Privacy Policy

01Scope & local-first approach

This Privacy Policy describes how Pulsatrix Technologies Inc. (“Pulsatrix”, “we”, “us”) collects, uses, discloses, stores, and protects personal information in connection with Pulsatrix — including this website (pulsatrix.ca and related staging/marketing origins), licensing and activation, customer accounts, the community board, tester applications, and related support.

Pulsatrix is built local-first: the MCP host and plugins run on infrastructure you control. Your operational data (tickets, companies, configs, time entries, RMM inventory, and similar ConnectWise or vendor data) is processed in your environment under your configuration. That operational content is not sent to Pulsatrix as part of normal product operation.

This policy is designed to meet transparency obligations under Québec’s Act respecting the protection of personal information in the private sector as amended by Law 25, and to give clear notices for visitors and customers worldwide. Where a stricter local rule applies, we honour the higher standard for that person where reasonably required.

02Who is responsible

The organization responsible for personal information covered by this policy is Pulsatrix Technologies Inc., 3354 Bellefeuille Street, Trois-Rivières, Québec G9A 3Z3, Canada.

For product risk, warranties, and limitation of liability, see our Disclaimer & Terms of Use and Terms of Service. For privacy requests, use the Privacy Officer channel in §09.

03Personal information we collect

Depending on how you interact with Pulsatrix, we may collect:

• Identity & contact — name, work email, company / MSP name, role or title, phone if you provide it.
• Account & licensing — account identifiers, licence keys / entitlement metadata, product edition or SKU, seat or usage counters needed for quotas, anonymous or pseudonymous machine identifiers used for activation integrity, and related timestamps.
• Tester / beta applications — fields you submit on the application form (including company name, MSP size, motivation, and consent).
• Community board — display name, optional company label, posts and comments you publish, and session data for signed-in licensed users.
• Support & correspondence — messages you send to us (email or forms), and records needed to respond.
• Website technical data — necessary cookies, security logs (e.g. IP address for rate-limiting and abuse prevention), browser language, and basic request metadata.
• Draft, pending legal review

  Optional website analytics & advertising. With your consent, chosen per category in the cookie manager, this marketing website uses Google Analytics 4 (audience measurement) and Google Ads (ad measurement and remarketing, via the GA4-Ads link). Both stay off until you allow the relevant category. Choosing Advertising alone can still send Google Analytics measurement events, since the visitor identifier cookie that remarketing itself relies on is governed by the Analytics category, not the Advertising one. See §06 for the full disclosure.

• Product telemetry: a separate system from the website analytics above, and never Google. One opt-in switch covers both pseudonymous usage counts and consented crash reports (on by default in the current early-access phase, with a clear, immediate way to opt out); tool arguments and results are never transmitted, and the two travel separate, non-joinable data paths. At small enough numbers of installs, usage patterns can still indirectly point to who is behind them: not fully anonymous, and we say so rather than over-claim. Never your clients’ ticket content.
• Billing — payment and tax details are handled by our payment processor (Stripe). We receive limited billing status and identifiers needed to fulfil the commercial relationship, not full card numbers on our own systems.

We do not intentionally collect your end-customers’ personal information from ConnectWise or other vendor APIs into Pulsatrix systems as part of normal MCP operation. If you paste such data into a support email or public post, treat that as your disclosure.

04Purposes of collection

We use personal information to:

• Operate, secure, and improve the website and product surfaces
• Issue, activate, renew, and enforce licences and entitlements
• Review early-access / tester applications and communicate decisions
• Provide customer support and respond to privacy or legal requests
• Process payments and prevent fraud or abuse
• Send essential service messages (security, licence, material policy changes)
• Send optional product updates only where permitted (and with consent where required)
• Comply with law, enforce our terms, and defend legal claims
• Measure site performance with analytics only when you opt in

05Legal bases

Québec / Canada (Law 25 and applicable federal rules). We collect personal information for the serious and legitimate purposes listed above, limited to what is necessary. Where consent is required (e.g. non-essential cookies or optional marketing), we obtain it in clear language and allow withdrawal.

EEA / UK (GDPR / UK GDPR), where applicable. Depending on the activity: performance of a contract; legitimate interests (securing the service, preventing abuse, product improvement that does not override your rights); consent (optional analytics / certain cookies); and legal obligation.

United States. We process information as described here for the business purposes listed in §04. We do not “sell” or “share” personal information for cross-context behavioural advertising as those terms are commonly defined under state laws such as the CCPA/CPRA. See §14 for California-specific rights language.

06Cookies & similar technologies

We use cookies and similar technologies. Essential cookies run by default so the site and sign-in flows work. Non-essential categories run only after you accept them in the consent banner. You can change choices anytime via manage cookie preferences.

