Privacy Policy

Last updated August 9, 2026.

This policy explains what personal information Pulso Labs handles through its website, booking system, client portal, project delivery, payments, and connected services.

Who is responsible for your information

9558-5840 Québec inc., operating as Pulso Labs, is responsible for the personal information described in this policy. We are established in Québec, Canada, and may serve clients in other jurisdictions.

Our Privacy Officer oversees compliance and privacy requests. Contact the Privacy Officer at yoan@pulsolabs.io. The person with the highest authority in the company remains accountable under Québec law.

Information we collect

Enquiries and communications

Name, email address, phone number, preferred contact method, Discord username, enquiry type, and message content.
Messages, replies, support requests, approvals, review decisions, notification history, and any files attached to those communications.

Bookings and projects

Delivery date, selected services, payment type and status, transaction reference, invoice details, annual services, consent version, consent timestamp, and booking reference.
Company and brand details, target market, project preferences, domain and business-email choices, website content, colour and logo direction, referral source, and other answers submitted in the required project brief.
Files such as photographs, logos, reference material, business-card content, and project deliverables.
Project status, milestones, deadlines, approvals, website addresses, renewal preferences, and launch or handoff information shown in the client portal.

Account, device, and security information

Client account identifier, normalized email address, hashed one-time access tokens, session and sign-out records, and project ownership records.
IP address, browser and device information, requested pages, timestamps, security events, integration attempts, and error logs.
Cookie choices and locally stored booking progress. Uploaded files are not stored in browser local storage.

Payments

Card information is entered on Stripe-hosted checkout pages. Pulso Labs does not receive or store complete payment-card numbers. We receive transaction status, amount, currency, receipt or session identifiers, and limited billing details needed to reconcile the booking.

Why we use information

To answer enquiries, prepare quotes, reserve delivery capacity, process payments, create invoices, and deliver contracted services.
To provide passwordless portal access, save project preferences, exchange files and messages, collect approvals, and communicate project status.
To create and maintain project tasks, folders, accounting records, renewal reminders, and final handoff materials.
To prevent fraud and abuse, secure the platform, diagnose failures, keep audit records, enforce agreements, and meet legal, tax, and accounting obligations.
To improve the site through optional analytics only after the required consent has been given.

We collect only information reasonably necessary for these purposes. Depending on the context, processing is based on consent, the steps needed to enter into or perform a contract, compliance with law, or another basis permitted in the applicable jurisdiction. Withdrawing consent does not affect processing already lawfully completed and may prevent us from providing a feature that requires the information.

Information about other people

If you give us personal information about an employee, contractor, property owner, tenant, guest, customer, or another person, you confirm that you are authorized to do so and have provided any notice or obtained any permission required by law. Do not upload unnecessary identity documents, financial information, health information, passwords, or other sensitive records.

Service providers and disclosures

We use service providers only when needed to operate the platform or deliver a project. Depending on the features enabled for a project, information may be processed by:

Hostinger and WordPress-related infrastructure for website hosting, database storage, email, and secure administration.
Stripe for hosted checkout, payment processing, fraud prevention, and receipts.
Intuit QuickBooks Online for customer, invoice, discount, and payment-status records.
Google Drive for project files.
ClickUp for internal production tasks, deadlines, client-facing project updates, and approved communication workflows.
OpenAI only when the optional official deliverable-review rewriting feature is enabled. General questions, service requests, and conversation replies are not sent to OpenAI. The original official review message is retained, rewritten text is subject to review controls, and no decision about a client is made solely by this feature.
Transactional email and professional advisers such as accountants, legal counsel, and security specialists where reasonably necessary.

Providers process information under their own privacy terms and our applicable agreements with them. Pulso Labs remains responsible for information entrusted to its service providers as required by law.

We may also disclose information with your direction, to complete a business transaction involving Pulso Labs, to collect a debt, to investigate misuse, to protect rights or safety, or when required by law, court order, or a competent authority. We do not sell personal information or use it for cross-context behavioural advertising.

Processing outside Québec

Our providers may process information elsewhere in Canada, the United States, or another country where they operate. Information there can be subject to local law and lawful access by authorities. Before entrusting personal information outside Québec, we assess relevant privacy factors and use contractual and other safeguards where required. You may ask the Privacy Officer for more information about these transfers.

Retention and deletion

We keep personal information only as long as reasonably necessary for the purpose collected, an active client relationship, warranties and dispute periods, security, backups, and legal, tax, accounting, or professional obligations. Retention depends on the record:

Unsuccessful enquiries and abandoned booking information are deleted or de-identified when no longer needed for follow-up, security, or dispute prevention.
Booking, contract, consent, invoice, and payment records are retained for the period required by applicable tax, accounting, consumer-protection, and limitation laws.
Project records, portal messages, approvals, and production files are retained while the project or related support remains active and for a reasonable period afterward to support handoff, warranty, disputes, or a returning client.
Expired magic links cannot be used. A successful link creates a trusted-device session lasting up to 30 days unless the client signs out or access is revoked sooner.
Security and integration logs are retained only as long as needed to investigate reliability, abuse, or legal issues.

When retention ends, records are deleted, securely destroyed, or de-identified. Copies may remain temporarily in protected backups until those backups rotate. You may request deletion, but we may retain information that law permits or requires us to keep.

Security and confidentiality incidents

We use measures appropriate to the sensitivity of the information, including encrypted transport, limited role-based access, private file routes, randomized stored filenames, hashed one-time tokens, authenticated portal sessions, server-side ownership checks, rate limiting, logging, and provider access controls. Clients must protect access links and sign out on shared devices. No internet service can guarantee absolute security.

If a confidentiality incident occurs, we will take reasonable steps to contain it, assess the risk, keep the legally required incident record, and notify affected people and regulators when required.

Your choices and rights

Where applicable, you may ask to access or correct your personal information, withdraw consent, obtain information about our use and disclosures, request deletion when we no longer have a lawful reason to retain the information, or receive eligible computerized information in a structured and commonly used format. You may also change optional cookie choices at any time.

We may need to verify your identity and authority before responding. Some requests can be limited or refused where law permits or requires, including where another person's rights, legal privilege, fraud prevention, or mandatory recordkeeping is involved. We will explain any refusal and available recourse.

To exercise a right or make a complaint, contact yoan@pulsolabs.io. You may also complain to the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada, or another regulator with jurisdiction.

Children

Our services are for businesses and adults authorized to contract for them. They are not directed to children, and we do not knowingly collect personal information from a child through this platform. Contact us if you believe a child submitted information.

Changes and contact

We may update this policy as the platform, providers, or law changes. The date above identifies the current version. If a material change affects information already collected, we will provide additional notice or seek consent when required.

Privacy Officer, 9558-5840 Québec inc., operating as Pulso Labs. Email: yoan@pulsolabs.io.