Privacy Policy

Sales Pulse AI, LLC, doing business as AI Sales Pulse ("AI Sales Pulse," "we," "us," or "our") operates the Pulse sales assistant platform (the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, and what rights you have.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Name and email address (required)
• Phone number (optional)
• Company name (required)
• Password (stored as an irreversible bcrypt hash, we never store your actual password)
• ERP/accounting system type (e.g., BGATE, QuickBooks Online, SAP, NetSuite) for integration configuration

1.2 Business Data

As you use the Service, you and your team may store:

• Customer and prospect records (names, emails, phone numbers, company information, addresses)
• Sales pipeline data (opportunities, deal values, stages)
• Messages and conversation threads (email and WhatsApp, if connected)
• Product catalog information (SKUs, pricing, inventory)
• Follow-up tasks, notes, and reminders
• Purchase/order history
• AI-generated insights and draft messages

New accounts start with a small set of clearly labeled demo records so the Service is usable before you connect a live system. This demo data is generated by us, is identified as such in the interface, contains no real customer information, and is removed once you import or sync your own data.

1.3 Security & Session Data

To protect your account, we collect:

• IP address and approximate geographic location on login
• Device and browser information (e.g., "Chrome on macOS")
• Login timestamps and session activity
• Audit log events (logins, password changes, 2FA setup, session revocations)

1.4 Integration Credentials

If you connect third-party services, we store:

• API keys or OAuth tokens for your ERP or accounting system (including QuickBooks Online via Intuit OAuth), email provider, and WhatsApp Business
• Optionally, your own AI provider API key, if you choose to supply one instead of using the AI included with Pulse
• All credentials are encrypted at rest using AES symmetric encryption before storage
• Disconnecting an OAuth-based integration invalidates the stored tokens and ends our access

1.5 Our Role (Controller and Processor)

For your own account information (name, email, login and security data), Sales Pulse AI, LLC is the controller. For the business data your company brings into Pulse (customers, contacts, and connected messages), your company is the controller and we act as its processor, or "service provider" under the CCPA. We process that data only to provide the Service to your company. The terms of that processing are in our Data Processing Addendum, which is part of our Terms of Service.

1.6 People in Your Conversations

Connected email and WhatsApp messages include information about other people, such as your customers and their staff. We process it only on behalf of the company that connected the account. If you are one of those people and want to make a request about your information, please contact the company you do business with. You may also contact us and we will pass your request to them.

2. How We Use Your Information

Purpose	Data Used
Provide the Service (CRM, pipeline, AI insights)	Account info, business data
Authenticate you and secure your account	Email, password hash, 2FA codes, sessions
Send transactional emails (2FA codes, password resets, daily digests, welcome emails)	Email address, name, task summaries
Connect your ERP, email, or messaging systems	Integration credentials, sync configuration
Generate AI-powered insights and draft messages	Customer data, conversation history, product catalog (sent to our AI provider, Anthropic, to produce the result; never sold, never used to train models)
Detect and prevent abuse	IP address, failed login attempts, rate limiting
Maintain audit trail for compliance	Security events, timestamps, device info

3. Third-Party Services & Data Sharing

We use the following third-party services to operate Pulse. Data is shared only as necessary to provide features you enable:

