Privacy Policy
Last updated: August 24, 2026
This policy explains what PulsePush collects when a shopper interacts with a store that uses our app, and what store owners ("merchants") can expect from us. We wrote it in plain language on purpose.
Who is who
- Shoppers are people who browse a store's funnels and may allow notifications.
- Merchants are store owners who install PulsePush on their Lightfunnels store.
- We ("PulsePush") provide the app that connects the two.
What we collect
- Notification permission: a browser-generated push endpoint (a technical address needed to deliver notifications to that browser). It contains no personal identity by itself.
- Contact details a shopper types at checkout: email, phone number, and first name — collected only if the shopper enters them, and used only so the store can send order-related messages.
- Order context from Lightfunnels: order total and basic customer details included in order events, used for messages like "your order is confirmed".
- Basic usage events: funnel visits and prompt interactions, used to attribute subscribers to the right store and funnel.
What we never do
- We never sell shopper data. To anyone. Ever.
- We never use one store's shoppers to message shoppers of another store.
- We never email or call shoppers — PulsePush only delivers the store's own web push notifications.
Where data lives
All data is stored in a Supabase (PostgreSQL) database hosted in the European Union. The app reaches it only from our servers with a server-side key — never from the browser — and every query is scoped to the store that owns the session.
Security
Traffic is encrypted in transit with TLS. The database, and the backups our database provider takes, are encrypted at rest. Store access tokens are encrypted before they are written, with the key held only in our server environment. Customer data is never written to application logs.
Access to customer data is limited to the account owner, who uses a unique password and two-factor authentication on every provider account. We do not use personal data for automated decision-making and we do not sell it. A suspected security incident is triaged within 24 hours, affected merchants are notified within 72 hours, and we keep a record of the incident and the fix.
Roles & responsibilities
The merchant decides what messages to send and to whom — for shopper data, the merchant is the data controller and we act as processor. Shoppers can unsubscribe from notifications at any time using their browser's notification settings, which permanently disables delivery to that browser.
Deletion
A shopper's contact details are kept only while the subscription is active for that store. When a store disconnects or uninstalls PulsePush, collection stops immediately and the store's subscriber data is deleted no later than 30 days afterwards. Merchants may also request earlier deletion at any time via the contact below.
Contact
Questions, deletion requests, or anything else: email us at support@dotchater.com or reach us through the app inside your Lightfunnels admin.