Cookie and analytics notice

In plain English

A cookie is a small text file that a website saves in your browser. Local storage and session storage are similar places in your browser where a site can keep small items. This notice lists what we use, where and why.
Our website (www.pulseri.com) uses Google Analytics to count visits. In the EU, the European Economic Area (EEA), the UK and Switzerland, no analytics cookie is set until you click "Accept". Everywhere else, analytics start on and you can switch them off with "Cookie settings" in the footer. If your browser sends a Global Privacy Control signal, analytics start off.
We do not use Google Analytics for advertising, and we use no advertising trackers.
Your choice stays in your browser for 12 months. We do not keep a copy of it on our servers.
The Pulseri app, the survey pages and the unsubscribe pages only use cookies and storage needed to sign you in, keep you safe and take payments, plus two small conveniences in the app that stay on your device.
Security services (Cloudflare, Google reCAPTCHA and Stripe) may set their own cookies to stop bots and fraud.
The Pulseri widget and SDK that our customers add to their own sites set no cookies and store nothing on your device.

1. Our website (`www.pulseri.com`)

1.1 What the website stores.

Name	Kind	Purpose	Lasts	Needed?
`_ga`	Cookie, set by Google Analytics	Gives your browser a random identifier, so Google Analytics can tell a returning visitor from a new one	2 years, renewed on each visit	No. Only when analytics are on (see 1.3)
`_ga_BFLGNM1P6M`	Cookie, set by Google Analytics	Keeps the state of your current visit	2 years, renewed on each visit	No. Only when analytics are on
`pulseri_consent`	Local storage	Remembers your analytics choice (see 1.4)	12 months	Yes
`__pulseri_probe`	Local storage	Checks that your browser lets us store your choice. It is written and removed straight away	A moment	Yes

The Google Analytics cookies are set for pulseri.com and all its subdomains, so your browser also sends them to the Pulseri app and its API. We do not use them there.

The contact form's spam check (1.5) and Cloudflare's security cookies (section 5) are described separately.

1.2 Analytics. We use Google Analytics 4, a service of Google. When analytics are on, Google's script loads from googletagmanager.com and counts page views and a few visit details:

the page address, without anything after a ? except campaign tags (such as utm_source), and without anything after a #;
the page title;
the page you came from (the referrer);
your approximate location, which Google derives from your IP address (Google says Google Analytics 4 does not log or store IP addresses);
your browser, operating system, device type and language.

We also record a few clicks, for example on a "Start trial" button, switching between monthly and yearly prices, following a link to our docs, or sending the contact form. These events do not contain your name, email address or message.

We turn off Google signals and ad personalisation, and advertising storage is always set to "denied" in Google's consent settings. We do not link analytics data to a Pulseri account or use it for advertising. Google processes the data on our behalf, as our processor. Google may process it in the United States and other countries; see the Privacy Policy for how we protect transfers. In Google Analytics we keep detailed visit data for 2 months, and the data tied to your browser's random identifier for 14 months after your last visit. Analytics are switched off on our development, test and preview sites.

1.3 When analytics run. Google Analytics is not strictly necessary for the website to work, so we ask for consent first where the law requires it.

Where we ask. Visitors in the EU, the EEA (Iceland, Liechtenstein and Norway), the United Kingdom and Switzerland see a cookie banner. "Accept" and "Reject" are equal buttons on the first layer. "Details" shows what analytics do and a switch, which is off until you turn it on. Google's script still loads, but until you accept it runs in a mode that sets no cookies (Google calls this "consent mode"). In that mode it may send Google basic visit information without cookies, such as the page and your browser type, which Google uses only in aggregate. If you close the page without choosing, nothing is stored and we ask again on your next visit. If we cannot tell where you are, or the check fails or takes more than about three seconds, we treat you as being in one of these countries and ask.

Everywhere else. Analytics start on, with no banner, and you can switch them off at any time with "Cookie settings" in the footer. If your browser sends a Global Privacy Control signal, analytics start off instead. We note this automatic setting in pulseri_consent and keep it for 12 months, so we do not check where you are again during that time. You can change it at any time with "Cookie settings". If your browser later sends a Global Privacy Control signal, we respect it.