Service	Purpose	Data Shared
Resend	Transactional email delivery	Email address, name, email content (2FA codes, password reset links, daily digests, welcome emails)
Anthropic (Claude AI)	AI sales assistant, insights, and drafts (included with Pulse)	Business data relevant to the request (customer records, conversation history, product catalog, sales metrics). AI is included with Pulse and runs on AI Sales Pulse's own Anthropic account, so no API key is required from you. Anthropic processes this data on our behalf to provide the AI features. Your business data is never sold and is never used to train AI models. You may optionally supply your own Anthropic API key, in which case requests run on your provider account instead.
Microsoft Graph API	Outlook email integration (opt-in)	OAuth tokens, email messages. Only activated when you connect your Outlook account via OAuth2 authorization.
Google (Gmail API)	Gmail integration (opt-in)	OAuth tokens and email messages, read-only. Only activated when you connect your own Gmail account through Google's consent screen. See Google User Data below.
Meta WhatsApp Business API	WhatsApp messaging integration (opt-in)	WhatsApp access token, contact metadata. Only activated when you configure WhatsApp Business integration.
BGATE / ERP Systems	Customer & product data sync (opt-in)	API credentials, salesperson code. Syncs customer, product, and inventory data from your ERP (currently BGATE; other ERP connections are built on request). Only activated when you configure your ERP connection.
Intuit (QuickBooks Online)	Accounting/ERP data sync (opt-in)	Authorized by you through Intuit's OAuth 2.0 consent screen; we never see your Intuit password. Access and refresh tokens are encrypted at rest. Pulse pulls customers, invoices, and products/items from your QuickBooks company file into your tenant on a scheduled basis. Disconnecting from Settings invalidates the stored tokens and stops all further access.
Voyage AI	Search by meaning (semantic search)	Text of business-linked messages is converted into search vectors so you can find conversations by meaning. Personal or ignored chats are never sent. Processed on our behalf, not used to train models.
Groq / OpenAI (speech-to-text)	Voice note transcription	Audio of WhatsApp voice notes that belong to a business conversation is sent to a speech-to-text provider to turn it into text. Voice notes in personal or unmatched chats are never downloaded or sent.
Google Fonts	Web font delivery	Standard HTTP request data (IP address, browser info) when loading the Inter font family
Railway	Application hosting	All application data is hosted on Railway's infrastructure in the United States. Railway provides the PostgreSQL database and compute environment.
Vercel	Marketing website hosting	Standard request data (IP address, browser info) when you visit aisalespulse.com, and the details you submit in the early-access form, which are emailed to us through Resend.

AI is included with Pulse and is active by default, so that insights and drafts work from day one; it runs on our Anthropic account and requires no key from you. All other integrations (email, WhatsApp, ERP, and QuickBooks Online) are disabled by default and only activated when you explicitly connect them in Settings > Integrations. You can disconnect any integration at any time.

3.1 Google User Data (Gmail)

If you choose to connect your Gmail account, Pulse asks Google for one permission only: read-only access to your email (the gmail.readonly scope). Pulse cannot send, delete, or change anything in your mailbox.

• What we access: the messages in your Gmail account (sender, recipients, subject, date, and message text), received from 30 days before you connect onward. We skip drafts, spam, trash, and chats.
• How we use it: only to provide features you see in Pulse: showing your customer emails on your customer and prospect pages, matching emails to your customers, creating your own follow-up cards, summaries, and draft replies, and letting you search your conversations. Gmail data is used only for the user who connected it and that user's company workspace in Pulse, never for other customers of Pulse.
• Who processes it: to provide these features, the text of your emails is processed by our service providers Anthropic (Claude AI, for cards, summaries, and drafts) and Voyage AI (for search by meaning). They process it only on our behalf to deliver your features and do not use it to train AI models. We do not share Gmail data with anyone else, except where needed for security or required by law.
• What we never do: we do not sell Gmail data, use it for advertising, give it to data brokers, or use it to develop, improve, or train generalized or non-personalized AI or machine-learning models.
• Human access: no person at AI Sales Pulse reads your Gmail data unless you give us permission for specific messages (for example, when you ask for support), it is necessary for security purposes such as investigating abuse, or it is required by law.
• Storage and security: Gmail data is stored in our database in the United States with the same protections as all other data (see Data Security). Your Google tokens are encrypted at rest.
• Your control: in Settings > Integrations you can disconnect Gmail at any time, which also revokes Pulse's access at Google, or choose Delete my Gmail data from Pulse, which permanently removes every email Pulse stored from your Gmail. You can also remove Pulse's access from your Google Account settings.

Pulse's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Data Security

We implement the following security measures to protect your data:

Encryption

• In Transit: All data transmitted between your browser and our servers is encrypted via TLS/HTTPS. We enforce HSTS (HTTP Strict Transport Security) with a one-year maximum age.
• At Rest: Integration API keys and OAuth tokens are encrypted using AES symmetric encryption (Fernet) before database storage.
• Passwords: Stored as irreversible bcrypt hashes (12 rounds). We never store or have access to your plaintext password.

