Privacy Policy

Last updated October 31, 2026

This Privacy Policy explains how Simplisik LLC (“Simplisik”, “we”, “us”) handles personal information through Pulseback: the dashboard and API at app.pulseback.io, the check engine, on-call paging and notifications, hosted status pages (on status.pulseback.io and on customers’ own domains), the Pulseback mobile app, and this website (together, the “Services”). It covers Pulseback only; Simplisik’s other products have their own privacy policies. It is effective as of October 31, 2026.

The short version

We collect what we need to check your services, page the people you choose and publish your status pages.

Workspace data (monitors, incidents, schedules, status pages) belongs to the customer that owns the workspace; we process it on its behalf.

On plans with AI features, incident data is sent to Anthropic through Cloudflare AI Gateway to draft summaries and postmortems. Nobody uses it to train AI models.

Card details go straight to Stripe. We never see them.

We don’t sell personal information, use it for advertising, or put analytics or advertising cookies on this website.

1. Who we are and our role

Pulseback is a product of Simplisik LLC, a Tennessee limited liability company based in the Nashville area. Our contact details are in section 15.

Where we decide: for your account, billing, support, the security of the Services and this website, we decide how information is used. For people in the EEA, the UK and Switzerland, we are the “controller” of that information.
Where our customers decide: for the content of a workspace (its monitors and their results, incidents, alerts, notes, on-call schedules, escalation policies, integrations, deploys it sends us, status pages and their subscribers), we act on behalf of the company that owns the workspace. That company is the controller (or “business”), we are its processor (or “service provider”), and its own privacy policy governs how it uses the information. Our Data Processing Addendum sets out those terms. If you are paged by, subscribed to, or mentioned in a workspace that isn’t yours, contact the company that runs it. We will help them respond.

2. Information we collect

Information you give us

Account: your name, email address, time zone and password. We store the password only as a salted PBKDF2 hash. When you sign up or reset your password we email you a single-use link and store only a hash of it, along with when your address was confirmed. If your organization uses single sign-on, we receive your name and email address from its identity provider.
Workspace: the workspace name, members and their roles, invitations (the invitee’s email address and role), environments, API keys (stored only as hashes, with when each was last used) and integrations. Secrets for integrations, such as Slack webhook URLs and webhook signing secrets, are stored encrypted.
Monitoring: the monitors you configure (names, URLs, hosts, request settings, keywords, headers and any credentials you put in them, which are part of the monitor’s configuration), and the results of every check: when and from which region it ran, the status, response time, status code and error.
On-call and incidents: schedules, rotations, overrides and swap requests, escalation policies, each person’s notification rules (for example “push at once, email after 5 minutes”), incidents and their timelines, notes, acknowledgements, alerts received through the Events API or by email (including the email’s sender, subject and up to 4,000 characters of its text), deploys and other changes your systems send us (service, title, commit message, SHA and author), and postmortems.
Mobile app: a push notification token, the device’s platform and name, and when it was last seen. The app keeps its sign-in token in the device’s secure storage.
Billing: plan and subscription status. You enter card details on Stripe’s pages and Stripe handles them; we store Stripe’s customer and subscription identifiers, not card numbers.
Support: what you send us by email or through the contact form on this website (your name, email address, company and message). Contact-form messages reach us by email; we don’t keep a separate copy on our servers.

Information collected automatically

Every request to the Services passes through our hosting provider, Cloudflare, which processes your IP address and browser and device details to deliver and protect the Services, and keeps short-lived operational logs of requests (see section 10). Some forms (sign-up, password reset, the contact form and status-page subscriptions) use Cloudflare Turnstile to tell people from bots, which processes signals from your browser for that purpose.
To limit repeated attempts to sign up, sign in, reset a password, send invitations, subscribe to a status page or send messages through our contact form, we store your IP address (and, for password resets, the email address entered) with a counter for up to a day.
We record when sessions were created and last used, and the device name for mobile sign-ins, so we can keep you signed in and expire old sessions.
Delivery records: which notifications were sent to whom, on which channel, to a masked destination (for example p•••@acme.dev), whether they were delivered, and who acknowledged an incident and how.