How we know where you are. On your first visit, and on each visit until a choice or automatic setting is stored, our server reads the country that Cloudflare derives from your connection, only to decide whether to ask. It answers "ask" or "do not ask". We do not store or log your country, and the check sets no cookie.

1.4 Your choice and how we keep it.

When you click "Accept" or "Reject", or save the switch in "Cookie settings", we store your choice in your browser's local storage under pulseri_consent. It is not a cookie and it is not sent to us. It records whether analytics are on, which group of countries applied, when you chose and which version of this notice you saw.
We keep your choice in your browser, not on our servers. We keep no other record of it. If you clear your browser's storage, the choice is gone and we ask again (or, outside the countries where we ask, analytics start on again unless your browser sends Global Privacy Control).
"Accept" and "Reject" are both kept for 12 months. We ask again after that, or sooner if this notice changes in a way that needs a new choice.
You can change your choice at any time with "Cookie settings" in the footer of every page.
A choice you make yourself on our site counts over the Global Privacy Control signal. In the countries where we ask, the signal changes nothing: no analytics cookies are set until you accept.
If you reject or switch analytics off after accepting, we tell Google's script to stop using analytics cookies and remove the Google Analytics cookies we can reach in your browser. The script itself stays on our pages and keeps running in the mode without cookies described in 1.3.

1.5 Contact form spam check. The contact page uses Cloudflare Turnstile (Cloudflare, Inc., United States, with servers worldwide) to tell people from bots. Its script loads only when you first use the contact form. It runs a short check in your browser and sends a result to us, which we verify with Cloudflare. For that, Cloudflare receives technical details such as your IP address and browser data. Cloudflare says Turnstile sets no cookies unless a site turns on a feature called pre-clearance. We use Turnstile only to protect the form, which we treat as strictly necessary for the service you asked for (our legitimate interest in security). We do not use it for advertising.

1.6 Hosting and delivery. Our website is delivered through Cloudflare, which sees visitors' IP addresses and request details in order to deliver pages and protect against attacks (see section 5).

1.7 Other tools. Apart from Google Analytics, the website uses no analytics, advertising or tracking tools. If we add one that is not strictly necessary, we will update this notice first and treat it like Google Analytics: in the countries where we ask, it will not run until you agree.

2. The Pulseri app (app.pulseri.com and api.pulseri.com)

2.1 Set by Pulseri. These are set when you open the app, register or sign in.

Name	Kind	Purpose	Lasts	Needed?
`pulseri-session`	Cookie. Sent only over secure connections and not readable by page scripts	Keeps you signed in. Visitors who are not signed in (for example on the sign-in or sign-up page) get a guest session	Signed in: the cookie expires 7 days after your last activity. Our server signs you out sooner: by default after 2 hours without activity, and at the latest 7 days after you signed in. An Enterprise account can set its own limits. Not signed in: 2 hours	Yes (strictly necessary)
`XSRF-TOKEN`	Cookie, readable by the page	Protects against forged requests, where another site tries to act in your name	2 hours, renewed as you use the app	Yes
`__Host-sso_bind`	Cookie. Secure, not readable by page scripts, sent only to the server that set it	Ties a single sign-on login to the browser that started it, so the login cannot be hijacked	10 minutes, removed once sign-in finishes	Yes
`__Host-social_bind`	Cookie, same protections	Does the same for "Sign in with Google" and "Sign in with Microsoft"	10 minutes	Yes
`pending_social_signup`	Cookie. Encrypted, not readable by page scripts	Holds the email address and name that Google or Microsoft passed to us, between signing in there and finishing your sign-up with us	10 minutes	Yes
`pulseri:post-login-redirect`	Session storage	Remembers the page you were heading to when you sign in through Google, Microsoft or single sign-on, so we can take you back there	Removed once used, or when you close the tab	Yes (for the sign-in you asked for)
Recent searches	Local storage	Remembers up to 8 recent searches in the dashboard. It holds only record identifiers and page addresses, not names; the app asks our server for the current names when it shows the list	Until you sign out (it is cleared then) or clear your browser	Convenience
Closed billing reminder	Local storage	Remembers that you closed the reminder to add your company details or VAT ID	We honour it for 7 days; after that the reminder can show again	Convenience

pulseri-session, XSRF-TOKEN and pending_social_signup are set for pulseri.com and all its subdomains, so your browser also sends them when you visit our website (www.pulseri.com). The website does not read or use them. The two __Host- cookies go only to the server that set them.