Authentication & Access Control

• Two-Factor Authentication (2FA): Optional email-based one-time codes with backup recovery codes (bcrypt-hashed).
• Session Management: 60-minute inactivity timeout and an 8-hour absolute session limit; if you choose "Remember me" (and in the mobile apps), you stay signed in for up to 30 days. Sessions can be viewed and revoked from the Security settings page.
• Brute Force Protection: Account lockout after 5 failed login attempts (15-minute cooldown). API rate limiting on all authentication endpoints.
• Role-Based Access: Distinct role tiers (sales rep, admin, and CEO, the account creator's highest-privilege role) with strict permission boundaries. Sales reps see only the customers assigned to them.

Security Headers

• Strict-Transport-Security (HSTS)
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY (prevents clickjacking)
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy: camera, microphone, and geolocation disabled

Infrastructure

• Hosted on Railway's managed infrastructure
• Data is stored in the United States. If you use Pulse from outside the U.S., your data is transferred to and processed in the U.S.
• PostgreSQL database with parameterized queries (SQL injection prevention)
• CORS restricted to authorized origins only
• Comprehensive audit logging of all security events

5. Multi-Tenant Data Isolation

Pulse is a multi-tenant platform. Each company's data is strictly isolated:

• Every business data table is scoped by a company_id identifier.
• All database queries filter by the authenticated user's company, ensuring you can never access another company's customers, products, messages, or pipeline data.
• Admin users can only manage users and data within their own company.
• Foreign key constraints and database-level indexes enforce isolation at the schema level.

6. Data Retention

Data Type	Retention Period
Account & profile data	Until you delete your account
Business data (customers, products, messages)	Until you delete your account or individual records
Session data	Automatically expired after 8 hours (60 min inactivity), or up to 30 days with "Remember me"
2FA verification codes	Automatically deleted after 5 minutes
Password reset tokens	Automatically expired after 1 hour
Failed login attempts	Cleared after 15 minutes or on successful login
Audit log	Retained for compliance; available in your data export
Integration credentials	Until you disconnect the integration
Closed accounts	Scheduled for deletion within 30 days of account closure, unless you ask for an export first or the law requires us to keep it
Backups	Kept for a limited period for disaster recovery, then overwritten in the normal backup cycle. Deleted data disappears from backups as they expire.

7. Your Rights

Regardless of where you are located, you have the following rights regarding your personal data:

GDPR Rights (EU/EEA/UK)

• Right of Access: View all data we hold about you via your account settings.
• Right to Portability (Article 20): Export all your personal and business data as a JSON file via Settings > Privacy > Export My Data. The export includes your profile, audit log, sessions, customers, messages, and follow-ups.
• Right to Rectification: Update your personal information at any time through your profile settings.
• Right to Erasure: Request deletion of your account and all associated data by contacting us.
• Right to Restrict Processing: Use Privacy Settings to control which communication channels are tracked and how AI processes your data.
• Right to Object: Opt out of daily digest emails and AI features at any time.

CCPA Rights (California)

• Right to Know: This policy describes all categories of personal information we collect and how they are used.
• Right to Delete: Contact us to request deletion of your personal information.
• Right to Non-Discrimination: We will not treat you differently for exercising your privacy rights.
• No Sale of Personal Information: We do not sell, rent, or share personal information for cross-context behavioral advertising.

To exercise any of these rights, email us at support@aisalespulse.com.

8. Cookies & Tracking

Pulse uses minimal cookies:

• Authentication Token: A JSON Web Token (JWT) stored in your browser's local storage to keep you signed in. This is essential for the Service to function.
• Session Identifier: Used to manage your active session and enforce timeout policies.

We do not use:

• Third-party analytics or tracking cookies
• Advertising cookies or pixels
• Cross-site tracking of any kind

9. Children's Privacy

Pulse is a business-to-business (B2B) application designed for sales professionals. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a platform announcement within the Service. The "Last Updated" date at the top of this page indicates when it was last revised.

11. Contact Us

If you have any questions about this Privacy Policy or your data, please contact us:

• Email: support@aisalespulse.com
• Company: Sales Pulse AI, LLC (doing business as AI Sales Pulse)
• Address: 300 Oakwood Lane, Hollywood, FL 33020, United States
• Phone: +1 (954) 807-9824
• Website: aisalespulse.com