This website

pulseback.io uses no analytics, advertising or tracking tools, and sets no cookies. Its typefaces load from Google Fonts (see section 7). The “Talk to us” form sends what you enter to us by email.

3. Alerts, paging and notifications

Pulseback exists to reach people when something breaks. When an incident pages someone, we send notifications according to the workspace’s escalation policy and that person’s notification rules:

Push to the Pulseback mobile app, through Expo’s push service, which hands the notification to Apple Push Notification service or Firebase Cloud Messaging. A notification shows the incident’s severity, title and headline, the workspace and environment, and who resolved it.
Email, sent through Cloudflare. Alert emails carry a reply-to address; replying “ack” or “resolve” acts on the incident as you, and anything else is added to the timeline as a note from you. We accept a reply only from the address we paged.
Slack and webhooks that a workspace admin connects. These are the workspace’s own services: we send incident updates there as the admin directs, and their terms and privacy policies apply.
Text messages and phone calls are not offered at launch. If we add them, we will update this policy and our subprocessor list before any phone number is used.

Workspace admins decide whom to page. If you were added to a workspace’s on-call schedule, the company that runs it is responsible for having your permission, and you can change your own notification rules, remove your devices or leave the workspace at any time.

4. Status pages and subscribers

Status pages are public. They show what the workspace chooses to publish: component names, uptime history, incident and maintenance updates, and a logo and links.
Anyone can subscribe to a status page with an email address. We send a confirmation email first (double opt-in) and email updates only after you confirm. Every update has an unsubscribe link, which removes your subscription. The workspace that owns the page can see its subscribers’ email addresses.
A status page on a customer’s own domain (for example status.acme.dev) is served by Pulseback through Cloudflare. It loads its typefaces from Google Fonts and sets no cookies.

5. AI features

On the Starter, Team, Business and Enterprise plans, Pulseback drafts an incident’s “What we know” summary, ranks which recent deploy most likely caused it, and drafts postmortems, using AI models provided by Anthropic, PBC. Requests reach Anthropic through Cloudflare AI Gateway.

What we send: incident data only: the incident’s title, severity, status, environment, service, headline, description and times; its timeline and notes; the summaries of its alerts; the names, targets and latest regional results of the monitors involved; and the deploys and changes recorded in the 30 minutes before it started (title, message, commit SHA and author). Timeline entries and deploys can contain people’s names.
What we do not send: email addresses, phone numbers, push tokens, passwords or API keys, integration secrets, billing information, status-page subscribers, or data from other incidents and workspaces.
Training and retention: we do not use your data to train AI models, and Anthropic does not use data it receives through its commercial API to train its models. Anthropic deletes requests and replies within 30 days, except where it must keep them longer to enforce its usage policies or comply with the law. We have turned off request logging in AI Gateway, so Cloudflare does not keep the text sent or the reply.
You stay in control: AI output appears as a draft or suggestion in the incident and can be wrong. A workspace on a plan without AI features sends nothing.

6. How we use information

The table lists what we use information for and, for people in the EEA, the UK and Switzerland, the legal basis we rely on. Where we process information for a workspace, the workspace owner decides its legal basis.

Purpose	Information	Legal basis
Provide the Services: run checks, open and group incidents, page the people on call, publish status pages, run integrations	Account, workspace, monitoring, on-call and incident information; delivery records; devices	Performance of our contract with you; for people in a workspace’s data, on the workspace owner’s instructions
Draft incident summaries, likely causes and postmortems with AI	Incident data, as described in section 5	Performance of our contract with you; on the workspace owner’s instructions
Email status-page subscribers	Subscriber email addresses and confirmation status	Consent (double opt-in), on the workspace owner’s instructions
Take payments and manage subscriptions	Billing information	Performance of our contract; legal obligations (tax and accounting)
Send account and service emails (verification, password resets, invitations, swap requests) and answer support requests	Contact details, support messages	Performance of our contract; legitimate interests in helping you
Keep the Services secure and reliable, prevent abuse, enforce our Terms and fix problems	IP addresses, logs, session and API key records, usage information	Legitimate interests in running a secure, reliable service
Understand and improve how the Services are used, in aggregate	Usage information	Legitimate interests in improving Pulseback
Comply with law and respond to lawful requests	Any information, as needed	Legal obligations; legitimate interests in protecting our rights and users

We do not use automated decision-making that has legal or similarly significant effects on you.

