Privacy Policy

InnoStak Pulse ("Pulse") is a website and app monitoring service run by RealTek Automation LLC, a Texas limited liability company doing business as "InnoStak" ("InnoStak", "we", "us"), based in Spring, Texas, USA. This policy explains how we handle personal information when you visit our website, use the free website health check, sign up for Pulse or use the app at http://pulse.innostak.com/. InnoStak's company website (https://www.innostak.com) and InnoStak's other services are covered by InnoStak's company privacy policy.

Pulse is for businesses only. Accounts are for people aged 18 or older who use Pulse on behalf of a business.

Controller and processor

• We are the controller (the "business" under California law) for account data, billing data, website and free-tool data, and communications with you. We decide how and why that data is used.
• We are a processor (a "service provider" or "processor" under US state laws) for customer monitoring data: the check results, provider data, incidents and reports we produce for your workspace. Your business is the controller of that data, and we handle it only to provide Pulse to you, under our Terms of Service and the data processing terms summarized below.

If you are a client of an agency that uses Pulse, the agency decides what is monitored and who can see it. Please contact the agency first about data in its workspace. We'll help them respond.

Information you give us

• Account details: your name, business email address, company name and role.
• Sign-in and security data: password (stored by Supabase Auth as a secure hash, never readable by us), sessions, and a sign-in history (time, IP address and browser) used to keep accounts secure.
• Team and client details: people you invite, their email addresses and roles, and the organizations and projects you set up.
• Monitoring setup: the URLs you ask us to check, alert preferences, quiet hours and time zone.
• Phone number, if you opt in to SMS alerts, with a record of your consent.
• Messages you send us, such as support requests and feedback.

Information from services you connect

• When you connect Vercel or Supabase, you authorize access through their own sign-in (OAuth) screens. We receive access tokens, which we encrypt before storing, and we collect project metadata, deployment information, health and usage metrics that the provider makes available to your plan.
• Provider data can include limited personal information, such as the names or email addresses of people on your provider team, or log lines that happen to contain personal data. We redact provider payloads where we can and keep detailed payloads for only 7 days.
• Billing information from Stripe, such as subscription status, invoices and the last four digits of your card. Stripe holds your full card details. We never store card numbers.

Information we create while monitoring

• HTTPS check results: status codes, response times, certificate details, redirects and security headers. We don't store full page contents with every check.
• Incidents, acknowledgments, alert delivery records and AI reports built from that evidence.
• Audit records of important actions in your workspace, including any read-only support access by InnoStak staff.

Information collected automatically

• Technical data needed to run and secure the service, such as IP address, browser type, request logs and error logs. Our hosting provider processes these as part of serving the site.
• The cookies listed in our Cookie Policy. Today these are strictly necessary cookies only; we don't use analytics, marketing or functionality cookies.

The free website health check

When you use the free health check, we process the URL you submit to run the test and show you the result. We don't store the result. To prevent abuse, we count requests per visitor using a keyed hash (HMAC) of your IP address, never the raw IP, plus the target hostname, in short 10-minute windows.

Optional features (rolling out after the pilot)

• Visitor page-speed telemetry: if a customer chooses to add our snippet to their site, it sends page performance measurements to Pulse. It is designed to scrub personal data, cookies, tokens, form contents and payment data before anything is stored. The customer is responsible for telling their own visitors about it.
• Database performance statistics: a customer may give Pulse a limited database login with the pg_monitor role, which reads performance statistics only. It is never used to read the customer's own records.

We don't ask for, and ask you not to send us, sensitive personal information such as health data, government ID numbers or financial account numbers.

The table below explains what we use information for. The legal bases column applies where the EU or UK GDPR applies.

We don't use personal information to make decisions that have legal or similarly significant effects on you based solely on automated processing.

We share personal information only in these situations:

• With service providers (subprocessors) that help us run Pulse, listed in the table below. They may use the data only to provide their services to us, under contract.
• Within your workspace: people in your workspace, and agency client users, see the data their role allows.
• With the providers you connect (like Vercel or Supabase) when Pulse reads from them on your behalf.
• If the law requires it, or to protect the rights, safety or security of our customers, users, the public or InnoStak. Where allowed, we'll tell the affected customer first.
• As part of a merger, acquisition or sale of assets, in which case this policy continues to protect your information.

Our subprocessors

Each provider's own terms govern its services. Where a provider offers data processing terms, we put them in place.

