Privacy Policy

The KundPulse service (the "Service") is operated by KundPulse AB ("KundPulse", "we", "us").

Data roles under the GDPR: KundPulse acts as a Data Controller for personal data relating to merchants and account holders (for example account, billing, and support data). KundPulse acts strictly as a Data Processor for end-customer personal data that the merchant uploads to, or processes through, the Service — the merchant remains the controller of that data and determines the purposes and means of its processing.

• Account data — name, email, password hash, business name, industry.
• Business profile data — locations, connected review platforms, email templates, and logo or avatar images stored in our file storage.
• Team data — team member email addresses, invitation records, and role assignments.
• Customer data you provide — customer name, email address, phone number (when included), preferred language, and request history. This reaches us either directly from you or through inbound webhooks you configure from your point-of-sale or booking system. We store the received payloads only for as long as necessary to fulfill email delivery, ensure system security, and troubleshoot technical errors, after which they are deleted or anonymized. Phone numbers are used only for WhatsApp invitations and one-way recovery replies on Elite Pulse, when the business has chosen that channel; otherwise they are stored only as part of the record. The Service has no SMS channel. You are the controller of this data; we process it on your behalf.
• Staff attribution data — employee names or external staff identifiers you send us to attribute a request or review.
• Review and feedback content — public reviews fetched on your behalf and private feedback submitted through your review links.
• Messaging and funnel logs — email delivery and status logs, review-link click events, unsubscribe tokens, and suppression-list entries; for WhatsApp, message delivery status, opt-outs, and any replies a customer sends.
• Public showcase content — when a business enables its review showcase, the reviewer display name, rating, date, and review text of the reviews that business chooses to publish appear on its public page and website embed.
• Free tools and lead forms — business-name searches in our free tools (looked up through OpenStreetMap), and the name, email, and business details you enter to request a printable kit or schedule a demo.
• Usage, device and audit data — log data, IP address, browser type, pages visited, timestamps, and audit-log entries of significant account actions.
• Support communications — messages you send us, including through the contact form on our website.

No sensitive personal data: The Service is not intended to process special categories of personal data under GDPR Article 9 (such as health, medical, or biometric data), criminal-conviction data, or payment card numbers. You must not upload, enter, or solicit such data through the Service — including in review requests, feedback forms, staff attribution fields, or messages sent to AI features — and we do not knowingly process it. If such data reaches us, we will delete or anonymise it in line with our retention practices.

Payments are processed by Stripe. Card and billing details are collected directly by Stripe and are not stored by us. See Stripe's privacy notice for details.

• Provide the Service (contract) — create your account, deliver features, send transactional messages.
• Send review requests on your behalf (contract / your customers' legitimate interest in your business) — emails and, on Elite Pulse, WhatsApp messages to your customers.
• Security and fraud prevention (legitimate interest, legal obligation) — logging, abuse detection, audit trails.
• Service improvement and analytics (legitimate interest) — understanding usage to improve features through server logs; product-analytics cookies are used only with your consent.
• Customer support (contract, legitimate interest) — responding to inquiries.
• Marketing communications (consent, legitimate interest) — product updates; you can opt out at any time.
• Legal compliance (legal obligation) — tax, accounting, responding to lawful requests.
• AI Processing and Sentiment Engine (legitimate interest / contract) — KundPulse utilizes secure, enterprise-grade artificial intelligence models to generate review response templates and extract sentiment analytics. Customer review data processed through our AI engines is treated with strict confidentiality, is completely isolated from public model training datasets, and is used solely to generate internal dashboard insights and automated responses for your authorized business locations.

AI sub-processors: KundPulse processes data via zero-data-retention AI sub-processors. End-customer personal data is never used to train public or foundational Large Language Models.

Zero Data Retention Guarantee: KundPulse uses zero-data-retention terms for LLM API calls. End-customer personal data sent to our AI providers is processed only for the specific request and is not retained by them afterwards. It is strictly isolated from public model training datasets and is never used to train, improve, or fine-tune public or foundational AI models. We only send the minimum content necessary to generate the specific output.

We share personal data only with service providers acting on our instructions and on a need-to-know basis:

• Cloud infrastructure — hosting, database, and authentication providers.
• Stripe — for subscription management, payments, tax compliance, and invoicing.
• Review platforms you connect — Google Business Profile. We exchange data with these platforms only for the accounts you explicitly connect, in order to read and sync reviews and to post replies you or your configured automations approve.
• AI providers — to generate suggested replies, summaries, and sentiment analysis. Content sent to AI providers is processed under zero-data-retention terms and is not used to train, improve, or fine-tune public or foundational AI models.
• Email providers — to deliver review requests and notifications.
• Meta (WhatsApp Business Platform) — to deliver WhatsApp invitations and recovery replies for Elite Pulse businesses that choose that channel.
• OpenStreetMap (Nominatim) — receives the business name you search for in our free tools.
• Security and bot-protection providers — Cloudflare, to verify that visitors to our public pages and free tools are human and to protect against automated abuse.
• Web analytics and tag management — Google (Google Analytics, Google Tag Manager) and similar analytics providers, only if you accept analytics cookies.
• Advertising and marketing partners — conversion-measurement and advertising networks such as Google Ads and, where enabled, Meta, LinkedIn or similar platforms, only if you accept advertising cookies.
• Professional advisers (legal, accounting) and public authorities where required by law.

We do not sell personal data.