Declining non-essential cookies does not prevent you from browsing the marketing site or applying to the beta.

07Consent

Where Law 25 or other law requires consent, we ask in clear, simple language, for specific purposes, and separately from other terms when required. You may withdraw consent at any time, subject to legal or contractual restrictions (for example, we may still keep records required for accounting or security).

Providing personal information through forms (register, contact, community) is voluntary, but some features cannot work without the minimum data needed to identify and contact you.

08Disclosure & service providers

We do not sell or rent personal information. We may disclose information to:

• Service providers (processors) who act on our instructions — for example cloud hosting, email delivery, payment processing (Stripe), error/ops tooling, and security services.
• Draft, pending legal review

  Google, only with your consent: Google Analytics 4 for audience measurement and Google Ads for ad measurement and remarketing, both on this marketing website only, never the product. See §06 for the full disclosure, including where this data is processed and how to change your choice at any time.

• Professional advisers (legal, accounting) under confidentiality duties.
• Authorities when required by law, court order, or to protect rights, safety, and security.
• Business transfers — if we reorganise or transfer assets, information may move under appropriate safeguards and notice where required.

AI model providers. If you configure Pulsatrix to call a cloud LLM (Anthropic, OpenAI, Google, xAI, etc.), prompts and context you send follow your contract and settings with that provider. That path is under your control, not a Pulsatrix secondary PSA database.

09Privacy Officer

For any questions or requests regarding your personal information, please contact our privacy officer:

Under Law 25, the person in charge of the protection of personal information (privacy officer) is accountable for overseeing compliance. Contact details are published on this website as required. We aim to acknowledge requests promptly and respond within applicable legal timeframes.

10Where data lives & international transfers

Operational product data remains on systems you choose (your hosts, your vendors, your models).

Website, licensing, billing, and support data may be processed in Canada and in other countries where we or our processors operate (including the United States and, depending on vendor footprint, the EEA or other regions). When personal information is transferred outside Québec or outside your country of residence, we use appropriate contractual and organizational measures (such as processor agreements and, where required for EEA/UK transfers, standard contractual clauses or equivalent mechanisms).

Law 25 may require privacy impact assessments before certain disclosures outside Québec. We apply that discipline to material processing changes involving personal information.

11Retention

We keep personal information only as long as necessary for the purposes described, or as required by law (for example tax and accounting records), to resolve disputes, or to enforce agreements. When no longer needed, we delete or anonymize it according to our retention practices.

Licence and security logs may be kept for a limited period to prevent fraud and ensure entitlement integrity. Community content you publish may remain until you delete it or request erasure, subject to backup cycles and legal holds.

12Security

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the information — including access controls, encryption in transit for public web services, least-privilege practices, and monitoring for abuse. No method of transmission or storage is perfectly secure; we work to reduce risk continuously.

You are responsible for securing your own MCP host, credentials, vendor API keys, model API keys, and approval policies on systems you control.

13Your rights

Subject to legal limits, you may have the right to:

• Access personal information we hold about you
• Correct inaccurate or incomplete information
• Delete / de-index information in certain cases
• Withdraw consent where processing is consent-based
• Data portability where applicable (e.g. GDPR)
• Object or restrict certain processing (GDPR)
• Appeal or complain to a supervisory authority

To exercise rights, email privacy@pulsatrix.ca. We may need to verify your identity. If you are in Québec and remain unsatisfied, you may contact the Commission d’accès à l’information du Québec (CAI). EEA residents may contact their local data protection authority; UK residents the ICO.

14Regional notices

Pulsatrix is offered from Canada with a global customer base. The following summaries help you locate rights that may apply. They do not replace the full text of local law.

If local mandatory rules conflict with this policy, those rules prevail for the individuals they protect to the extent required.

15Children

Pulsatrix is a B2B product for professional MSP use. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact privacy@pulsatrix.ca and we will take appropriate steps.

16Confidentiality incidents

We maintain processes to assess and handle confidentiality incidents involving personal information. Where Law 25 or other law requires, we record incidents, notify the Commission d’accès à l’information and affected persons when there is a risk of serious injury, and take remedial steps. Other jurisdictions may impose their own breach-notification duties; we follow applicable requirements.

17Governance & privacy by design

Law 25 requires governance policies and practices proportionate to our activities — including roles across the information lifecycle, retention and destruction, and a complaint process. Product design favours data minimization and local-first processing so operational client data need not leave your environment for core MCP use.

Privacy impact assessments (PIAs) are used when required before high-risk projects, including certain technology deployments or transfers of personal information outside Québec.

18Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top applies. Material changes will be highlighted on this page and, where appropriate, communicated through the site or email.

Related documents: Terms of Service, Disclaimer & Terms of Use, Refund policy.