Privacy Policy

Last updated: 26 October 2026

PulseMarko («we») is an online service for businesses and creators: a shared inbox for messengers, chatbots, website chat, AI replies, post scheduling, link-in-bio pages, websites, online courses and broadcasts. This policy explains what data we process, why and on what legal basis, who processes it for us, and how you can control or delete it. The service is operated by [Service owner — fill in the details in Admin → Documents]. Privacy contact: [email protected].

1. Who is who

• Our customers are businesses and people who create a PulseMarko account, and their staff. For account data we are the controller.
• Their audience are people who message a customer's Instagram, Facebook Page, Telegram, Viber, WhatsApp or website chat, call through connected telephony, buy on their pages and sites or study their courses. For this data the customer is the controller and we are the processor: we process it only on the customer's instructions to provide the service (see section 11 of the Terms). For questions about such data, contact the business you messaged first; we will help.

2. What data we process

• Account data: name, email, phone, company name, password hash, settings, plan and payment status. Card data is entered on the payment provider's page (monobank, LiqPay, WayForPay or Heleket) and never reaches us.
• Connected channels: when you connect Instagram or a Facebook Page through the official Meta login, we receive an access token and basic profile data (account ID, username, name, profile picture, follower count) for the permissions you approve. For Telegram, Viber, WhatsApp, telephony and SMS — the tokens or keys you enter. We never ask for or store your Instagram or Facebook password.
• Messages, comments and calls in connected channels: text, attachments, the sender's ID, name and username as provided by the platform, contact details people choose to share (phone, email), and call data (number, time, duration, recording — if the customer enabled recording in its telephony).
• Website chat: the visitor's messages and files, the page they write from, device type, browser language and approximate country by IP. Nothing is stored on our server until the visitor writes; the visit counter lives only in their browser.
• Scheduled posts (text, images, video) and their statistics returned by the platform (reach, likes, comments).
• Orders, leads and learning: name, phone, email, product, amount, payment status, source (UTM tag, promo code), course progress, homework, certificates, confirmed devices of a student for video protection.
• Service analytics: where a customer came to our website from (UTM tags, referring site, first page — saved at sign-up) and the time of the last login.
• Technical data: IP address, browser, event and error logs needed for security and troubleshooting.

3. How we use Meta Platform Data

Data received from Instagram and Facebook APIs is used only to provide the features the customer turned on: show conversations in the inbox, send replies written by the customer or their chatbot, reply to comments, publish scheduled posts and show their statistics. We do not sell this data, do not use it for advertising, do not build profiles for third parties, do not transfer it to data brokers and do not use it to train AI models. We follow the Meta Platform Terms and Developer Policies.

4. Purposes and legal bases

• Performance of the contract (public offer): account, channels, messages, posts, payments, support.
• Legal obligation: payment accounting, responding to lawful requests of authorities.
• Legitimate interest: security, protection against spam and abuse, fixing errors, understanding how customers find and use the service (minimised or de-identified).
• Consent: optional product news — you can unsubscribe at any time.
• Audience data is processed on the customer's instructions under the customer's own legal basis.

5. Sub-processors

• Hosting and backups — data centres in the EU (Germany, Finland).
• Payment providers chosen by the customer: monobank, LiqPay, WayForPay, NovaPay (Ukraine), Heleket (crypto).
• Platforms connected by the customer: Meta (Instagram, Facebook, WhatsApp), Telegram, Viber, TikTok; SMS provider (TurboSMS); the customer's IP telephony (Binotel, Ringostat, Zadarma, Unitalk and others); email delivery; course video hosting (YouTube, Vimeo, Kinescope, Gumlet, Bunny, VdoCipher).
• Anthropic (Claude, USA) — only if the customer enables AI features: the text of the current conversation and the customer's knowledge base are sent to generate a reply and are not used to train models. Transfers outside Ukraine/the EU are made with contractual data protection safeguards.
• We do not sell personal data and do not share it with ad networks.

6. Cookies and browser storage

• Necessary: session and form protection (XSRF) cookies, «Remember me», language choice. Login does not work without them.
• Traffic source (pm_src, 30 days): remembers the ad tag or website you came from so we know which advertising works. Set only if you arrived via a tag or from another site.
• Partner program (pm_ref — up to 60 days, pm_dev — up to a year): which partner referred you and fraud protection (detecting self-referrals and duplicates). Set only after following a partner link or when a partner signs in.
• Course student device (up to 3 years): protects course video from sharing access with other people.
• Website chat: the visitor's browser keeps a conversation identifier and a visit counter (localStorage) so the conversation is not lost between pages.
• Third-party ad pixels (Google, Meta, TikTok) on our customers' websites are enabled by the customer, who is responsible for visitors' consent.

7. Retention

• Account data — while the account exists.
• Message history — 90 days on the free plan and 730 days with a paid module; older messages are deleted automatically. Contacts and posts are kept while the customer's account and the connected channel exist.
• When a channel is deleted in PulseMarko, its contacts, messages and comments are deleted.
• Website chat: anonymous conversations (no name, phone, email or request) are deleted after 90 days.
• Original images and video of published posts are deleted 7 days after publishing; a small preview remains.
• Technical logs — up to 90 days.
• When an account is deleted, its data is erased within 30 days; backups rotate within the next 30 days.
• Payment records may be kept as required by Ukrainian accounting and tax law.

8. Deleting data

• Customers: delete a channel in «Channels», or write to [email protected] to get a copy of your data or delete the whole account.
• Instagram / Facebook users: remove PulseMarko in your Instagram or Facebook settings («Apps and websites») and choose to delete data — we receive the request automatically and delete the related data. See Data deletion instructions.
• People who messaged a business: contact that business, or write to us and we will help.

9. Security

HTTPS everywhere, encrypted storage of access tokens and payment keys, signed webhooks, roles and permissions for team members, two-factor authentication, alerts about logins from new devices, daily backups, account activity log. If a breach may harm people, we notify affected customers and, where required by law, the Ukrainian Parliament Commissioner for Human Rights.

10. Automated decisions

Chatbots and AI reply to messages automatically according to rules set by the customer. They do not make decisions with legal effects for a person; the customer's staff can take over the conversation at any time.

11. Your rights

Under the Law of Ukraine «On Personal Data Protection» and, where applicable, the GDPR, you may learn what data about you is processed, get a copy, correct or delete it, restrict or object to processing, withdraw consent and complain to the Ukrainian Parliament Commissioner for Human Rights or the supervisory authority of your country. Write to [email protected]; we answer within 30 days.

12. Children

Only persons aged 18+ may create an account. Customers' audiences (students, buyers) may be younger — in that case the customer is responsible for parental consent where the law requires it.

13. Changes

We will notify customers by email or in the app at least 10 days before material changes to this policy take effect. The last update date is shown at the top of the page.