Privacy Policy

1Who We Are

Vulse is an infrastructure intelligence platform operated by Vulse s.r.o., a company registered in the Slovak Republic.

This Privacy Policy explains how we collect, use, store, protect, and share information about you when you use our website at vulse.io, our web application, APIs, and any related services (collectively, the "Service"). It applies to all users of Vulse, including visitors to our marketing website, registered account holders, and enterprise customers.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this policy, please do not use the Service.

2What Data We Collect

We collect information in the following categories, depending on how you interact with the Service:

2.1 Account & Identity Data

When you register for a Vulse account, we collect:

• Full name and email address
• Company name and job title
• Password (stored in hashed, salted form — we never store plaintext passwords)
• Profile photo (optional)
• Billing address and VAT number (for paid plans)

If you sign up via a third-party authentication provider (Google, Microsoft, GitHub), we receive the name, email, and profile picture associated with that account. We do not receive your third-party password.

2.2 Infrastructure & Operational Data

This is the core data you create while using Vulse — the content of your workspace. It includes:

• System definitions: names, hostnames, IP addresses, platform details, environment labels, and owner assignments
• Dependency relationships between systems
• System documentation, API documentation, and version history
• Defined risks, problems, and monitoring configurations
• Release windows, release request tickets, and change records
• Incident records, status updates, and resolution notes
• Any other content you choose to enter into the Service

2.3 Usage & Technical Data

We automatically collect certain technical information when you access the Service:

• IP address and approximate geolocation (country/city level)
• Browser type, version, and operating system
• Device identifiers and screen resolution
• Pages visited, features used, and time spent in the application
• Referring URLs and search terms
• Error logs and performance metrics
• API request logs (endpoint, timestamp, response code)

2.4 Communication Data

If you contact us for support, sales enquiries, or other correspondence, we collect:

• The content of your messages and emails
• Attachments you send us
• Records of previous interactions to provide continuity of support

2.5 Payment Data

We use Stripe as our payment processor. We do not store full payment card numbers on our servers. We retain non-sensitive billing metadata such as the last four digits of a card, card type, billing name, and transaction history for accounting purposes.

3How We Use Your Data

We use collected data for the following purposes:

Purpose	Details
Providing the Service	Creating and managing your account, hosting your infrastructure data, processing release requests, and operating all platform features.
Authentication & Security	Verifying your identity at login, detecting and preventing fraudulent access, enforcing two-factor authentication where enabled.
Billing & Payments	Processing subscription payments, issuing invoices, handling refunds, and managing plan upgrades and downgrades.
Customer Support	Responding to support tickets, diagnosing bugs, and resolving technical issues you report.
Product Improvement	Analysing aggregated, anonymised usage patterns to improve features, fix issues, and prioritise our roadmap.
Communications	Sending transactional emails (password resets, billing receipts, incident alerts). We send product update emails only with your consent.
Legal Compliance	Fulfilling legal obligations, responding to lawful requests from authorities, and enforcing our Terms of Service.

We do not use your data to display advertisements, and we do not sell your data to data brokers or marketing companies.

4Legal Basis for Processing

Under the EU General Data Protection Regulation (GDPR), we are required to identify a lawful basis for each type of processing. We rely on the following bases:

• Contract performance — processing necessary to deliver the Service you have signed up for, including account management, hosting your data, and processing payments.
• Legitimate interests — improving the Service, fraud prevention, security monitoring, and internal analytics, where these interests are not overridden by your rights.
• Consent — sending marketing communications and placing non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation — retaining financial records, responding to lawful authority requests, and fulfilling tax and regulatory requirements under applicable EU and Slovak law.

Where we rely on legitimate interests, we have conducted a Legitimate Interests Assessment (LIA) and concluded that our interests do not override your fundamental rights. You may request a copy of this assessment by contacting our DPO.

5Data Sharing & Third Parties

We do not sell your personal data. We share data only in the limited circumstances described below:

5.1 Sub-processors

We use trusted third-party service providers ("sub-processors") to operate the Service. All sub-processors are contractually bound by Data Processing Agreements (DPAs) that restrict their use of your data:

Sub-processor	Purpose	Location
Amazon Web Services	Cloud infrastructure & data hosting	EU (Frankfurt)
Stripe	Payment processing	USA (SCCs applied)
Postmark	Transactional email delivery	USA (SCCs applied)
Intercom	Customer support & live chat	USA (SCCs applied)
Cloudflare	CDN, DDoS protection, DNS	EU nodes prioritised
Sentry	Error monitoring & crash reporting	USA (SCCs applied)

An up-to-date list of all sub-processors is available at vulse.io/subprocessors. We will notify you of any material changes to this list at least 30 days in advance.

5.2 Legal Disclosures

We may disclose your data if required to do so by law, court order, or government authority, or where necessary to protect the rights, property, or safety of Vulse, our users, or others. We will notify you of any such disclosure request, to the extent permitted by law.

5.3 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of all or part of our assets, your data may be transferred to the acquiring party. We will notify affected users prior to any such transfer and ensure the new party agrees to at least the same level of privacy protections described in this policy.

5.4 With Your Consent

We will share your data with third parties in any other circumstance only with your explicit consent, which you may withdraw at any time.

6Data Retention

We retain your data for as long as your account is active or as necessary to provide the Service. Specific retention periods are:

• Account data — retained for the duration of your account, plus 30 days after deletion to allow recovery. After 30 days, account data is permanently purged from all systems including backups.
• Infrastructure & operational data — retained for the duration of your subscription. On cancellation, data is available for export for 30 days, then permanently deleted.
• Billing & financial records — retained for 10 years as required by Slovak and EU tax law (Act No. 431/2002 Coll. on Accounting).
• Usage & technical logs — retained for 90 days for security and diagnostic purposes, then deleted.
• Support communications — retained for 3 years to provide continuity of support history, then deleted.
• Marketing consent records — retained until you withdraw consent, plus 3 years for legal compliance purposes.

