Privacy, plainly stated.
This notice describes the account, billing, usage, source, and limited business-prospect information Origin Pulse handles.
Who is responsible. Matthew Bridges trading as Origin Pulse is the data controller, at 6 Warner Walk, Sudbury, CO10 1DJ. For privacy questions or rights requests, contact hello@originpulse.co.uk.
Information we handle
- Account information such as name, work email, company name, password hash, workspace membership, and role.
- Billing and invoice metadata supplied by Stripe. We do not store full payment-card numbers.
- Workspace configuration, API-key hashes and prefixes, usage events, delivery records, exports requested, and security/audit events.
- Public or licensed company information such as company name, registration number, incorporation date, registered location, source sector, observed date, and provenance. See Data sources.
- Technical information needed to secure the service, such as request IDs, browser or device details supplied to hosting logs, and hashed abuse signals.
Why we use it
We use this information to create and secure workspaces, authenticate users, provide tenant-scoped signals, process subscriptions and invoices, measure usage against plan limits, send transactional account messages, investigate abuse, support source corrections, and improve reliability. We do not sell customer account data.
Legal bases
Depending on the activity, we rely on performance of a contract, legitimate interests in operating and securing a business service, compliance with legal obligations, or consent where consent is required. Service emails are limited to account, security, billing, and delivery matters unless you separately opt in to marketing.
Business prospects
Before an account exists, we may use a limited set of business-prospect information to invite a small number of relevant corporate businesses to consider or test Origin Pulse. This may include the legal business name, company number and status, business website, sector and location, a public role-based business email address, and, where relevant, a contact's name, job title, and named work email address. We obtain company facts from the Companies House public register and contact details from the business's own public website. We record the source and collection date.
Our purpose is to identify relevant prospective business customers, make limited business-to-business contact, understand whether the service is useful to them, record their response, and respect their contact preferences. Where this involves personal information, our lawful basis is our legitimate interests in finding relevant business customers and validating the service through proportionate, low-volume outreach. We assess those interests against the person's rights before the outreach begins. This prospect activity is separate from account, security, billing, delivery, and other service messages.
When we obtained a person's information indirectly, our first communication identifies Origin Pulse, explains why we are contacting them, links to this notice, and gives a simple way to object. We provide this information no later than one month after collection and, if earlier, when we first contact the person. We share prospect information only with processors needed to host the service, keep the working outreach record, or send the email. We do not sell it or share it with other organisations for their own marketing.
We delete a non-responsive prospect's outreach record within 90 days of the first contact. If a person objects or opts out, we stop using their information for direct marketing. We keep only the contact point, affected channel, and date on a suppression list for as long as needed to prevent further marketing; we do not use suppression records to send marketing.
Sharing and processors
We share the minimum information needed with infrastructure and service providers such as hosting, managed Postgres, Stripe for billing, and the transactional email provider configured for the service. Providers process information under their applicable terms and security commitments. We may disclose information where required by law or to protect the service and its users.
Retention and deletion
Our operational policy retains signal records, source payloads, deliveries, usage events, and processed webhook payloads for up to 395 days; audit and operational review records for up to 730 days; and expired sessions and reset tokens only briefly after expiry. Account data is retained while the workspace is active. Issued invoices, immutable legal invoice facts, and independently archived invoice documents are retained for at least seven years from issue, or longer where a legal obligation, dispute, or legal hold requires it; they are deleted only when the applicable retention period and legal obligations have ended. Customer exports are generated in the browser and are not stored by the service.
Your rights
Subject to applicable law, you may ask for access, correction, deletion, restriction, portability, or information about processing. You may also object to processing based on legitimate interests. Your right to object to the use of your personal information for direct marketing is absolute: email hello@originpulse.co.uk and we will stop. You may complain to the Information Commissioner's Office. We may need to verify your identity and may retain limited information where law, security, or a suppression record requires it.
Source corrections
If a source record is inaccurate, withdrawn, or delivered in error, email the signal reference and the correction you are requesting. We will review the source evidence, record the outcome, and withdraw or rectify the customer-visible signal where appropriate.
Security and contact
Passwords are hashed, session cookies are protected, API keys are shown once and stored only as hashes, and workspace queries are tenant-scoped. No online service is risk-free; report suspected compromise immediately to hello@originpulse.co.uk.