What you have to give us. To create an account you must give us your name, email address and a password. To start a paid plan you must give Stripe a payment method and, where tax applies, a billing address. Everything else is optional.

The public: what a workspace publishes on its status pages.
Your workspace: members see its monitors, incidents, schedules, delivery records and subscribers according to their role.
Your systems: Slack, webhooks and other integrations a workspace admin connects receive incident updates. They are the workspace’s own providers, not ours.
The services you monitor: checks send requests to the URLs and hosts you configure, from our check regions, identified as Pulseback, with the headers and credentials you set.
Service providers that process information for us under contracts that limit how they use it:

Provider	What they do	Information involved
Cloudflare, Inc.	Hosting and compute (Workers, Durable Objects), database (D1), queues, request logs, security and bot protection (Turnstile), sending and receiving email, custom status-page domains, and routing AI requests (AI Gateway)	All information processed by the service, including IP addresses, email content and the incident data sent to AI features
Stripe, Inc.	Payments, subscriptions, invoices and tax calculation (Stripe Checkout and Customer Portal)	Billing contact email, workspace name, plan, billing address where tax applies, and payment details you give Stripe directly
650 Industries, Inc. (Expo)	Delivering push notifications to the Pulseback mobile app, through Apple Push Notification service and Firebase Cloud Messaging	Device push tokens and notification content (incident title, severity and headline, workspace and environment, and who resolved it)
Anthropic, PBC	AI incident summaries, likely-cause ranking and postmortem drafts, on plans that include AI features, through Cloudflare AI Gateway	Incident data only: title, severity, status, timeline, alert summaries, affected monitors and their results, and recent deploys (which can include names of responders and commit authors)
Google LLC (Google Fonts)	Typefaces for this website, the dashboard and hosted status pages, requested by the visitor’s browser	IP address and browser details of the device that loads the fonts

This is every service provider that processes personal information for the Services, including information we process for workspaces; the same list, with locations, is on our subprocessors page. We update it before a new provider starts processing personal information.

Legal and safety: when the law requires it, or when it is needed to protect people, the Services or our rights.
Business changes: as part of a merger, acquisition, financing or sale of assets, subject to this policy’s protections.
With your consent or at your direction.

We do not sell personal information, “share” it for cross-context behavioral advertising, or use it for targeted advertising, as those terms are defined in US state privacy laws, and we do not disclose it to third parties for their own direct marketing.

8. Cookies and local storage

Name	Where	Purpose	How long
`pb_session` (cookie)	Dashboard	Keeps you signed in (`HttpOnly`, `Secure`, `SameSite=Lax`)	30 days
`pulseback.workspace`, `pulseback.env.…` (local storage)	Dashboard	Remember the workspace and environment you last opened	Until browser storage is cleared
Sign-in token (secure storage)	Mobile app	Keeps the app signed in	180 days, or until you sign out

These are needed for the Services to work. This website and status pages set no cookies of their own. Cloudflare may set strictly necessary security cookies to protect the Services from bots and attacks. We do not use analytics, advertising or cross-site tracking cookies, so the Services work the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.

9. Where information is processed

Simplisik LLC is based in the United States. Our database is hosted in North America; checks run from the regions each monitor selects, and Cloudflare’s global network delivers the Services from locations near each visitor. Our other providers process information in the United States and may process it in other countries. If you use the Services from outside the United States, your information is transferred to, stored in and processed in the United States, where data protection laws may differ from those where you live. Where the law requires a transfer safeguard, we and our providers rely on recognized mechanisms such as the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or the European Commission’s Standard Contractual Clauses (which our DPA incorporates). You can ask us for a copy of the safeguards that apply by emailing privacy@pulseback.io.

