Data processing agreement

This agreement covers the feedback your customers leave through Pulse, which Pulse processes on your behalf. It applies once you use Pulse for your business. For a countersigned copy, email support@pulseapp.click with your business's legal name and address.

1. Roles

You (the business) are the controller of your customers' feedback. Pulse is the processor and acts only on your documented instructions, which are: collect feedback through your QR codes, store it, transcribe, translate and analyse it, show it to you, and email you about it.

2. What is processed

• People: your customers who leave feedback, and your own staff who use Pulse.
• Data: voice recordings, typed feedback, transcripts, translations, summaries and topics, optional names, optional reply email addresses, and when and where (which QR code) feedback was left.
• Pulse does not ask for special category data. If a customer says something sensitive in a recording, it is processed only as part of that recording.

3. Pulse's obligations

• Process the data only to provide Pulse to you.
• Use sub-processors that don't train AI models on your customers' feedback.
• Make sure anyone with access to it is bound to keep it confidential.
• Keep it secure: encryption in transit and at rest, short-lived signed links for recordings, and access limited to each business's own data.
• Use only the sub-processors listed on the privacy page, bind each to equivalent data protection terms, and announce new ones there at least 14 days before they start.
• Help you answer your customers' requests to see or delete their feedback. You can delete any feedback yourself in Pulse.
• Tell you without undue delay, and within 72 hours of finding out, about any breach affecting your data.
• Give you the information you reasonably need to show you comply, and answer written questions about how Pulse protects your data.

4. Transfers

Some sub-processors are outside the UK and the EEA, mainly in the United States. Those transfers rely on the European Commission's standard contractual clauses or the UK equivalent, as set out in each sub-processor's terms.

5. Retention and deletion

Recordings are deleted after 12 months, and reply addresses within a day of the reply or after 90 days. Everything else stays until you delete it or your account. When you delete your account, Pulse deletes your data straight away; copies in backups can remain for up to 30 days. You can export your data from Settings first.

6. Your obligations

You confirm you have a lawful basis for collecting feedback, and that your QR codes or signs make clear that feedback is recorded and analysed. Pulse's feedback page shows customers this too.

This agreement is a standard template, not legal advice. If your business needs different terms, email us.