Privacy policy

1. Data controller

The controller of personal data collected through the Pulsar platform is Expeteo SARL, a company incorporated under Luxembourg law with registered office at Op Der Haart 28, 9999 Wemperhardt, Luxembourg. For any question relating to the protection of your data or the exercise of your rights, you may contact our data protection officer at contact@pulsar.lu. This policy describes the conditions under which Pulsar collects, processes and protects your personal data, in accordance with the General Data Protection Regulation (GDPR) and the Luxembourg law of 1 August 2018.

2. Data collected

Pulsar collects several categories of data: account data (last name, first name, professional email address, company name, billing address, VAT number); usage data (connection logs, IP address, browser type, pages visited, actions performed in the dashboard); data from connected sources (encrypted OAuth tokens allowing access, with the Client's authorisation, to the Google Search Console, Google Analytics 4, Google Ads, Google Business Profile, YouTube, Bing Webmaster Tools, Bing Ads, Microsoft Clarity, Meta Facebook and Instagram, Meta Ads, LinkedIn, Pinterest, TikTok, Trustpilot and Matomo accounts, together with the audience, SEO and advertising metrics retrieved through these tokens); tracking and visibility data (positions in search engines, SERP features, brand mentions and marketing prompts queried against artificial intelligence assistants); billing data (transmitted to Stripe, our payment provider). No banking data is stored by Pulsar.

3. Purposes of processing

Your data is processed to provide and operate the Pulsar platform in accordance with the contract, manage your account and subscription, aggregate and analyse your marketing data, measure the visibility of your brand in search engines and artificial intelligence assistants, produce reports and automatically written summaries, handle billing and accounting, provide technical and commercial support, secure the platform and detect abuse, inform you of important changes to the service through transactional emails, and improve the quality of the service through aggregated and anonymised usage analysis. Your data is never used for marketing purposes by third parties nor resold.

4. Legal basis

Processing related to the performance of your subscription, account management and billing is based on the legal ground of performance of the contract, set out in Article 6.1.b of the GDPR. Processing related to platform security, abuse prevention and the retention of connection logs is based on Pulsar's legitimate interest, set out in Article 6.1.f of the GDPR. Processing related to the fulfilment of our accounting and tax obligations is based on compliance with a legal obligation, set out in Article 6.1.c of the GDPR. Any non-essential cookies are based on your consent, set out in Article 6.1.a of the GDPR.

5. Retention period

Your account data is retained throughout the duration of your subscription, and for three years thereafter, for the purposes of legitimate commercial prospection and management of potential disputes. Technical logs (connections, IP, requests) are retained for twelve months for security reasons. Data from connected sources is retained as long as your subscription is active and the corresponding OAuth tokens are valid. Invoices and accounting records are retained for ten years, in accordance with Luxembourg legal obligations. Beyond these periods, your data is irreversibly deleted or anonymised.

6. Recipients and subprocessors

Your data is accessible only to authorised personnel within Expeteo SARL, strictly within the scope of their duties. Pulsar relies on carefully selected technical subprocessors: Infomaniak Network SA (Switzerland) for primary hosting and backups, Stripe (Ireland / United States) for payment processing and invoicing, Cloudflare (United States) for protection against attacks and CDN delivery, Brevo (European Union) for sending transactional emails, SerpApi (United States) for retrieving positions and SERP features on Google and Bing, including AI-generated overviews, DataforSEO (United States) for keyword search volumes, as well as the generative artificial intelligence providers Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini) and Perplexity for measuring visibility in AI and automatically writing report summaries. The providers of the connected sources you authorise (Google, Meta, Microsoft, LinkedIn, Pinterest, TikTok, Trustpilot) remain controllers for their own scope.

7. Processing by artificial intelligence

Pulsar uses generative artificial intelligence services for two purposes: measuring the visibility of your brand in the answers of AI assistants (notably ChatGPT, Gemini and Perplexity) by submitting to them the marketing prompts you define, and automatically generating written summaries of your performance reports. For this purpose, Pulsar transmits to its AI providers (Anthropic, OpenAI, Google, Perplexity) the relevant prompts as well as marketing metrics, most often aggregated. Pulsar limits these transmissions to only the data necessary and does not transmit any sensitive personal data beyond what is essential for the requested processing. These providers operate within the framework of their professional offerings accessible through programming interfaces, which do not use the transmitted data to train their models. Depending on your offer, you can disable the features that rely on artificial intelligence.

8. Transfers outside the European Union

Primary hosting is performed in Switzerland, a country covered by an adequacy decision of the European Commission. Some subprocessors (Stripe, Cloudflare, SerpApi, DataforSEO, the artificial intelligence providers Anthropic, OpenAI, Google and Perplexity, as well as the providers of connected sources Google and Meta) may carry out data transfers to the United States. These transfers are governed by the Standard Contractual Clauses adopted by the European Commission and, where applicable, by the EU-US Data Privacy Framework when the subprocessor is certified under it. Pulsar regularly assesses the compliance of its subprocessors and implements additional measures where necessary.

9. Your rights

In accordance with the GDPR, you have the right to access, rectify, erase, port, restrict and object to the processing of your personal data, as well as the right to withdraw your consent at any time for the processing that relies on it. You may exercise these rights by writing to contact@pulsar.lu, attaching proof of identity where necessary. Pulsar undertakes to respond within one month. If you consider that your rights are not respected, you may lodge a complaint with the National Commission for Data Protection (CNPD) of Luxembourg, the competent supervisory authority.

10. Security

Pulsar implements technical and organisational measures designed to protect your data against loss, alteration or unauthorised access: systematic TLS encryption of communications, encryption of OAuth tokens and sensitive secrets at rest in the database, multi-factor authentication available on all accounts, logging and auditing of administrator access, daily encrypted backups, regular security reviews and strict application of the principle of least privilege. In the event of a data breach likely to entail a risk to your rights and freedoms, Pulsar will notify the CNPD within seventy-two hours and inform you without delay.

11. Contact and supervisory authority

For any question relating to this privacy policy or to the exercise of your rights, contact Pulsar at contact@pulsar.lu or by post to: Expeteo SARL, Op Der Haart 28, 9999 Wemperhardt, Luxembourg. If you consider that your rights are not respected, you may refer the matter to the National Commission for Data Protection (CNPD): 15, boulevard du Jazz, L-4370 Belvaux, Luxembourg, https://cnpd.public.lu.

12. Data obtained from Google APIs

When you connect a Google account to Pulsar, we access, on your behalf and with your explicit authorization, only the following data (read-only unless otherwise stated): Google Search Console statistics (queries, clicks, impressions, positions), Google Analytics 4 audience metrics, Google Ads campaign data (spend, conversions, performance) and your Google Business Profile statistics (views, interactions, reviews). Use: this data is used solely to display your dashboards, charts and reports within Pulsar; it is never used for advertising purposes. Sharing: it is neither sold nor transferred to third parties; it is hosted by our subprocessors (see section 6) and, for report generation, processed by artificial-intelligence services called via API without any reuse or model training on your data. Protection: access tokens and data are encrypted in transit and at rest (see section 10). Retention and deletion: you can revoke access at any time from Pulsar's settings or from your Google account; when a source is disconnected or your account is deleted, the associated Google tokens and data are deleted (see section 5).

13. Limited Use of Google data

Pulsar's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.