Current subprocessors:

• Cloud — hosting, database, authentication, file storage.
• Stripe — payments, billing, tax, invoicing.
• Meta — WhatsApp Business Platform message delivery (Elite Pulse only).
• OpenStreetMap Foundation — business-name search in free tools.
• Google — API for review sync (only when you connect your account).
• AI Gateway — large language model inference for sentiment analysis, summaries, and suggested replies.
• Email — transactional and authentication email delivery.
• Cloudflare — bot detection, human verification (Turnstile) and abuse prevention on our public pages and free tools.

KundPulse’s use and transfer of information received from third-party APIs (including Google) will adhere strictly to their respective Developer and Data Use Policies, including Google's API Services User Data Policy Limited Use requirements.

Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and additional technical and organisational measures.

Data Processing Addendum (DPA): For merchant customers, our Data Processing Addendum — incorporating the EU Standard Contractual Clauses for any transfers of end-customer personal data outside the EU/EEA — forms part of these arrangements and is available on request at support@kundpulse.com.

We retain account and business data for as long as your account is active. After account closure, data is deleted or anonymised within a reasonable period, subject to legal retention requirements (e.g. accounting records). Review and feedback data may be retained in aggregated, anonymised form for analytics. You can request earlier deletion at any time. Cached review and account data synced via official third-party APIs (such as the Google Business Profile API) is retained only while your account is active and is permanently deleted within 30 days of account termination or integration disconnect.

Inbound webhook payloads: raw payloads received from your POS or booking system are kept only for the time needed to process delivery, maintain security, and resolve technical errors, after which they are deleted or anonymized.

You can also act on your data directly in the product: account settings let you export all of your data, delete your account immediately, or schedule deletion for a later date (which you can cancel until it runs). Security and audit logs, email delivery logs, and suppression records are kept for a limited period to protect the Service and to honour unsubscribe requests.

• Account and business data — while your account is active, then deleted or anonymised after closure.
• End-customer requests and feedback — while the business account is active, or until the business deletes them.
• Inbound webhook payloads — only as long as needed for delivery, security, and troubleshooting.
• Email and WhatsApp delivery logs — for a limited period for security and deliverability; opt-out and suppression records are kept so we can keep honouring them.
• Audit logs — for a limited period for security and fraud prevention.
• Backups — deleted data may remain in encrypted backups until they are overwritten on their normal cycle.
• Accounting records — as long as tax and accounting law requires.

Public showcase: a reviewer who wants their review removed from a business's showcase can ask that business or email support@kundpulse.com, and we will pass on or act on the request.

If you are in the EU/EEA, you have the right to:

• access your personal data;
• rectify inaccurate data;
• request erasure ("right to be forgotten");
• restrict or object to processing;
• data portability;
• withdraw consent at any time (without affecting prior lawful processing).

Account holders can exercise access, portability and erasure directly from account settings, which provide a full data export and immediate or scheduled account deletion.

For California residents (CCPA): you have rights to know, delete, correct, and to opt-out of "sale" or "sharing" of personal information. We do not sell or share personal information as defined by the CCPA. To exercise any right, contact support@kundpulse.com. We respond within one month.

You also have the right to complain to a data protection supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY, imy.se), or you can contact the authority where you live or work.

We use appropriate technical and organisational measures including encryption in transit (TLS), encryption at rest for sensitive data, role-based access controls, audit logging, and regular review of access. No system is perfectly secure; please notify us immediately of any suspected compromise.

We use cookies, local storage, pixels, tags and similar technologies, grouped into three categories:

• Strictly necessary (always on) — authentication and session security, bot protection, interface preferences such as your selected location, and remembering your cookie choice.
• Analytics & performance (only with your consent) — web analytics and tag-management tools that measure visits, pages viewed and how the site is used, so we can improve it. We currently use Google Analytics and Google Tag Manager, and may use similar analytics providers.
• Advertising & conversion measurement (only with your consent) — advertising and measurement networks that record which ads or campaigns lead to actions such as enquiries, demo requests, audits, sign-ups and checkouts. We currently use Google Ads and may, where enabled, use other networks such as Meta (Facebook/Instagram), LinkedIn, Microsoft Advertising or similar providers. These may receive device, browser, page and ad-click data.

Non-essential technologies are blocked for every visitor, worldwide, until you opt in. If your browser sends a Global Privacy Control (GPC) signal, advertising stays off even if you accept all. We store your choice, its date and the notice version as a consent record. You can change or withdraw consent at any time via “Cookie settings” in the site footer. Some providers may process data outside the EU/EEA under the safeguards described in section 5.

Bot and abuse protection (Cloudflare Turnstile): our public pages and free tools are protected by Cloudflare Turnstile, which verifies that a visitor is a human and not an automated script. Turnstile runs invisibly in most cases and analyses device, browser and network signals (including IP address) together with a strictly necessary security token stored in your browser. It does not track you across websites and is not used for advertising. See the Cloudflare Turnstile Privacy Policy for details.

The Service uses AI to draft suggested replies, summarise sentiment, and generate executive reports. Where you enable automation (for example automatic replies to positive public reviews), messages can be generated and published without a further manual step, based on the settings you configure. These features do not make decisions that produce legal effects, or similarly significant effects, concerning end customers, and you remain responsible for the settings you enable and the content that is published under your business account.

The Service is not directed at children under 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the current version. We will tell account owners about material changes by email or in-app before they take effect.

If you have questions about this Privacy Policy or wish to exercise your GDPR rights, please contact us at support@kundpulse.com. Data controller and operator: KundPulse AB.