PulseTracker

← back to app

Privacy Policy

Last updated: May 7, 2026

1. Who we are

PulseTracker ("PulseTracker", "we", "our", "us") is a server-side tracking and ad-attribution platform operated by Eletrolar. This policy explains how we handle personal data and advertising-platform data (Meta, Google, TikTok, and similar) accessed through PulseTracker.

Service domain: https://app.pulsetracker.io

2. Data we collect

2.1 Account data

  • Name, email, and authentication credentials.
  • Company, plan, and billing information.
  • Access logs, IP address, and user-agent for security purposes.

2.2 Advertising-platform data (via OAuth)

  • Identifiers for Business Managers, ad accounts, Pixels, datasets, and Conversions API tokens.
  • Campaign, ad set, and ad metrics; conversion events (impressions, clicks, spend, ROAS, EMQ).
  • Product-catalog metadata when authorized by the user.

We do not collect organic posts, private messages, contact lists, or any personal data of end users beyond what is strictly required for conversion attribution.

2.3 Customer site visitor data

  • Server-side events sent by the customer's site/app (PageView, Lead, Purchase, etc.).
  • Matching parameters (email, phone, IP, user-agent, fbclid, gclid) — always SHA-256 hashed before transmission to Meta CAPI as required by the platform.
  • UTM parameters and click identifiers for attribution.

3. How we use data

  • Operate server-side tracking and attribution services.
  • Forward conversion events to Meta Conversions API and equivalent endpoints.
  • Calculate ROAS, EMQ, funnel metrics, and reports for the customer.
  • Detect fraud, abuse, and misuse of the platform.
  • Comply with legal and tax obligations.

We do not sell personal data. We do not share data across customer accounts. We do not train AI models on customer data without explicit authorization.

4. Legal basis (GDPR/CCPA)

  • Contract performance: processing data necessary to deliver the contracted service.
  • Legitimate interest: security, fraud prevention, and product improvement.
  • Consent: OAuth integrations with Meta, Google, and TikTok require explicit user consent at the time of connection.
  • Legal obligation: retention of tax records and compliance with court orders.

California residents have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information.

5. Sharing

We share data strictly with:

  • Advertising platforms: Meta, Google, TikTok, Microsoft — only the events and parameters that the customer configures for transmission.
  • Infrastructure providers: Cloudflare (Workers/R2/D1), Supabase (Postgres/Auth), and Vercel — under data-processing agreements.
  • Payment processors: for subscription billing.
  • Authorities: when required by law, court order, or to protect rights.

6. Retention

  • Account data: while the account is active + 90 days after cancellation.
  • Conversion events and CAPI logs: 180 days.
  • OAuth tokens: revoked immediately upon disconnection of the integration.
  • Audit logs: 12 months.
  • Tax data: 5 years (legal obligation).

7. Security

TLS 1.2+ in transit, AES-256 at rest. OAuth tokens stored encrypted. Access restricted by least-privilege principle. Continuous log auditing and periodic permission review. Incident notification within 72 hours where required by applicable law.

8. Your rights

You may, at any time:

  • Access, correct, or port your data.
  • Request deletion of personal data.
  • Withdraw consent for integrations.
  • File a complaint with your local data protection authority.

To exercise any right, contact the operator of this PulseTracker instance. We respond within 30 days.

9. Meta Platform — data use

When you connect your Meta account to PulseTracker, we request the following permissions: ads_management, ads_read, business_management, catalog_management, and pages_show_list. These permissions are used solely to:

  • List available Business Managers, ad accounts, Pixels, and datasets.
  • Send server-side conversion events via the Conversions API.
  • Read campaign metrics for ROAS and EMQ reports.

PulseTracker complies with the Meta Platform Terms and the Meta Business Tools Terms.

10. Cookies

We use essential cookies (session, authentication, CSRF) and analytics cookies (platform usage). We do not use third-party advertising cookies in the dashboard.

11. Children

The service is not directed to individuals under 18. We do not knowingly collect data from minors.

12. Changes to this policy

Material changes will be announced by email and/or in-product notification at least 30 days before they take effect.

13. Contact

For privacy questions, log into your PulseTracker dashboard at https://app.pulsetracker.io and use the in-app support channel.