Privacy

Last updated: September 22, 2025

At PulseMesh LLC ("PulseMesh," "we," "us," "our"), we take your privacy seriously. This Privacy Policy explains what personal data we collect, how we use it, the choices you have, and the rights available to you under applicable laws. By using our website or mobile/web apps, you agree to the practices described below.

---

Who This Policy Covers

PulseMesh serves two primary user groups. Our data practices differ slightly depending on which group you fall into; where practices diverge, we call it out explicitly.

• Account Holders / Display Owners – Individuals or organizations that create an account at pulsemesh.io to manage one or more Displays and (where applicable) purchase subscription plans.
• Viewers – People who use the PulseMesh mobile or browser app to listen to a Display. Viewers do not need an account.

Unless clearly labeled otherwise, statements below apply to both groups.

---

Quick Summary (Not a Substitute for the Full Policy)

• We collect name, email, and Display address from Account Holders when they sign in and set up a Display.
• We collect device location (GPS) from Viewers only with device permission to show nearby Displays and confirm you are within range to listen. We do not use precise location for advertising, and we do not sell or share it.
• We collect usage, diagnostics, and IP address information across our services for security, analytics, and performance.
• Payments are processed by Dodo, Stripe, or Lemon Squeezy (depending on region). We never see full payment card numbers.
• Marketing e‑mail may be sent through FastMail and Sendune (opt‑out any time).
• You can request access, correction, deletion, portability, and limits on sensitive data; U.S. state and international rights vary (details below).

---

Key Terms

Display – A light show, holiday display, drive‑through event, or similar audiovisual installation that can be associated with a physical location in PulseMesh.

Display Owner – The Account Holder responsible for a Display.

Precise Location Data – GPS‑level latitude/longitude or similar high‑accuracy location that pinpoints a device to within ~1,750 feet (~533m) or less. Treated as Sensitive Personal Information under several privacy laws.

Personal Data / Personal Information – Any information that identifies or can reasonably be linked to an identifiable person or household. (Terms vary by law; we use them interchangeably here.)

---

Our Role: Controller vs. Processor

PulseMesh acts as a data controller for personal data we collect directly from you (e.g., account, billing, analytics). We may act as a data processor / service provider when we process certain data strictly on behalf of a Display Owner (for example, geocoding a Display address the owner provides). Our agreements with Display Owners and our vendor contracts include data protection terms appropriate to each role.

---

Information We Collect

1. Account Holders / Display Owners (pulsemesh.io)

• Name & Email Address – Collected at signup for authentication, account management, and communications.
• Display Address (street address) – Required to associate a Display with a geographical location. (See “Display Visibility” below for publication controls.)
• Billing & Subscription Data – Plan selection, billing address, and transaction data routed to our payment processors (Dodo, Stripe, or Lemon Squeezy by region). We do not store full payment card numbers.
• Cookies & Session Identifiers – For login, security, fraud prevention, and remembering preferences.
• IP Address & Device/Browser Metadata – Automatically captured for security and analytics.

2. Viewers (PulseMesh App – Mobile & Browser)

• Precise Device Location (GPS) – Sensitive Data: With your device’s permission, the app collects GPS coordinates while you are using PulseMesh to (a) show Displays near you and (b) confirm you are within the listening radius (currently 0.5 miles) before audio plays. You can revoke permission in device settings at any time.
• Raw Location Pings, Unidentified: GPS coordinates are transmitted to PulseMesh servers to perform proximity lookups. These pings are processed without attaching name, email, or other direct identifiers; we do maintain technical logs (e.g., timestamp, device/session token, IP) necessary to operate the service and secure systems.
• Usage & Diagnostics: Events such as app opens, playback start/stop, errors, and performance metrics.
• IP Address & Network Data: Used for security (attack prevention), rough regional analytics, and abuse controls.
• No Name / Email: The app does not ask Viewers for name or email.

---

Display Visibility (Map Opt‑In)

By default, Viewer apps show nearby Displays within 0.5 miles but do not present a map or reveal precise addresses.

Display Owners can optionally opt in to publish their Display on an in‑app map. When enabled, viewers may see the Display’s exact address and/or a map pin. Because some Display addresses may be residential locations, this setting is off by default. Owners can change visibility at any time in Display settings.

