Privacy Policy
Last updated: November 6, 2026 · Version 2026-11-06
This policy explains what personal data Pulse5 collects, why, who receives it, how long we keep it, and what rights you have. It applies to people who use Pulse5 and to visitors of pulse5.site. It also explains our role when we handle data for sites that our customers build.
1. Who is responsible
The controller of your personal data is Omer, an individual based in Israel ("Pulse5", "we"). Privacy contact: contact@pulse5.site.
For the websites our customers build and publish, the customer is the controller of their visitors' data and Pulse5 is their processor (see Section 9).
2. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | Email address, password (stored only as a hash by our authentication provider), Google account ID and name if you use Google sign-in, time of acceptance of the Terms and a hashed IP address | You, Google |
| Your content | Prompts, chat messages, uploaded files, generated project files and images, project names, site addresses | You; our AI providers on your behalf |
| Connections and keys | Your own AI provider keys, GitHub and Supabase connection tokens, custom domains. Keys and tokens are stored encrypted | You |
| Usage and security | Daily usage counts, audit-log entries about your actions (with your IP address), rate-limit counters (stored under a hash), error logs, browser type | Automatically |
| Web analytics on our own pages | Page views and device type through Vercel Web Analytics, which does not use cookies or store IP addresses | Your browser |
| Requests and reports | Your name, email and message when you contact us, make a privacy request, or report content | You |
| Web pages you ask us to read | The address and the text of pages you give to Lead Check or Site Audit | You; the public web |
| Billing (when paid plans open) | Email, billing country, plan, last four card digits and status. Our payment partner handles card details; we never see them | You, payment partner |
3. Why we use it, on what legal basis, and for how long
| Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|
| Create your account, run the builder, save and publish your projects | Contract (Art. 6(1)(b)) | While your account is open; 30 days after closing for export, then deleted. Backups are overwritten on our database provider's normal cycle |
| Security, abuse prevention, rate limiting, enforcing the Terms | Legitimate interest (Art. 6(1)(f)) | Rate-limit counters 30 days; IP addresses in audit logs 90 days, then removed; audit entries without IP while the account lasts |
| Record that you accepted the Terms and confirmed you are an adult | Legal obligation and legitimate interest (proof) | While your account is open, plus the limitation period for claims |
| Handling reports of illegal content and copyright notices | Legal obligation and legitimate interest | 3 years after a case closes (rejected reports); longer where the law or a dispute requires |
| Privacy requests | Legal obligation | 3 years after completion |
| Page-view counters on published sites | Contract with the site owner; legitimate interest | 24 months |
| Billing, tax and accounting records (when paid plans open) | Legal obligation | As tax law requires, typically 7 years |
| Service emails (verification codes, security and account notices) | Contract; legitimate interest | Not stored beyond delivery logs at our email provider |
We do not send marketing email. If that changes we will ask for your opt-in first and every message will have an unsubscribe link.
We do not sell personal data, we do not share it for advertising, and we do not use it to profile you in ways that have legal or similarly significant effects. Automated checks flag pages that look like another company's sign-in page and enforce rate limits; a person reviews any decision that disables a site.
4. Who receives your data
We use the companies below to run Pulse5. Each processes data only on our instructions and under a data processing agreement or the provider's standard data terms.
| Provider | What for | Data | Where |
|---|---|---|---|
| Supabase | Authentication and database | Account, projects, chat, usage, reports | Cloud data centres of the provider |
| Vercel | Hosting, content delivery, web analytics | Requests to our servers (IP address, browser), your published sites | Global edge, US |
| OpenRouter, and the model hosts it routes to | AI text and code generation | Your prompts, chat history and project files | US and other countries where the model host runs; OpenRouter picks the host for each request |
| Cloudflare (Workers AI) | AI image generation | Image descriptions derived from your prompt | Global |
| Resend | Verification and account emails | Your email address | US |
| Web search service operated for Pulse5 | Looking up facts and pages for your build | Search terms and page addresses taken from your prompt | Run by Pulse5 |
| Unsplash and Pexels | Stock photos and video | Search terms. Images on published sites are loaded straight from their servers, so they see the visitor's IP address | US |
| "Continue with Google" sign-in | Name, email, Google ID | US | |
| GitHub, Supabase (your own account) | Only if you connect them | Tokens, repository and database actions you request | US |
| Your own AI provider | Only if you add your own key | Your requests | As the provider states |
| Payment partner (when paid plans open) | Selling plans as seller of record | Billing details | As the partner states |
We may also disclose data when a court or authority requires it and the request is valid, to protect people from harm, or in a sale or reorganisation of the company with the same protections. We review such requests and tell the person concerned unless the law forbids it.
Fonts and open-source libraries used on our own pages are served from our own servers. When you preview a site inside the editor, your browser may load fonts and libraries directly from Google Fonts, Fontshare, unpkg, jsDelivr and Tailwind, which then see your IP address. Published sites load these through our servers instead.
5. How AI is used
Pulse5 sends your prompts, the chat so far and the relevant project files to AI models to plan and write your site, and sends descriptions to an image model to create pictures. The output is generated by machines, may be wrong, and is marked as AI-generated (see the Terms).
