Privacy Policy

Pulse (the “Service”) is operated by AI TRANSMIT LTD (“Company”, “we”). For the work records and workspace content you put in the Service, you (or your organization) are the controller of that data and Company acts as your processor. For account and usage data about you as a user, Company is the controller. Contact us through our contact page.

• Account data: your name and email address, used to sign you in with an emailed sign-in link, plus your workspace, membership and role.
• Work records: the time entries you or your agents log — dates, durations, categories, tools, projects, and the notes and descriptions on them.
• Work Memory: where an admin turns it on, the decisions and learnings your team saves or confirms: title, summary, detail, status, and which entries they cite.
• Activity records: how each entry was logged (by you, a timer, or an agent), and who created or confirmed a memory, including which credential an agent used (section 5).
• Billing data: your plan and subscription status. Card details are handled by our payment provider, not stored by us.
• Usage data: anonymized page analytics for this website.
• API and MCP data: metadata about API tokens and connected apps (name, creation and last-used time). We store only a one-way hash of each token, never the token itself.

We never collect screenshots, keystrokes, window titles, idle activity, browser history, or location.

To provide and secure the Service: authenticate you, run your workspace, show reports and summaries, send account and invite emails, manage your plan, and respond to support requests. We do not sell your data, and we do not use your work records to advertise to you or anyone else.

Some features send content to third-party AI model providers, and only when you (or an admin) use them:

• AI insights. A short summary of a period is generated from aggregates only — totals, counts, and the names of the top categories — not the text of your entries. It uses Anthropic Claude through the AI TRANSMIT Router or the Vercel AI Gateway. If no model is available, a local heuristic is used instead.
• Semantic search (optional, off by default). If an admin enables it, the text of your memories (title, summary and detail) and each search query are sent to an embedding model provider (Google’s Gemini embedding model, through the same Router or Gateway) to compute a search index, which is stored alongside the memory. Nothing else is sent. Turning it off stops sending; the stored index is kept until the memory is removed.
• Independent review (optional, off by default). If an admin enables it, when an agent proposes a memory we send the proposal’s text, the descriptions and notes of the entries it cites, and the titles and summaries of similar existing memories to an evaluation model provider (through the Vercel AI Gateway, with zero data retention requested) to produce advisory scores. It never changes a memory by itself.

We do not use your content to train models, and we choose providers that do not train on it. AI output can be wrong; please review it before relying on it.

You can create API tokens, or connect an app such as Claude.ai over OAuth, to let tools and AI agents read and write your records through our REST API and MCP server. A token acts with your user’s access within one workspace, and anything an agent reads through it is disclosed to that agent and to the AI service it runs on, under that service’s own terms and privacy policy. Company does not control those third-party agents. Treat tokens like passwords: you can revoke one at any time and it stops working immediately.

When an agent writes a memory, Pulse records which credential it used — the API token’s ID and label, or the connected app’s ID and name — so reviewers can tell agents apart. That label is kept with the memory even after the token is revoked. The agent may also volunteer an unverified name, model and session ID, which are stored as-is and shown as self-reported. None of this is sent to a third party.

An admin can connect a read-only GitHub App so a work memory can point at a note that an agent keeps in a repository. When a memory cites a note, we ask GitHub only whether that file exists at that exact commit, and we store the repository name, file path, commit id and GitHub’s file checksum. We never read, copy or store the note’s contents, and we never write to your repositories. Connecting also records the GitHub account name of the installation and who connected it. To confirm you control an installation, GitHub gives us a one-time token for your account that we use once and discard. Access to the notes themselves stays governed by GitHub. Disconnecting removes the connection from Pulse; it does not delete any memory, and you should also uninstall the App in your GitHub settings.

We use service providers to run the Service, acting on our instructions: a managed Postgres database (Supabase), application hosting and analytics (Vercel), an email delivery service for sign-in and invite emails (Resend), a payment provider that acts as merchant of record for subscriptions (Paddle), an AI gateway and AI model providers (section 4), and GitHub if an admin connects it (section 6). Within your workspace, an admin can view members’ timesheets. We may also disclose data if required by law. We will provide a current provider list on request.

We keep your data while your account is active. You can request export or deletion of your workspace’s data; deleting a workspace removes its members, entries, memories and related records. Other data is removed or anonymized within a reasonable period after you close your account, except where we must keep it for legal, tax or security reasons, such as billing records.

Pulse is passwordless: every sign-in is a single-use link, valid for 15 minutes, sent to your email address, so there is no password for you to choose, for us to store, or for anyone to steal. Access to your account follows access to your inbox. Data is encrypted in transit, access is scoped per workspace, and API tokens and OAuth secrets are stored only as hashes. No system is perfectly secure; tell us promptly if you suspect a problem.

Our providers (including AI model providers) may process data in countries other than your own. Where required, we rely on appropriate safeguards for those transfers under applicable data-protection law.

Subject to applicable law, you can ask to access, correct, export or delete your personal data, or object to certain processing. Contact us through the contact page. If your data is in a workspace you do not administer, we may refer your request to that workspace’s admin.

We use a single session cookie to keep you signed in and privacy-friendly analytics to measure site usage. We do not use advertising or third-party tracking cookies.

We will post changes on this page and update the date above, and notify you of material changes.

AI TRANSMIT LTD, registered in England & Wales.
Reach us through our contact page or at pulse@transmit.work.