Privacy Policy — Pulsyr Cloud

Last updated: 10 August 2026

Draft — not yet in force. Pulsyr Cloud is not open for signup, so we are not processing anyone's data under this policy today. It describes what the software actually does, verified against the source, and will be finalised with Chilean counsel before the service opens. Questions: legal@pulsyr.dev

This policy covers Pulsyr Cloud, the hosted service. If you run the open-source software yourself, we receive nothing and this policy does not apply.

1. Data controller

Avonlea Systems SpA · RUT 77.890.325-3 · Hamburgo 550, Ñuñoa, Santiago, Chile Contact for privacy matters and for exercising your rights: legal@pulsyr.dev

2. What we collect

Account data. Name, email address, a bcrypt hash of your password (never the password), your account role, and the projects you have access to. API and MCP tokens are stored as SHA-256 hashes — we cannot recover a token, only replace it.

Your content. Everything you or your agent puts into the service: backlog items, summaries, comments, decisions, dependency graphs, threads and their artifacts, management documents and their file contents, pendings, plan tasks. Uploaded deliverables are stored as binary content in our database.

Incident data. If you connect Sentry, the error data Sentry sends us: issue title, level, counts, timestamps, project slug, and links. Titles and payloads are sanitised of HTML before storage.

Audit records. Every change writes an event with the actor, the action, and a payload. This is a core product feature, not analytics.

Operational data. Server logs (IP address, timestamp, request path, user agent) kept for security and debugging.

We do not run analytics, advertising, or tracking of any kind. There is no Google Analytics, no pixels, no session recording, no behavioural profiling.

3. Cookies

One cookie: pulsyr_session, which keeps you signed in. It is essential to the service, carries no tracking identifier, and needs no consent banner. Signing out clears it. We set no other cookies.

4. Third-party requests from your browser

The application currently loads four resources from third-party CDNs. Loading them transmits your IP address and user agent to those providers:

We are removing these. Self-hosting the font and compiling the CSS is on our roadmap specifically so that using Pulsyr Cloud sends nothing to a third party you did not choose. This section will be updated when that ships.

5. Subprocessors

We use these providers to run the service. Each receives only what its function requires.

AI providers do not train on your content. Anthropic and Google do not use API-submitted data to train their models under their commercial terms.

AI is optional. With no AI keys configured, the service degrades gracefully: items simply carry no AI estimate and incidents stay untriaged. If you supply your own AI provider key, your content goes to that provider under your own agreement with them.

We will give notice before adding a subprocessor that processes your content.

6. Why we process it, and on what basis

We do not sell personal data. We do not share it for advertising. Ever.

7. International transfers

We are established in Chile and your content is stored in Chile — Oracle Cloud's sa-santiago-1 region. It does not leave the country as part of normal operation.

Two things do cross a border, and only when they apply to you: fragments of your content go to our AI subprocessors in the United States when AI features are enabled, and your billing data goes to our payment processor in the United Kingdom and the EU when you subscribe. Both transfers rely on those providers' standard contractual clauses and equivalent safeguards. Turning AI off keeps your content in Chile entirely.

8. Retention

9. Your rights

Under Chile's Law 21.719 on personal data protection and, where it applies, the GDPR, you may request: access to your data, correction, deletion, portability in a machine-readable format, restriction of processing, and objection to processing based on legitimate interest.

Write to legal@pulsyr.dev. We respond within 30 days. We will not charge you for a reasonable request and we will not make you justify it.

Much of this you can do yourself and immediately: export via the API or MCP tools, correct anything through the interface, and delete your account whenever you like.

If you believe we have mishandled your data you may complain to Chile's Agencia de Protección de Datos Personales, or to your local supervisory authority in the EU.

10. Security

Passwords are hashed with bcrypt. API and MCP tokens are stored as SHA-256 hashes. Session cookies are signed, and marked secure outside development. Inbound webhooks are verified by HMAC signature. Every MCP token is scoped to exactly one project, enforced server-side, so an agent cannot reach a project it was not given. Cross-account access is blocked at a single chokepoint in the code rather than per-endpoint.

No system is perfectly secure. If we suffer a breach affecting your personal data, we will notify you and the relevant authority without undue delay.

11. Children

The service is not for anyone under 18 and we do not knowingly collect their data.

12. Changes

We will post material changes here and email account holders at least 30 days before they take effect.

Avonlea Systems SpA · RUT 77.890.325-3 · Hamburgo 550, Ñuñoa, Santiago, Chile · legal@pulsyr.dev