Zum Inhalt springen
Public Pulse
Demo buchenDemo
Public Pulse legal

Privacy Policy

Last updated

Public Pulse Pty Ltd (ACN 668 509 019, ABN 90 668 509 019) (“we”, “us”, “our”, “Company”) is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, store, and safeguard your personal information when you visit our website or use our platform (collectively, the “Platform”).

We are bound by the Privacy Act 1988 (Cth) (the “Privacy Act”) and the Australian Privacy Principles (“APPs”) contained therein. We are committed to handling your personal information in accordance with the Privacy Act and the APPs.

2.1 Types of Information Collected

We collect personal information that is reasonably necessary for our functions, including:

  • Identity Data: Full name, job title, role, username, or similar identifiers.
  • Contact Data: Email address, telephone number, and postal address.
  • Account Credentials: Username, password (encrypted), and authentication data.
  • Constituent Data: Information uploaded by you regarding your constituents (e.g., names, addresses, correspondence history). This may include Sensitive Information within the meaning of the Privacy Act (such as political opinions or affiliations).
  • Technical Data: IP address, browser type, time zone, and device information.
  • Usage Data: Information about how you use and interact with our Platform.
  • Communications Data: Records of your communications with us.
  • Payment Information: Billing address and payment method details (processed by our third-party payment processor).

2.2 Methods of Collection

We collect personal information:

  • Directly from you: When you register, subscribe, complete forms, or contact support.
  • Automatically: Through cookies, server logs, and similar technologies as you navigate the Platform.
  • From third parties: Including payment processors, authentication providers (Google, Microsoft), and analytics providers.

2.3 Sensitive Information

Some Constituent Data may constitute Sensitive Information under the Privacy Act, such as information about political opinions or affiliations. We collect Sensitive Information only where the individual has consented to its collection, or where its collection is otherwise required or authorised by or under law. Where our customers upload Constituent Data to the Platform, the customer is responsible for ensuring it has the necessary consents or another lawful basis to provide that information to us for processing. We handle Sensitive Information only for the purposes for which it was collected and with the heightened protections the Privacy Act requires.

3.1 Primary Purposes

  • Service Provision: To provide, operate, maintain, secure, and improve the Platform.
  • Account Management: To create and manage your account and subscriptions.
  • Customer Support: To respond to enquiries and provide technical support.
  • Billing and Payment: To process payments and manage billing.
  • Security: To detect, prevent, and respond to fraud and security incidents.
  • Legal Compliance: To comply with applicable laws and regulations.

3.2 AI and Machine Learning

We use anonymised and aggregated usage data (including interactions with AI features) to train, test, and improve our AI and machine learning models. We do not use identifiable Customer Data to train general-purpose public AI models without your prior express written consent.

We may disclose your personal information to:

  • Service Providers: Including Supabase (hosting, Australia/AWS Sydney region), Cloudflare (CDN), OpenAI and Google Cloud Vertex AI (AI processing), Twilio SendGrid (email delivery), Sentry and Datadog (error tracking and operational monitoring), and analytics providers. A current list of our subprocessors is maintained in our Trust Center.
  • Professional Advisers: Lawyers, accountants, auditors, and insurers.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets.
  • Legal Authorities: When required by law or to protect rights and safety.

5.1 Primary Data Storage

We primarily host and store your data in Australia, using Supabase with underlying infrastructure provided by Amazon Web Services (AWS) in the Sydney region.

5.2 Overseas Disclosures

Some of our Service Providers are located overseas, including in the United States (OpenAI, Google, Cloudflare, Twilio SendGrid, Sentry, Datadog). When we transfer personal information overseas, we take reasonable steps to ensure that the overseas recipient protects the information in a way that is substantially similar to the APPs.

We implement and maintain appropriate technical and organisational security measures, including:

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
  • Role-based access controls (RBAC)
  • Multi-factor authentication (MFA) for administrative accounts
  • Regular security assessments and penetration testing
  • Comprehensive audit logging and monitoring
  • Incident response plan for security breaches

In the event of a data breach that is likely to result in serious harm, we will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC).

