Controller and processor roles
PulsePigeon is owned and operated by Blitz Global LLC (“PulsePigeon”, “we”, “us”).
PulsePigeon plays two distinct roles, and it is important to keep them separate:
- As a controller for the personal data of our own account holders (your name, contact details, billing information, and how you use the platform). This policy describes that processing.
- As a processor for the personal data contained in the mail you send (recipient addresses and message content). We process that data on your instructions under the Data Processing Addendum; you are the controller of it.
Data we collect
Account and billing data
Name, email, organization, authentication identifiers, and billing details. Payment card data is handled by our payment processor; we do not store full card numbers.
Business country. We ask the owner of each workspace to confirm the country where the business is based. We store the confirmed country code, the time, and the user who confirmed it. We use it to apply regional data-handling rules to the workspace, and where the law depends on where a business is based. We pre-fill the field from the country our edge network infers from your IP address when you visit; we do not store the IP address for this purpose.
Usage and log data
API requests, console activity, sending metadata (timestamps, message identifiers, delivery events, bounce and complaint signals), IP addresses, and device and browser information used to secure and operate the service.
Recipient data (as processor)
Recipient email addresses and the content of messages you send, processed only to deliver your mail and provide delivery reporting, suppression, and abuse controls.
How we use data
We use personal data to:
- provide, operate, secure, and improve the service;
- deliver your mail and report on delivery, bounces, and complaints;
- detect, prevent, and investigate abuse, fraud, and security incidents, and enforce our Acceptable Use Policy;
- process billing and manage your account;
- communicate service, security, and account notices; and
- meet legal and regulatory obligations.
We do not sell personal data, and we do not use the recipient data you send for our own marketing.
Legal bases (GDPR)
Where the GDPR applies, we process account data on the bases of contract (to provide the service), legitimate interests (to secure and improve it, and to prevent abuse), and legal obligation. Recipient data is processed on your instructions as controller. See our GDPR page for more.
Data retention
We retain account data for the life of your account and as needed afterward for legal, tax, and dispute-resolution purposes.
Audit and security records, which log actions on your account, are kept for 2 years.
Message content and recipient metadata are retained for a limited operational window and then removed, subject to your plan’s log-retention setting. Suppression data (addresses that bounced, complained, or unsubscribed) may be retained indefinitely to prevent unlawful or unwanted re-sending.
Contact archive and erasure
Customers are the controller of their contacts and PulsePigeon is the processor. The customer chooses a retention window of 1 to 24 months for archived contacts, including churned contacts who have not requested erasure. The window begins when the contact is archived; former status alone does not start it. At the end of that window, contacts become eligible for automatic deletion. Automatic lifecycle deletion is disabled by default; until enabled, contacts remain archived. Active customers and legal holds defer deletion. Contacts who unsubscribe or opt out are not sent marketing or winback mail.
An eligible erasure request deletes the contact profile, events, consents, preferences, and list memberships. When a contact is erased, we keep only one-way fingerprints of the email address, never the address itself, so the erasure and any opt-out keep working. A fingerprint cannot be turned back into an address, but it can be matched against an address someone already has. If an erasure is deferred (for example because of a legal hold), the contact record is kept until the deferral ends. Suppression lists that customers keep for their own sending are stored as addresses and are deleted with the workspace. A small amount of operational data may remain, including queued or in-flight message records and delivery-protection suppression entries for bounced or complained-about addresses. Operational retention windows apply where configured. Billing and invoice records are kept for the legally required accounting period and are never used for marketing.
Delete requests for active customers may be deferred until their status changes or the controller explicitly proceeds. Legal holds suspend deletion until released. Marketing remains suppressed while a delete request is pending. Storage errors leave the request unfulfilled for repair and retry.
Security
We protect data with encryption in transit and at rest, tenant isolation, least-privilege access, secret management that keeps credentials server-side, and monitoring. See our Security page for details. No system is perfectly secure, and we cannot guarantee absolute security.
International transfers
We and our subprocessors may process data in countries other than yours. Where we transfer personal data internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, as described in the Data Processing Addendum.
Your rights
Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, and to object to certain processing. To exercise rights over your account data, contact [email protected].
To ask us to delete your account, see Account deletion.
For requests about recipient data we process on a customer’s behalf, we will refer the request to that customer as the controller and support them in responding.
Connecting an AI assistant or agent
You can choose to connect an AI assistant or agent to your PulsePigeon workspace by giving it a project API key for use with an agent that supports the Model Context Protocol (MCP). A key or connection is limited to one project and to the permissions it was given, and cannot read other projects or workspaces. The one exception is the optional domain list and template list permissions of a sign-in connection: they are off unless you tick them, and they show the names and status of your workspace's sending domains and templates across all projects. It can send mail only if it was given send permission.
What the assistant receives
Results returned to the agent can contain information about that project: whether it is ready to send, its message streams, and delivery status and diagnostics for individual messages. Mail the agent sends is sent from your account with the recipients and content the agent supplies, and goes through the same tenant, vetting and compliance checks as other sends. Anything the agent reads or composes through the connection, including recipient email addresses and message content, is visible to the assistant and its provider.
Processing by the AI provider
The assistant and the company that runs it (for example Anthropic or OpenAI) are not part of PulsePigeon. We do not send workspace data to an AI provider on our own: data leaves PulsePigeon for the provider only when your connected agent asks for it. The provider processes what it receives under its own terms and privacy policy, which govern how it is used, stored and retained. Recipient data you let an agent read is data you choose to disclose as its controller.
What we record
We record each request a connected agent makes, for security and support: the time, the tool called and its outcome (with an error code if it failed), your workspace and project, the type of credential used and a pseudonymous hash of its identifier, a request identifier, whether the request came from a browser or a server, how long it took, counts of items or recipients, and identifiers of related messages or approval actions. The record does not contain the content returned to the agent or the content of mail it composed.
Disconnecting
You can disconnect an agent at any time from Connected apps in your workspace settings, which lists project API keys and any OAuth connections and lets you revoke each one. A revoked key or connection stops working on its next request. Revoking stops future access. It does not delete what the provider already received, which you can manage with that provider, and it does not recall mail that has already left the workspace.
Changes and contact
We may update this policy; material changes will be posted here with a new effective date. Questions can be sent to [email protected].