PulseBoard Privacy Notice

1. Who we are

PulseBoard is operated by ThinkScaler (NeoThink Scaler Technologies Pvt. Ltd.) ("ThinkScaler", "we", "us"). We decide why and how your account, sign-in, billing, security and support data is processed, so for that data we are the Data Fiduciary.

Your workspace is run by a company (the workspace Owner). The company decides what business content goes into its workspace - tasks, chats, notes and the member details it enters about you - so for that content the company is the Data Fiduciary and PulseBoard acts on its behalf as its processor.

2. The personal data we process

• Account: your name, email address, profile photo, and how you sign in (Google or email and password). Passwords are handled by Firebase Authentication; we never see or store them in readable form.
• Workspace profile: your role, job designation, reporting manager, username, active/removed status, online status and last-seen time.
• Optional details you (or your workspace administrator) add: phone number, employee ID, date of birth, gender, nationality, address and blood group. All are optional.
• Check-ins: only when you tap Check in, we record your approximate location (coordinates, a place name and the time) and share it as a card with your manager. We do not track your location in the background.
• Content you create: tasks, comments, chat messages, files, images, voice messages and notes.
• Device and notifications: a push-notification token for each device you use, and your app version and notification settings.
• Crash reports: only if you tap Send crash report - your user ID, workspace ID, device model, Android version and the technical error trace.
• AI assistant: the messages you send to the assistant and its replies, only if your workspace Owner has turned the assistant on.
• Billing: your workspace's plan and payment status and payment reference IDs. Card and bank details are handled by Razorpay or Google Play - we never receive them.
• Support and grievances: what you tell us when you contact us or raise a grievance.
• Consent records: which notice version you accepted and each consent choice you make, with the date and channel.
• Technical logs: our hosting provider's infrastructure logs (for example IP address and request time), used for security.

3. Why we use it (the specific purposes)

We use your personal data only for these purposes, and for nothing else without asking you first.

• To provide PulseBoard - creating your account, signing you in, showing your workspace, delivering tasks, chats and notifications. You agree to this when you accept this notice at sign-up. It is required to use the app.
• To keep the service secure and prevent abuse - detecting fraud, misuse and unauthorised access.
• To send service messages - verification codes, security alerts, billing notices and the notifications you have enabled.
• To run the AI assistant - only when your workspace Owner enables it. Your task and chat content is then sent to our AI provider to generate replies.
• To take payment and manage your workspace subscription.
• To comply with the law - for example responding to lawful requests and keeping records the law requires.
• Optional, separate consent: to send you product updates and offers. This is off unless you switch it on, and you can switch it off at any time.

4. What we do not do

• We do not sell, rent or trade your personal data, and we do not share it with advertisers or data brokers.
• We do not use your workspace content (tasks, chats, notes, files) or your AI conversations to train AI models.
• We do not track your location in the background or read your contacts.
• We do not treat continued use of the app as consent to a new purpose. If we ever want to use your data for something new, we will ask you first.

5. Who receives your data

• Other members of your workspace, according to the roles and permissions your workspace sets - for example your profile details, and the tasks and chats you take part in.
• Google (Firebase Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Messaging) - hosting, sign-in, database, file storage and push notifications.
• Google Vertex AI (Gemini) - AI assistant features, only when enabled by your workspace Owner.
• Resend - sending one-time codes, support and grievance emails.
• Razorpay and Google Play Billing - subscription payments.
• Authorities, only where the law requires it.
• These providers process data for us under contract and only to provide their service. Some of their servers are outside India (for example our AI provider runs in the United States), which the Act permits unless the Government restricts a country.

6. How long we keep it

• While you are an active member of a workspace, we keep your data so the service works.
• If you leave a workspace or are removed from it, your personal profile data (name, contact and profile details, photo, check-ins, notifications, unshared notes) is erased automatically 30 days later. You can ask for it to be erased sooner by deleting your account.
• If you delete your account, we erase your personal data in your workspace(s) immediately and delete your sign-in. Tasks, comments and messages you wrote belong to the workspace's business records: they stay, shown under the name "Former member". Chat files stay with their chats.
• If a workspace Owner deletes a workspace, all of its data is permanently removed after 30 days.
• We keep a minimal record of your consent and any erasure (your user ID and timestamps, no name or contact details) for up to 7 years to be able to show we complied with the law. Grievance tickets are kept until resolved and for as long as needed to defend legal claims.
• Technical and security logs are kept only as long as needed for security and to meet legal requirements.

7. Your rights and how to use them

Under the Act you have the right to:

• Get a summary of the personal data we hold about you and how it is processed, and who we share it with.
• Correct, complete or update your data - edit your profile in the app.
• Have your data erased.
• Have your grievances resolved (see section 11).
• Nominate a person to exercise your rights if you die or become unable to.
• Withdraw a consent you gave, as easily as you gave it (see section 8).
• You can do all of this yourself in the app: Account > Privacy & data on Android, or Privacy & data in your profile on the web. Some requests about business content owned by your workspace may need to go to your workspace Owner.

8. Withdrawing consent

• Product updates and offers: switch it off in Privacy & data. It takes effect immediately.
• The core service: because PulseBoard cannot run without processing your account and content, withdrawing this consent means deleting your account. You can do that in Privacy & data.
• Location: check-ins only happen when you tap Check in, and you can turn off the location permission in your phone's settings at any time.

9. Children

PulseBoard is for working adults and is not for anyone under 18. If we learn that an account belongs to someone under 18, we will delete it and its data.

10. Security and breaches

We protect your data with encryption in transit, role-based access controls and restricted database rules. No system is perfectly secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India, as the law requires.

11. Grievance Officer and the Data Protection Board

Grievance Officer: Shibani Shankar Pradhan, ThinkScaler (NeoThink Scaler Technologies Pvt. Ltd.). Email: shibani@neothinkscaler.com. You can also raise a grievance inside the app under Privacy & data, which gives you a ticket number.

We will respond as quickly as we can and in any case within 90 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India (see meity.gov.in for how to reach the Board).

12. Changes to this notice

If we change this notice in a material way we will update its version date and show you the new notice in the app so you can review and accept it. Continued use alone is not treated as consent to new purposes.