, signs you out, and removes you from every company. Kudos you gave stay with the people who received them, shown as from "Former member".
• Closing a company: an owner can close it in the app. Owners can export its data or reopen it for 30 days; then it's deleted from our live systems.
• After a Customer leaves: we delete Customer Data from our live systems within 30 days of a written request or the end of the account. Copies in backups are overwritten within a further 30 days.
• Billing records are kept as long as tax and accounting law requires. Paddle keeps its own records as merchant of record.
• Security and operations logs are kept for up to 30 days.
• Emails to us are kept as long as needed to help you, and up to three years.

8. Cookies and similar technologies

Pulsido uses only what it needs to work:

These are strictly necessary, so we don't ask for consent. pulsido.com and help.pulsido.com set no cookies. When you open Paddle's checkout to pay, Paddle may set its own cookies under Paddle's privacy policy. GIFs come from GIPHY's servers, which can see your IP address when an image loads.

9. Security

We use encryption in transit (HTTPS) everywhere, encryption at rest for the database and storage, hashed passwords, encrypted storage for connected-service tokens, and permissions that keep admins from seeing results and feedback. Our Security page has the details. No system is perfectly secure, and if a breach affects your information, we'll tell the affected Customers and people as the law requires.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict some processing, to withdraw consent, and to complain to a data protection authority. This includes rights under the GDPR and UK GDPR, India's Digital Personal Data Protection Act, 2023, and US state laws such as California's CCPA. We won't treat you differently for using them.

• If you use Pulsido through your employer, contact your company's Pulsido admin first. They control your company's data, and we'll help them with your request. You can also write to us and we'll pass it on.
• For everything else, email privacy@pulsido.com. We may need to confirm your identity first. An authorized agent can make a request for you with your written permission.
• In Pulsido itself, you can edit your profile, choose whether your birthday and work anniversary are celebrated, and choose which notifications reach you.
• Emails: service emails (such as invites) are part of using Pulsido. We don't send marketing email without permission.

We answer within 30 days, or sooner where the law requires.

11. Children

Pulsido is a workplace product for people aged 18 and over. We don't knowingly collect information from children. If you think a child has given us information, tell us and we'll delete it.

12. Grievance Officer and contact

For questions, requests, or complaints about privacy, including under India's Information Technology Act, 2000 and Digital Personal Data Protection Act, 2023, contact our Grievance Officer:

Grievance Officer, ByteYeti (Pulsido) Email: privacy@pulsido.com

We acknowledge complaints within 72 hours and aim to resolve them within 30 days. Our postal address is available on request. If you're in the EEA or UK and aren't satisfied with our answer, you can complain to your local data protection authority.

13. Changes to this policy

When we make a material change, we'll update the date at the top and tell Customers' owners by email or in Pulsido at least 30 days before it takes effect. Earlier versions are available on request.