10. How long we keep information

Information	How long we keep it
Account information	While your account is open. Deleting your account removes it right away, along with every workspace where you are the only member and everything in it. Other workspaces keep the incidents, notes and timeline entries you created in them.
Workspace information (monitors, incidents, schedules, status pages, integrations, delivery records)	Until you delete it or the workspace. Deleting a workspace deletes everything in it and cancels its subscription.
Raw check results	By plan: 7 days on Free, 30 days on Starter, 90 days on Team, 13 months on Business, 13 months on Enterprise
Hourly response-time rollups	90 days
Daily uptime history (status-page bars)	13 months
Status-page subscribers	Until they unsubscribe or the workspace removes them or the page
Sessions	30 days for the dashboard, 180 days for the mobile app, or until you sign out
Email verification, password-reset and invitation links	Until they expire (7 days to verify an address or accept an invitation, 1 hour to reset a password), then deleted
IP addresses (and email addresses entered to reset a password) used to limit repeated attempts	Up to one day
Operational request logs	Up to 7 days
Database backups (point-in-time recovery)	30 days
AI requests	Anthropic: up to 30 days, as described in section 5. Cloudflare AI Gateway: not logged.
Billing and tax records	As long as tax and accounting laws require, generally seven years. Stripe keeps its own records under its policy.

Deleted information can remain in backups and logs until they expire as described above. We may also keep information for longer where we need it to resolve disputes, prevent abuse or comply with the law.

11. Your rights and choices

In the dashboard and the app

Change your name, email address, time zone, password and notification rules.
Remove mobile devices, sign out, and delete your account.
Workspace admins can remove members, cancel invitations, revoke API keys, delete monitors, incidents, status pages and subscribers, and delete the workspace.
Status-page subscribers can unsubscribe with the link in every email.

By request

Email privacy@pulseback.io for anything you cannot do yourself, or to exercise any of these rights:

know what personal information we hold about you and get a copy, including in a portable format;
correct inaccurate information;
delete your information;
ask us to restrict how we use it;
withdraw consent where we rely on it;
opt out of the sale of personal information, targeted advertising and profiling, which we do not do.

These rights apply to everyone, wherever you live, although how they work depends on the law that applies to you. We will confirm your request by writing to the email address on your account, and may ask for more information if we cannot verify your identity that way. We respond within one month, or sooner where the law requires, and will tell you if we need longer. You can use an authorized agent, who must show us your signed permission. We will not discriminate against you for exercising your rights.

Your right to object. Where we use your information based on our legitimate interests (see section 6), you can object at any time by emailing privacy@pulseback.io. We will stop unless we have compelling legitimate grounds that override your interests, or we need the information to establish, exercise or defend legal claims.

Appeals. If we decline your request, you can appeal by replying to our decision with “Appeal” in the subject line. We will answer within 60 days. If you are not satisfied, you can contact your state attorney general.

EEA, UK and Switzerland. You can complain to us at privacy@pulseback.io, and we will acknowledge your complaint within 30 days. You can also complain to your local data protection authority; in the UK, that is the Information Commissioner’s Office (ico.org.uk).

People in a workspace’s data. If you are on someone else’s on-call schedule, subscribed to their status page or mentioned in their incidents, that company controls your information, so contact it first. If you contact us, we will pass your request to that company and help it respond.

12. Security

We encrypt traffic with TLS, hash passwords with PBKDF2 and a unique salt, store sessions, API keys and email links only as hashes, encrypt integration secrets with AES-256-GCM, rely on Cloudflare’s encryption of stored data at rest, sign outgoing webhooks, and limit access to workspace data by role. Changing your password signs out your other sessions. Our security page describes how the Services are built. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects personal information, we will notify the people affected and the authorities as the law requires. For information we hold for a workspace, we will notify the company that owns it so it can do the same.

13. Children

Pulseback is for businesses. You must be 18 or older to create an account, and the Services are not directed to children. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete it.

14. Changes to this policy

When our practices change we will update this page and its “Last updated” date. If a change is material, we will tell account holders by email or in the dashboard before it takes effect. You can ask us for an earlier version at privacy@pulseback.io.

15. Contact us

Questions, requests and appeals: privacy@pulseback.io, or by mail:

Simplisik LLC
Attn: Privacy (Pulseback)
5510 Old Hickory Blvd, Suite B #32
Hermitage, TN 37076
United States