When data is deleted, it is rendered unrecoverable through secure deletion procedures. We do not retain data in anonymised form beyond these periods unless stated otherwise.

7Data Security

Security is core to Vulse — we are an infrastructure management platform and we take our own security obligations extremely seriously. Our security measures include:

Technical measures

• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted using AES-256
• Passwords are hashed using bcrypt with a minimum cost factor of 12
• Database access is restricted to authorised internal services via private VPC networking
• Two-factor authentication (TOTP and WebAuthn) is available and strongly encouraged for all users
• API keys are hashed before storage and are only displayed once at creation
• Regular automated vulnerability scanning and dependency audits
• Automated backups encrypted and stored in geographically separate regions

Organisational measures

• Access to production systems is restricted to a limited number of vetted engineers using hardware security keys
• All production access is logged and reviewed
• Annual employee security training and background checks for staff with data access
• A formal incident response procedure, including mandatory breach notification within 72 hours as required by GDPR
• Annual third-party penetration testing; results shared with Enterprise customers upon request under NDA
• SOC 2 Type II certification, renewed annually

Despite our best efforts, no system is completely immune to security threats. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.

To report a security vulnerability, please contact security@vulse.io. We operate a responsible disclosure programme.

8International Data Transfers

Vulse is headquartered in the European Union (Slovakia). Your data is primarily processed and stored on servers located within the EU (AWS eu-central-1, Frankfurt).

Some of our sub-processors (listed in Section 5) are based in the United States. For any transfer of personal data to countries outside the European Economic Area (EEA) that do not have an adequacy decision from the European Commission, we ensure that appropriate safeguards are in place, specifically:

• Standard Contractual Clauses (SCCs) — the EU Commission-approved SCCs (2021 version) are incorporated into our Data Processing Agreements with all US-based sub-processors
• Supplementary technical measures — including end-to-end encryption and pseudonymisation where feasible, to reduce risk in the event of government access requests in third countries

Enterprise customers who require EU-only data residency may request this through their account settings or by contacting enterprise@vulse.io.

9Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data under the General Data Protection Regulation (EU) 2016/679:

Right of Access (Art. 15)

You have the right to obtain confirmation of whether we process your personal data, and if so, to receive a copy of that data along with information about how it is processed.

Right to Rectification (Art. 16)

You have the right to request correction of inaccurate personal data or completion of incomplete data. You can update most account information directly through the Settings panel in your Vulse dashboard.

Right to Erasure / "Right to be Forgotten" (Art. 17)

You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where the processing was unlawful. Note that we may need to retain certain data to comply with legal obligations (e.g. financial records).

Right to Restriction of Processing (Art. 18)

You may request that we restrict the processing of your data in certain circumstances, for example while a dispute about its accuracy is resolved.

Right to Data Portability (Art. 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV), and to transmit it to another controller. You can initiate a full data export at any time from Settings → Data & Privacy → Export My Data.

Right to Object (Art. 21)

You have the right to object to processing based on our legitimate interests. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision-Making (Art. 22)

Vulse does not make decisions that produce legal or similarly significant effects based solely on automated processing.

Right to Withdraw Consent

Where processing is based on your consent (e.g. marketing emails), you may withdraw that consent at any time using the unsubscribe link in any email, or from Settings → Notifications.

Right to Lodge a Complaint

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with your national data protection supervisory authority. In Slovakia, this is:

10Cookies & Tracking Technologies

We use cookies and similar tracking technologies on our website and within the application. You can manage your cookie preferences via the cookie banner displayed on your first visit, or at any time through Settings → Privacy → Cookie Preferences.

Types of cookies we use

Category	Purpose	Consent required?
Strictly necessary	Authentication session tokens, CSRF protection, load balancing. The Service cannot function without these.	No
Functional	Remembering your preferences (language, timezone, UI layout, notification settings).	No
Analytics	Aggregate, anonymised usage analytics to improve the product (we use a self-hosted, cookie-less analytics solution).	No (anonymised)
Marketing	If you arrive via a partner referral, a cookie records the referral for commission purposes only. No advertising cookies are placed.	Yes

We do not use Google Analytics, Meta Pixel, or any other advertising tracking network. We do not place third-party advertising cookies on your device.

11Children's Privacy

The Service is intended for use by businesses and professional engineering teams. It is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16.

If we become aware that a child under 16 has provided us with personal data without verifiable parental consent, we will promptly delete that information. If you believe a child has provided us with their data, please contact us at privacy@vulse.io.

12Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to all registered account holders at least 14 days before the changes take effect
• Display a prominent notice within the application dashboard
• For significant changes affecting your rights, request your renewed consent where legally required

Previous versions of this Privacy Policy are archived and available upon request by contacting our DPO. We encourage you to review this policy periodically to stay informed about how we protect your data.

Your continued use of the Service after changes take effect constitutes your acceptance of the revised policy, to the extent permitted by applicable law.

13Contact & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us through any of the following channels:

We aim to acknowledge all privacy-related enquiries within 2 business days and resolve them within 30 days. For urgent matters relating to a potential data breach or immediate risk to your data, please include "URGENT" in the subject line of your email.

This policy was last reviewed and approved by Vulse s.r.o. legal counsel on 1 January 2026.