PulseGTO
Privacy Policy
In short: we store what an account needs (e-mail, username, password hash and confirmation status), what billing needs (a Stripe customer reference), what the desktop licence needs (a device fingerprint), and, for free accounts, which strategies you opened in the last 30 days so the daily cap works. We send account e-mails for address confirmation and registration notices. No advertising or selling of data. Optional Google Analytics on public website pages runs only after you accept analytics cookies; it is not installed in the desktop solver or account panels. Hand-history files you upload are processed in memory and not stored. You can export or delete everything from the dashboard.
1. Controller
Michał Mazur, operating under the Pulse Labs brand, Bobrowa 111, 39-203 Bobrowa, Poland, [email protected] is the controller of personal data processed through pulsegto.com and the PulseGTO desktop software.
2. What we process, why, and on what basis
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| E-mail, username, password (as a bcrypt hash), and e-mail confirmation token hash and expiry | Your account, login, and confirmation that you control the address | Contract, art. 6(1)(b) | Account details until you delete the account; confirmation token until used or expired |
| Google account ID and e-mail (if you sign in with Google) | Login | Contract, art. 6(1)(b) | Until you delete the account |
| Stripe customer ID, subscription status and paid-through dates | Your plan and billing | Contract, art. 6(1)(b); legal obligation for invoices, art. 6(1)(c) | Account lifetime; invoice records as long as tax law requires (in Poland 5 years) |
| Device fingerprint and the signed licence issued for it | Activating the desktop engine on your computers | Contract, art. 6(1)(b) | Until you delete the account |
| Boards opened in the strategy library and when (free accounts) | Enforcing the 24-hour cap; showing you your remaining board views | Contract, art. 6(1)(b) | 30 days, then deleted automatically |
| IP address, user agent, requested URL | Security, rate limiting, blocking abuse; server logs | Legitimate interest, art. 6(1)(f) | Logs: 14 days |
| Cloudflare Turnstile token | Telling humans from bots at sign-up and login | Legitimate interest, art. 6(1)(f) | Not stored by us |
| Hand-history files you upload | Parsing the hands you ask us to parse | Contract, art. 6(1)(b) | Processed in memory, not stored |
| E-mails you send us | Support | Legitimate interest, art. 6(1)(f) | Up to 2 years |
For signed-in Cloud accounts, we retain daily service-use totals for 30 days: Cloud page openings (including reloads), successful preflop/postflop strategy queries, the game (NLHE or PLO), and the latest opening/query timestamps. These account service counters help support and diagnose product use; they are separate from the Free lookup allowance and Google Analytics. They do not record cards, ranges, action paths, IP addresses, time spent or every click. They are included in account data exports and removed with the account.
During an Engine trial, the desktop app periodically checks whether its licence is still valid. The check sends the device identifier and licence signature; the server also receives the connection's IP address. It does not send cards, ranges, strategies or solve results. We keep timestamps of successful trial licence checks with your account, including a contact history, so we can assess trial use. These timestamps do not show whether you are at the computer or how long a solve runs. They are included in your account data export and removed when you delete your account. Ordinary security logs are kept for 14 days as described above.
When you request an authenticated installer or blueprint download, we record the file, its game (NLHE, PLO or the shared installer) and the request time with your account. This records a download start, not completed transfer or installation. The history is visible to the site owner, included in your account export and deleted with your account.
Hand-history files usually contain the screen names of other players. We only parse them to show you the hand and do not keep the file or those names.
We do not use your data for advertising, profiling or automated decisions with legal effect, and we do not sell it.
3. Who receives data (processors)
| Recipient | What | Why | Where |
|---|---|---|---|
| OVH | Everything the server stores | Hosting | EU |
| Cloudflare, Inc. | IP address, requests; Turnstile challenge data | DNS, DDoS protection, bot check | EU/US, under Cloudflare's EU data-processing terms and standard contractual clauses |
| Stripe Payments Europe, Ltd. | E-mail, payment details you enter on Stripe's pages | Payments, invoices | EU/US, under Stripe's data-processing agreement |
| Google LLC | Only if you choose "Sign in with Google": your Google ID, e-mail, name | Login | EU/US, standard contractual clauses |
| Brevo | E-mail address, username, and account confirmation message | Delivery of transactional account e-mails, including confirmation and registration notices | Processed to send the message, under Brevo's data-processing terms |
We share data with authorities only when the law obliges us to.