2.2 Set by our providers.

Name	Set by	Where	Purpose	Lasts	Needed?
`__stripe_mid`	Stripe	Signed-in app and the registration page	Fraud prevention for payments	1 year	Yes (payment security)
`__stripe_sid`	Stripe	Signed-in app and the registration page	Fraud prevention for payments	30 minutes	Yes (payment security)
`_GRECAPTCHA` and storage inside Google's frame	Google reCAPTCHA	Sign-in, sign-up and password reset	Tells people from bots	Set by Google	Yes (security)

Stripe. Today Stripe's script loads throughout the signed-in app and on the registration page, not only on the card form. It is used for payments and to prevent fraud. It may set the two cookies above and send Stripe technical details about your device and browser. Stripe uses this data for fraud prevention as its own controller (it decides how the data is used, under its own privacy policy). We treat this as strictly necessary for payment security.

Google reCAPTCHA. On sign-in, sign-up and password reset, Google's reCAPTCHA script loads when you submit the form. It checks whether you are a person or a bot. Google may set the _GRECAPTCHA cookie and use storage inside its own frame, and receives technical details such as your IP address and browser data. Google acts as its own controller for this data, under its own privacy policy and terms. We use reCAPTCHA only to protect accounts and treat it as strictly necessary for security.

2.3 Sign-in providers. If you use "Sign in with Google", "Sign in with Microsoft" or your company's single sign-on, that provider may set its own cookies on its own pages. We do not control them.

2.4 The app uses no analytics or advertising tools.

3. Survey and unsubscribe pages

When you open a survey link or an unsubscribe link from an email, the page is served by the Pulseri app at app.pulseri.com. When you submit your answers or unsubscribe, the page sets pulseri-session (a guest session, 2 hours) and XSRF-TOKEN (2 hours) to protect the request against forgery. Both are strictly necessary. Cloudflare's security cookies (section 5) may also apply. These pages use no analytics or advertising tools.

The organisation that sent you the survey decides what it asks and is responsible for your answers. See the Privacy Policy for how we handle that data on its behalf.

4. Customers' sites with the Pulseri widget

Our customers can add the Pulseri SDK and in-app widget to their own websites and products. The SDK and widget set no cookies and store nothing in local or session storage. To show the right survey, they send us the page path, the site's address and the address of the page you came from, without query strings or anything after a #. They do not send the page title.

The customer controls its own site and is responsible for any notice or consent that its site needs, including for its own cookies. We act as its processor under our Data Processing Addendum.

5. Cloudflare security cookies (all our sites)

Our website, the app, the API and the survey pages are delivered through Cloudflare, which sees IP addresses and request details in order to deliver pages and protect against attacks. If Cloudflare runs a bot check or a challenge on your visit, it may set:

Name	Purpose	Lasts	Needed?
`__cf_bm`	Tells people from bots	30 minutes	Yes (strictly necessary for security)
`cf_clearance`	Records that you passed a challenge, so you are not asked again straight away	Usually 30 minutes	Yes (strictly necessary for security)

6. Your choices

Analytics. Use "Cookie settings" in the footer of the website to switch analytics on or off at any time (see 1.4). The website works with analytics off. You can also block or delete the _ga cookies in your browser, use a content blocker, or use Google's browser add-on to opt out of Google Analytics (https://tools.google.com/dlpage/gaoptout).
Your stored choice. If you delete pulseri_consent from your browser's local storage, we ask again (or, outside the countries where we ask, analytics start on again unless your browser sends Global Privacy Control).
Strictly necessary cookies. You can block or delete them in your browser settings, but then sign-in, payments, the contact form or survey answers may not work, and deleting app cookies signs you out.

7. Changes

We will update this notice when our tools change. If a change needs a new choice from you, we ask again. See the Privacy Policy for how we handle personal data, and our sub-processors page for the providers we use.

Cookie and analytics notice

Version history