Pulse5 does not use your content to train its own models. The companies that run the models process it under their API terms, which govern what they keep. We aim to use model hosts that do not retain or train on API data and will list the hosts in the table above. Do not put secrets, health data or other sensitive personal data into prompts.
7. Transfers outside your country
Our providers process data in the United States and other countries. Where the law requires a safeguard, we rely on an adequacy decision (for example the EU-US Data Privacy Framework for certified providers) or on the Standard Contractual Clauses and, for the UK, the UK Addendum, in our providers' data processing agreements. Israel holds an EU adequacy decision for transfers to Israel. You can ask us for a copy of the safeguards by writing to contact@pulse5.site.
8. Your rights
Depending on where you live, you can ask us to: tell you what we hold about you and give you a copy; correct it; delete it; restrict or stop certain processing; give you your data in a portable format; and withdraw consent you have given. You can object to processing that rests on our legitimate interests. You will not be treated worse for using these rights. We answer within one month (30 days in Israel, 45 days in California).
Ways to use them: delete your account and download your data in Settings → Danger zone, or use this form. We confirm it is you by replying to the email address you give.
EU, EEA, UK and Switzerland
You may complain to your data protection authority, for example through edpb.europa.eu (EU), the ICO (UK) or the FDPIC (Switzerland).
Israel
Under the Privacy Protection Law you may inspect and ask for correction or deletion of data we hold about you. The database we keep is covered by the law's registration and security rules, and you may complain to the Privacy Protection Authority.
California and other US states
We do not sell or share personal information for cross-context behavioural advertising, and we do not process it for targeted advertising or profiling. You may ask to know, access, correct and delete your data, and you can appeal a refusal by replying to our answer. We do not knowingly collect data from anyone under 18.
Brazil, Canada (including Quebec), Australia and elsewhere
The rights above apply to you as far as your national law gives them. Quebec residents may ask for our privacy officer, contact@pulse5.site. Brazilian residents may contact the same address, our privacy contact for LGPD matters.
9. Visitors to sites built with Pulse5
When you visit a site that someone built and published with Pulse5, that site's owner decides what is collected from you and why, and is responsible for telling you. Pulse5 processes some of that data for the owner: messages submitted through forms, page-view counts, and, outside the EU, EEA, UK and Switzerland, visitor analytics. If you have a question about a site's data, ask its owner. You can also write to us and we pass it on. To report a site, use the report page.
10. Data processing terms for site owners
This section is Pulse5's data processing agreement with customers who are controllers of personal data that visitors give to their sites, and it is part of the Terms.
- Subject and duration. Pulse5 processes form submissions and visitor analytics from the owner's published sites to provide the service, for as long as the owner uses it. Types of data: whatever visitors enter in forms, plus technical data. People concerned: the owner's visitors and customers.
- Instructions. We process this data only on the owner's documented instructions, which are the Terms and the owner's use of the product, and tell the owner if we think an instruction breaks the law.
- Confidentiality and security. Staff with access are bound by confidentiality. We apply the measures in Section 12.
- Sub-processors. The owner authorises the providers in Section 4. We tell owners about additions or changes by email or in the app at least 30 days ahead, and an owner who objects on reasonable grounds may stop using the service. We stay responsible for our sub-processors.
- Assistance. We help the owner answer visitors' rights requests and carry out security, breach and impact-assessment duties, taking into account the nature of processing.
- Breaches. We tell the owner without undue delay, and within 48 hours, after becoming aware of a personal-data breach affecting their data.
- Return and deletion. On request or when the owner's account ends, we delete or return the data, within 30 days, unless the law requires us to keep it. Owners can delete submissions at any time.
- Audits. We give owners the information needed to show compliance and allow reasonable audits on 30 days' notice, no more than once a year, at the owner's cost.
- International transfers. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the Standard Contractual Clauses (Commission Decision (EU) 2021/914), Module Two (controller to processor) and, for onward transfers, Module Three, are incorporated by reference. Option 7 (docking clause) applies; the authority is the one of the owner's establishment or, if there is none, Ireland; the governing law is Irish law. For the UK, the International Data Transfer Addendum issued by the ICO is incorporated; for Switzerland the clauses apply with references to Swiss law and the FDPIC.
Contact for data processing matters: contact@pulse5.site.
11. Children
Pulse5 is only for people 18 and older. We do not knowingly collect data from anyone younger. If we learn that we have, we delete it and close the account. If you think a child has given us data, write to contact@pulse5.site.
12. Security and breaches
Connections use HTTPS. API keys and connection tokens are encrypted at rest. Databases have access rules that limit each user to their own data. Passwords are hashed. We limit staff access and keep a log of account and publishing actions. No system is perfectly secure.
If a breach of personal data puts people at risk we tell the authorities within 72 hours where the law requires, and the people affected without undue delay. To report a vulnerability, write to contact@pulse5.site; our security.txt has the details.
13. Changes
We keep earlier versions of this policy and give a summary of changes. For material changes we tell you in the app or by email before they take effect.
14. Contact
Privacy: contact@pulse5.site. Operator: Omer, an individual, Israel.