Privacy Policy

KundPulse AB operates KundPulse (the "Service"). 

Data roles under the GDPR: KundPulse AB acts as a Data Controller for personal data relating to merchants and account holders (for example account, billing, and support data). KundPulse AB acts strictly as a Data Processor for end-customer personal data that the merchant uploads to, or processes through, the Service — the merchant remains the controller of that data and determines the purposes and means of its processing.

• Account data — name, email, password hash, business name, industry.
• Business profile data — locations, connected review platforms, email templates, and logo or avatar images stored in our file storage.
• Team data — team member email addresses, invitation records, and role assignments.
• Customer data you provide — customer name, email address, phone number (when included), preferred language, and request history. This reaches us either directly from you or through inbound webhooks you configure from your point-of-sale or booking system; we store the received payloads for delivery and troubleshooting. Phone numbers are stored only as part of that record — all outbound customer messaging is email; the Service has no SMS channel. You are the controller of this data; we process it on your behalf.
• Staff attribution data — employee names or external staff identifiers you send us to attribute a request or review.
• Review and feedback content — public reviews fetched on your behalf and private feedback submitted through your review links.
• Messaging and funnel logs — email delivery and status logs, review-link click events, unsubscribe tokens, and suppression-list entries.
• Usage, device and audit data — log data, IP address, browser type, pages visited, timestamps, and audit-log entries of significant account actions.
• Support communications — messages you send us, including through the contact form on our website.

Payments are processed by Stripe. Card and billing details are collected directly by Stripe and are not stored by us. See Stripe's privacy notice for details.

• Provide the Service (contract) — create your account, deliver features, send transactional messages.
• Send review requests on your behalf (contract / your customers' legitimate interest in your business) — emails to your customers.
• Security and fraud prevention (legitimate interest, legal obligation) — logging, abuse detection, audit trails.
• Service improvement and analytics (legitimate interest) — understanding usage to improve features.
• Customer support (contract, legitimate interest) — responding to inquiries.
• Marketing communications (consent, legitimate interest) — product updates; you can opt out at any time.
• Legal compliance (legal obligation) — tax, accounting, responding to lawful requests.
• AI Processing and Sentiment Engine (legitimate interest / contract) — KundPulse utilizes secure, enterprise-grade artificial intelligence models to generate review response templates and extract sentiment analytics. Customer review data processed through our AI engines is treated with strict confidentiality, is completely isolated from public model training datasets, and is used solely to generate internal dashboard insights and automated responses for your authorized business locations.

AI sub-processors: KundPulse processes data via zero-data-retention AI sub-processors. End-customer personal data is never used to train public or foundational Large Language Models.

We share personal data only with service providers acting on our instructions and on a need-to-know basis:

• Cloud infrastructure — hosting, database, and authentication providers in the EU.
• Stripe — for subscription management, payments, tax compliance, and invoicing.
• Review platforms you connect — Google Business Profile, Meta (Facebook Pages via the Graph API), and Trustpilot. We exchange data with these platforms only for the accounts you explicitly connect, in order to read and sync reviews and to post replies you or your configured automations approve.
• AI providers — to generate suggested replies, summaries, and sentiment analysis. Content sent to AI providers is not used to train their public models.
• Email providers — to deliver review requests and notifications.
• Professional advisers (legal, accounting) and public authorities where required by law.

We do not sell personal data.

Current subprocessors:

• Cloud — hosting, database, authentication, file storage.
• Stripe — payments, billing, tax, invoicing.
• Google, Trustpilot, Meta — API for review sync (only when you connect your account).
• AI Gateway — large language model inference for sentiment analysis, summaries, and suggested replies.
• Email — transactional and authentication email delivery.

KundPulse’s use and transfer of information received from third-party APIs (including Google, Meta, and Trustpilot) will adhere strictly to their respective Developer and Data Use Policies, including Google's API Services User Data Policy Limited Use requirements.

Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and additional technical and organisational measures.

We retain account and business data for as long as your account is active. After account closure, data is deleted or anonymised within a reasonable period, subject to legal retention requirements (e.g. accounting records). Review and feedback data may be retained in aggregated, anonymised form for analytics. You can request earlier deletion at any time. Cached review and account data synced via official third-party APIs (such as Google Business Profile, Meta Platform APIs, or Trustpilot APIs) is retained only while your account is active and is permanently deleted within 30 days of account termination or integration disconnect.

You can also act on your data directly in the product: account settings let you export all of your data, delete your account immediately, or schedule deletion for a later date (which you can cancel until it runs). Security and audit logs, email delivery logs, and suppression records are kept for a limited period to protect the Service and to honour unsubscribe requests.

If you are in the EU/EEA, you have the right to:

• access your personal data;
• rectify inaccurate data;
• request erasure ("right to be forgotten");
• restrict or object to processing;
• data portability;
• withdraw consent at any time (without affecting prior lawful processing).

Account holders can exercise access, portability and erasure directly from account settings, which provide a full data export and immediate or scheduled account deletion.

For California residents (CCPA): you have rights to know, delete, correct, and to opt-out of "sale" or "sharing" of personal information. We do not sell or share personal information as defined by the CCPA. To exercise any right, contact privacy@kundpulse.com. We respond within one month.

We use appropriate technical and organisational measures including encryption in transit (TLS), encryption at rest for sensitive data, role-based access controls, audit logging, and regular review of access. No system is perfectly secure; please notify us immediately of any suspected compromise.

We use cookies, local storage, and similar technologies that are strictly necessary for the Service to function — authentication and session security, and interface preferences such as your language and your currently selected location. We do not use advertising cookies, and product-analytics tracking is not enabled on the Service. If we enable analytics cookies in the future, we will request your consent first.

The Service uses AI to draft suggested replies, summarise sentiment, and generate executive reports. Where you enable automation (for example automatic replies to positive public reviews), messages can be generated and published without a further manual step, based on the settings you configure. These features do not make decisions that produce legal effects, or similarly significant effects, concerning end customers, and you remain responsible for the settings you enable and the content that is published under your business account.

The Service is not directed at children under 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the current version.

If you have questions about this Privacy Policy or wish to exercise your GDPR rights, please contact us at privacy@kundpulse.com.