Privacy Policy
Last Updated: 09-Feb-2026
ProductPulse ("we," "us," or "our") provides an AI-driven platform to help organizations synthesize customer feedback into actionable product requirements. This Privacy Policy describes how we handle information in our capacity as a data processor.
1. Data Collection and Integration
We process data provided by our Customers through two primary channels:
Native integrations: Automated synchronization of support tickets, call transcripts and emails from platforms like HubSpot.
Manual uploads: Processing of business documents (PDF, Word, Excel, CSV, TXT) uploaded directly by authorized users.
2. The ProductPulse Sanitization Pipeline
To protect privacy, all incoming data undergoes a rigorous multi-stage sanitization process before permanent storage:
Automated Scrubbing: Our system uses advanced pattern matching to detect and remove common Personally Identifiable Information (PII), such as email addresses, phone numbers, and financial identifiers, from the raw text.
AI Synthesis: Following the initial scrub, we use industry-leading AI models (OpenAI GPT-series) to extract the "canonical need"—a professional, anonymized summary of the core feedback.
Minimized Storage: We do not store the raw, unredacted transcripts. Our database only retains the anonymized summaries and structured metadata required to provide the service.
3. Purpose of Processing
We use the processed data for the following internal business purposes of the Customer:
Requirement Identification: Using vector embeddings to group similar feedback and identify recurring product needs.
Business Impact Analysis: Correlating feedback with high-level business metrics (such as lifecycle stage or deal size) to assist in prioritization.
Usage Tracking: Monitoring the volume of items processed to ensure compliance with the Customer’s selected subscription plan.
4. Security Architecture and Data Isolation
ProductPulse implements rigorous technical and organizational measures to safeguard Customer Data:
Multi-Tenant Isolation: We utilize Row Level Security (RLS) to maintain strict logical separation between organizational datasets. This architecture ensures that data access is restricted solely to the authenticated tenant.
Cryptographic Standards: All sensitive configuration data is encrypted at rest using AES-256-GCM. Data in transit is protected via TLS 1.2 or higher.
Identity and Access Management (IAM): Our platform employs a granular, role-based access control (RBAC) framework, ensuring data visibility is limited to authorized personnel as defined by the Customer’s internal hierarchy.
5. Third-Party Sub-Processors
We partner with a limited number of vetted technology providers to deliver our service. Each sub-processor is evaluated for security compliance and is bound by data processing obligations consistent with this policy:
Cloud Infrastructure (Supabase/AWS): Used for secure database hosting, encrypted storage, and authentication. Data is logically isolated via Row Level Security (RLS).
Artificial Intelligence (OpenAI API): Used for extraction, synthesis, and embedding generation. Important: We utilize OpenAI’s enterprise API platform; per their standard terms, data processed via the API is not used to train OpenAI’s models or improve their services.
Communications (Resend): Used strictly for transactional system notifications, such as organization invites and security alerts.
6. Data Retention and Deletion
We retain synthesized requirements and anonymized summaries for the duration of the Customer’s active subscription. Upon termination of the service, all organization data is deleted in accordance with our Data Processing Agreement (DPA).
7. Contact and Compliance
As a B2B provider, we support our Customers in fulfilling their obligations under global data protection laws (such as GDPR). For inquiries regarding data access or deletion, please contact your organization's ProductPulse administrator or our support team.