---

Data Inventory & Use Table

The chart below summarizes the main categories of data we collect, typical sources, how we use the data, our legal bases (GDPR), retention practices, the service providers who receive the data, and whether the category is “sold” or “shared” for cross‑context behavioral advertising under U.S. state privacy laws.

* Deleted records persist in system backups until overwritten in the ordinary course of business.

---

How We Use Your Information

Website (Account Holders / Display Owners)

• Authenticate and manage accounts.
• Manage Displays, subscriptions, and billing.
• Send transactional communications (service updates, subscription notices).
• Send marketing communications where permitted (unsubscribe any time).
• Analyze service usage to improve performance, plan capacity, and enhance features.
• Protect security, prevent fraud/abuse, and enforce our Terms.

App (Viewers)

• Determine which Displays are near you and enforce listening radius rules.
• Stream synchronized audio when you are within range of a Display.
• Measure anonymous usage to help Display Owners understand listener counts and troubleshoot performance.
• Improve app reliability and audio synchronization quality.

We do not use precise device location for targeted advertising. We do not sell or share personal information (including location data) for cross‑context behavioral advertising. If our practices change, we will update this Policy and provide legally required notices and opt‑out mechanisms.

---

Cookies & Similar Technologies

We use cookies, local storage, and similar technologies on pulsemesh.io. The PulseMesh app uses local storage and device APIs rather than traditional browser cookies.

Essential Cookies (Required)

• Authentication & session management
• Security (CSRF, rate limiting, fraud detection)

Analytics Cookies / SDK Events (Optional)

• Google Analytics (configured with Signals & Ads features disabled) for usage metrics.
• Cloudflare Analytics for performance & security insights.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from logging in. Analytics cookies can be disabled without breaking core site functionality.

---

Third‑Party Services & Disclosures

We engage carefully selected service providers that process personal data on our behalf and under contract. They are permitted to use personal data only to provide services to PulseMesh and must protect it appropriately.

Payments

• Dodo Payments, Stripe, Lemon Squeezy (regional routing). These processors handle payment card data; we receive tokenized references and transaction metadata, not full PANs.

Email & Marketing Communications

• FastMail for transactional and some account communications.
• Sendune for marketing and lifecycle communications (unsubscribe any time).

Address Geocoding / Mapping

• ArcGIS (Esri) processes Display addresses to obtain geocoordinates and mapping context.

Analytics & Performance

• Google Analytics (Signals & Ads disabled) for website/app usage metrics.
• Cloudflare for security, DDoS mitigation, and performance optimization (processes IP addresses and network metadata).

Additional infrastructure (hosting, content delivery, logging, error monitoring) may process personal data as needed to operate the service; those vendors are bound by similar data protection terms.

---

Data Retention

We retain personal data only as long as needed for the purposes described, to meet legal obligations, or to resolve disputes. When data is deleted from active systems it will be removed from searchable production databases; residual copies may remain in backups until those backups are overwritten in the ordinary course of business.

Category-Specific Durations

• Account Data: Retained while your account is active and for 30 days after deletion (recovery window). After 30 days, data is queued for deletion; backups purge on normal rotation.
• Display Data: Retained while Display is active and for 30 days after removal (to allow reversal), then queued for deletion; backups per rotation.
• Analytics & Diagnostics: Retained up to 26 months (current analytics configuration). Aggregated, de‑identified reporting metrics may persist longer.
• Payment & Tax Records: Retained up to 7 years to comply with tax, accounting, and audit obligations (we store only tokenized references, not full card numbers).
• Precise Location: Processed transiently for the active session; not retained in user‑identified form. De‑identified aggregates (e.g., listener counts by Display) may be retained.
• Support Tickets: Life of ticket + 2 years (unless needed longer for dispute resolution or legal claims).

---

Your Privacy Rights

The privacy rights available to you depend on where you live. We will honor requests required by applicable law and, where feasible, extend comparable rights globally.