Under the Privacy Act, you have the right to:

  • Request access to the personal information we hold about you.
  • Request correction of inaccurate, out of date, incomplete, or misleading information.
  • Request deletion of your personal information in certain circumstances.

To exercise these rights, contact us using the details in Section 16. We will respond within 30 days.

  • Account Data: Retained for the duration of your account plus up to 7 years for compliance purposes.
  • Customer Data: Retained for 30 days after termination to allow data export, then securely deleted.
  • Usage Data: Retained for up to 2 years for analytics, or longer if aggregated and de-identified.
  • Payment Data: Retained for 7 years for taxation and financial record-keeping.

A parliamentary office can connect its Facebook Page, Instagram professional account or WhatsApp business number to Public Pulse so its staff can read and answer constituent messages from one inbox. This section explains what that connection stores and how it is removed.

10.1 What we store when an office connects

  • The Page or account itself: the Page id, the Page name, the Page avatar, and the Page access token Meta issues for it. The token is encrypted at rest and is used only to receive and send messages on the Page’s behalf. For WhatsApp, the equivalent is the business phone number id, its display name and its access token.
  • Not the person who signed in: Facebook Login is used only to list the Pages an administrator manages and to obtain the Page token. We do not keep the administrator’s Facebook user id, profile, friends or email from that sign-in.

10.2 What we store from constituents who message the office

  • The sender’s platform-scoped id (a Page-scoped Messenger id, an Instagram-scoped id or a WhatsApp number), display name and, where Meta provides one, profile picture.
  • The messages exchanged with the office, including attachments, which are copied into the office’s Public Pulse storage so they remain available if Meta expires the original media link.
  • Delivery, read and reaction signals for those messages.

This is Constituent Data under Section 2.1: it is held for the office that received it, under the office’s control, and is not used to train general-purpose AI models.

10.3 Retention

Page and account data is kept while the Page is connected. Removing the Page deletes its access token immediately. Synced conversations are kept as part of the office’s correspondence record under the Customer Data retention in Section 9, and an organisation administrator can permanently delete a removed Page’s synced conversations from Public Pulse at the time of removal.

10.4 How to request deletion

  • Office administrators: open Settings in Public Pulse, select the connected Page or number, and choose Remove. The purge option on that screen also deletes the synced conversations.
  • Through Meta: removing Public Pulse from your Facebook account settings, or submitting a data deletion request there, notifies us automatically. Meta gives you a confirmation code and a link to our data deletion status page, where you can check the outcome.
  • Constituents: messages you sent to an office are held by that office. You can ask the office directly, or contact our Privacy Officer using the details in Section 16 and we will coordinate with the office.

We use cookies and similar technologies to operate the Platform:

  • Essential cookies: Required for the Platform to function, including authentication, session management, and security. These cannot be disabled.
  • Analytics cookies: Help us understand how the Platform is used, such as pages visited and features accessed, so we can improve it. Analytics data is aggregated wherever possible.

On this website, optional analytics and support services load only after you enable their categories. Analytics includes Vercel Web Analytics and Speed Insights, and Google Analytics and Microsoft Clarity where configured. Optional support messaging is provided by Intercom. We do not currently load targeted advertising tags.

Use to accept, reject or change these choices. We remember your preference in this browser for 180 days. Withdrawing permission stops the related services, clears their known first-party cookies where accessible, and refreshes the page. These website preferences do not change your signed-in workspace or its authentication cookies.

You can control or delete cookies through your browser settings. Blocking essential cookies may prevent parts of the Platform, including sign-in, from working.

The Platform may contain links to third-party websites. We are not responsible for the privacy practices of third-party websites.

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and, where appropriate, by email notification.

If you have a complaint about our handling of your personal information, please contact our Privacy Officer. We will acknowledge your complaint within 7 days and provide a written response within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992
  • Email: enquiries@oaic.gov.au

If you have any questions or requests regarding this Privacy Policy, please contact our Privacy Officer:

Public Pulse Pty Ltd
Privacy Officer Email: privacy@publicpulse.com
General Email: legal@publicpulse.com
Address: 81-83 Campbell Street, Surry Hills, NSW 2010, Australia
ABN: 90 668 509 019
ACN: 668 509 019

Back to top ↑