4. Cookies
Necessary cookies keep the website working. Optional analytics cookies are used only after you choose “Accept analytics”. You can reject them and continue using the site, or change your choice using “Cookie settings” in the footer:
| Cookie | Purpose | Lifetime |
|---|---|---|
pulsegto_token | Keeps you signed in | 7 days |
pulsegto_blueprint | Remembers which strategy library you selected | 1 year |
session | Sign-in with Google (state during the redirect) | Session |
Cloudflare cookies (__cf_bm and similar) | Bot protection, set by Cloudflare | Up to 30 minutes |
The desktop software stores your settings and your own solved strategies on your computer only.
Optional public website analytics
With analytics consent, we also remember the first available campaign labels (utm_source, utm_medium, utm_campaign) and referring domain in a signed first-party cookie for up to 30 days. We do not store a full referring URL or IP address in this attribution record. On account creation, including Google sign-up, this source and its recording time are linked to your account to assess registrations and trial activation by source. Existing accounts are not backfilled. The account record is included in export and removed on account deletion; rejecting analytics removes the browser attribution cookie, but does not automatically erase a source already attached to an account. Campaign labels are indicative, not independently verified.
With your analytics consent (GDPR art. 6(1)(a)), Google Analytics measures visits to public pages: page paths, browser and device information, approximate location and a cookie-based visitor identifier. Google processes connection information to provide these reports. We do not send your account ID, e-mail, solver inputs or results. Analytics page URLs omit query strings and fragments. Google signals and ad personalisation are disabled. Analytics remains off on account and solver pages.
With your separate advertising-measurement consent, the same Google tag measures successful creation of a new account as a Google Ads registration conversion (nominal measurement value 1 PLN, not a payment). Existing-account sign-ins are not conversions. Advertising storage and advertising measurement data are enabled only after this opt-in; ad personalisation stays disabled. Google may receive Google Ads click identifiers (gclid, gbraid, wbraid), connection information and an opaque, random conversion transaction identifier, but no e-mail, name, account ID or password. Only these allowlisted click parameters may be included in advertising page URLs.
Google Ads first-party _gcl_* cookies and click identifiers are retained for up to 90 days; the browser may also hold click identifiers for the current tab for up to 90 days. A signed, first-party pulsegto_ads_consent cookie records advertising consent for up to 180 days. A new-account delivery cookie, pulsegto_registration_receipt, expires within 30 minutes and is consumed once. Our server stores a one-time delivery record linked to the new account to prevent repeat conversions; it is removed when the account is deleted. Cookie settings allow you to reject both purposes, accept them separately or withdraw consent. Withdrawal removes our first-party measurement cookies and the tab's saved click identifiers; it does not undo earlier processing.
Google Ireland Limited / Google LLC provides Analytics, with processing that may occur outside the EEA under Google's applicable data-processing and transfer terms. See Google's Privacy Policy. Analytics cookies (_ga and _ga_*) expire after up to 180 days; your consent choice is stored locally for 180 days. Report retention is controlled by the Analytics property's settings. Rejecting or withdrawing consent stops our tag and removes its first-party analytics cookies. Withdrawal does not undo earlier processing.
5. Your rights
Under the GDPR you may ask for access, rectification, erasure, restriction, portability and object to processing based on legitimate interest. Two of these you can do yourself in the dashboard:
- Export — "Download my data" gives you everything we store about you as a JSON file.
- Delete — "Delete account" erases the account, licences and strategy views at once. Invoice records at Stripe are kept as long as tax law requires; they are no longer linked to an account on our side.
For anything else write to [email protected]; we answer within one month. You may also complain to a supervisory authority — in Poland the President of the Personal Data Protection Office (UODO), uodo.gov.pl, or the authority of the country where you live.
6. Security
Passwords are stored as bcrypt hashes. Traffic is encrypted (TLS). The server accepts connections only through Cloudflare, the database is not reachable from the internet, and access to the server is by SSH key from a fixed address. Licences are signed with a private key that never leaves the server.
7. Children
The Service is for adults. We do not knowingly process data of anyone under 18; if you believe we do, contact us and we will delete it.
8. Changes
We will post any change here with a new version and date, and notify registered users of material changes by e-mail or on the dashboard.