Privacy, plainly stated.
This notice describes the account, billing, usage, and source information Origin Pulse handles to provide the service.
Who is responsible. Origin Pulse is operated by a sole trader. The data controller or contracting name and service or registered address are identified on your order confirmation or invoice. For privacy questions or rights requests, contact hello@originpulse.co.uk.
Information we handle
- Account information such as name, work email, company name, password hash, workspace membership, and role.
- Billing and invoice metadata supplied by Stripe. We do not store full payment-card numbers.
- Workspace configuration, API-key hashes and prefixes, usage events, delivery records, exports requested, and security/audit events.
- Public or licensed company information such as company name, registration number, incorporation date, registered location, source sector, observed date, and provenance. See Data sources.
- Technical information needed to secure the service, such as request IDs, browser or device details supplied to hosting logs, and hashed abuse signals.
Why we use it
We use this information to create and secure workspaces, authenticate users, provide tenant-scoped signals, process subscriptions and invoices, measure usage against plan limits, send transactional account messages, investigate abuse, support source corrections, and improve reliability. We do not sell customer account data.
Legal bases
Depending on the activity, we rely on performance of a contract, legitimate interests in operating and securing a business service, compliance with legal obligations, or consent where consent is required. Service emails are limited to account, security, billing, and delivery matters unless you separately opt in to marketing.
Sharing and processors
We share the minimum information needed with infrastructure and service providers such as hosting, managed Postgres, Stripe for billing, and the transactional email provider configured for the service. Providers process information under their applicable terms and security commitments. We may disclose information where required by law or to protect the service and its users.
Retention and deletion
Our operational policy retains signal records, source payloads, deliveries, usage events, and processed webhook payloads for up to 395 days; audit and operational review records for up to 730 days; and expired sessions and reset tokens only briefly after expiry. Account data is retained while the workspace is active and for as long as needed for billing, security, dispute, and legal records. Customer exports are generated in the browser and are not stored by the service.
Your rights
Subject to applicable law, you may ask for access, correction, deletion, restriction, portability, or information about processing. You may also object to processing based on legitimate interests and complain to your supervisory authority. We may need to verify your identity and may retain limited information where law or security requires it.
Source corrections
If a source record is inaccurate, withdrawn, or delivered in error, email the signal reference and the correction you are requesting. We will review the source evidence, record the outcome, and withdraw or rectify the customer-visible signal where appropriate.
Security and contact
Passwords are hashed, session cookies are protected, API keys are shown once and stored only as hashes, and workspace queries are tenant-scoped. No online service is risk-free; report suspected compromise immediately to hello@originpulse.co.uk.