Rights You May Have

• Access / Know – Learn what personal data we hold about you.
• Correction / Rectification – Ask us to fix inaccurate or incomplete data.
• Deletion / Erasure – Ask us to delete personal data (subject to legal exceptions).
• Restriction / Objection – Limit or object to certain processing (e.g., analytics, marketing).
• Data Portability – Receive certain data in a portable format.
• Opt Out of Marketing – Unsubscribe from marketing e‑mail at any time.
• Limit Use of Sensitive Personal Information (e.g., precise location) – In jurisdictions where this right applies, you can direct us to limit use to what is necessary to provide the service.
• Opt Out of Sale or Sharing / Targeted Advertising – We do not sell or share personal information for cross‑context behavioral advertising. If that changes, we will provide required opt‑out mechanisms.

U.S. State Privacy Rights (California, Colorado, Connecticut, Virginia, Maryland, Minnesota, Texas, and others)

Where these laws apply, you may exercise the rights listed above and, where offered, direct us to limit our use of Sensitive Personal Information. We also honor recognized browser or device‑level opt‑out signals such as Global Privacy Control (GPC) for applicable rights.

EU / EEA / UK (GDPR)

If you are located in the European Economic Area or United Kingdom, our processing of your personal data is governed by GDPR/UK GDPR. Legal bases appear in the data table above. You have the rights described above plus the right to lodge a complaint with your local supervisory authority. Because PulseMesh does not yet have an EU/UK establishment or appointed representative, please contact us directly at [email protected] and we will work with you to address concerns.

Canada & Other Regions

We will respond to access and deletion requests consistent with local law and our global practices.

---

How to Exercise Your Rights

Send an e‑mail to [email protected] with:

1. Your name (if you have an account) or, for Viewers, sufficient information for us to locate relevant data (e.g., device ID if available).
2. Your request type (access, deletion, correction, limit sensitive data, etc.).
3. The specific data or processing you are concerned about.

Identity Verification: For some requests (access, deletion, portability) we must verify your identity. We may ask you to confirm account e‑mail, recent activity, or other information. If you use an authorized agent (per California law), we may require written authorization and may still ask you to verify directly.

Appeals: If we deny or partially deny your request, you may appeal by replying to our response e‑mail with the subject "Privacy Appeal." If you remain unsatisfied, you may have the right to contact your state attorney general or data protection authority.

Response Times: We aim to respond promptly and within the timelines required by law (generally 30 days under GDPR; 45 days under California and most U.S. state privacy laws; each extendable where permitted for complex requests).

---

Security

We use a combination of administrative, technical, and physical safeguards designed to protect personal data:

• TLS encryption in transit
• Encryption at rest for key data stores (where supported by our infrastructure)
• Access controls limited to personnel with a legitimate business need
• Network‑level protections and DDoS mitigation through Cloudflare
• Logging, monitoring, and alerting for suspicious activity
• Regular backups and disaster‑recovery planning
• Vendor security reviews and contractual data protection commitments

No system can be guaranteed 100% secure, but we work continuously to protect your information.

---

Data Breach Notification

If we discover a security incident that compromises personal data, we will take appropriate steps to contain and investigate the event. We will notify applicable regulators and, where required by law, affected individuals. Under GDPR, we notify the relevant supervisory authority within 72 hours of becoming aware of a notifiable personal data breach and communicate to affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms.

---

International Data Transfers

PulseMesh operates globally using cloud infrastructure located in multiple regions for performance and reliability.

• Primary Storage: United States (primary data centers).
• Regional Storage: United Kingdom and Australia regions may be used to reduce latency for users in those areas.
• Safeguards: Cross‑border transfers are protected using appropriate safeguards such as Standard Contractual Clauses (SCCs), Data Privacy Framework participation by certain vendors, encryption, and contractual data protection commitments.

Because PulseMesh does not currently have an EU/UK establishment or appointed representative, EU/UK users should direct privacy inquiries to [email protected]. We will evaluate whether to appoint a representative as our European user base grows.

---

Children’s Privacy

Our services are not directed to children under 13 and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information as required by the U.S. Children’s Online Privacy Protection Act (COPPA) and applicable state or international laws. Parents or guardians who believe their child has provided personal information to PulseMesh should contact us at [email protected].

---

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make material changes we will: (1) post the updated Policy with a new "Last updated" date; and (2) notify registered Account Holders by e‑mail or in‑product notice. We encourage all users to review the Policy periodically.

---

Contact Us

Questions? Privacy request? Please contact us at: [email protected]