We do not sell or rent personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA, as amended by the CPRA) and similar state laws. We have not done so in the past 12 months. We don't use targeted advertising, and we don't knowingly sell the personal information of anyone under 16.

Global Privacy Control

We honor the Global Privacy Control (GPC) browser signal as a valid request to opt out of sale, sharing and targeted advertising for that browser, and our cookie tool keeps Marketing & targeting cookies off. Because we don't sell or share today, you don't need to do anything, but the signal will keep working if our practices ever change.

Sensitive personal information

The only sensitive personal information we handle is your account login and password, used solely to let you sign in. We don't use or disclose sensitive personal information for any purpose that would give you a right to limit it under California law.

We keep information only as long as necessary to provide Pulse, meet our legal and compliance obligations, maintain service quality and resolve disputes. You may ask us to delete specific data at any time, unless a legal obligation requires us to keep it. These are our default retention periods:

Deleting your account

When a workspace owner deletes a workspace or account, we stop monitoring, revoke connected-provider tokens where the provider allows, and hold the data for a 30-day recovery period in case the deletion was a mistake. After that, we delete it. We keep only the minimal audit and billing records that the law or legitimate record-keeping requires.

Our backups are encrypted and roll off on their own schedule. Deleted data may remain in backups until they expire. We don't restore deleted data from backups except to recover from a disaster, and we delete it again if we do.

Before you delete, owners can export their workspace data. Exports are delivered through short-lived private links.

We use industry-standard security measures, including encryption, firewalls and access controls, to protect your data. Pulse is designed with these safeguards:

• Tenant isolation: row-level security in the database keeps each workspace's data separate, and agency client users see only their own organization or projects.
• Encrypted provider credentials: access tokens are encrypted by the application before they're stored, with the key kept outside the database.
• Staff controls: InnoStak staff must use multi-factor authentication. Support access to a customer's dashboard is read-only, time-limited, tied to a reason and recorded in the audit log.
• Encryption in transit (HTTPS) and encrypted backups.
• Least-privilege access to connected providers: we request the narrowest access each provider offers and tell you when it's broader than read-only.

No system is perfectly secure, and we can't guarantee that information will never be accessed without authorization. Pulse is not currently SOC 2 or ISO 27001 certified. Read more on our Security page.

If something goes wrong

If we learn of a security breach affecting your personal information or your monitoring data, we will notify affected customers, individuals and regulators as the applicable law requires, and without undue delay. For monitoring data we process for you, we'll notify your business so it can meet its own obligations.

InnoStak is based in the United States, and Pulse and its subprocessors process data in the United States. If you use Pulse from outside the US, your information will be transferred to, and processed in, the US, where privacy laws may differ from those in your country.

InnoStak is not certified under the EU–US Data Privacy Framework or its UK extension. For personal data transferred from the European Economic Area, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (SCCs), with the UK International Data Transfer Addendum where needed, together with our security measures. You can ask us for a copy of the relevant safeguards. [Attorney to confirm: SCCs as the transfer mechanism, module selection, and whether to pursue Data Privacy Framework certification]

Whatever the law in your location requires, we offer the rights below to all users. Some laws exempt business-contact or employee data; we choose to honor these requests anyway where we reasonably can. We aim to respond to every request within 30 days. The deadlines below are the longest your law allows, and we'll tell you if we need that extra time.

Everyone

• Access: ask what personal information we hold about you and get a copy.
• Correction: fix information that is wrong or incomplete. You can edit most account details yourself in the app.
• Deletion: ask us to delete your personal information, subject to the exceptions the law allows (for example, records we must keep for tax purposes).
• Portability: get your information in a commonly used, machine-readable format.
• Opt out of marketing email at any time using the unsubscribe link.
• Withdraw consent, for example for SMS alerts, at any time. This doesn't affect processing that already happened.

EU and UK residents (GDPR)

• All of the rights above, plus the right to object to processing based on legitimate interests and to restrict processing in certain cases.
• The right to complain to your local data protection authority, such as your EU supervisory authority or the UK Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to fix things first, so please contact us; we'll acknowledge a complaint within 30 days.
• We respond within one month, which the law allows us to extend by up to two more months for complex requests. We'll tell you if we need to.

California residents (CCPA/CPRA)

In the past 12 months we have collected these categories of personal information, from you, from services you connect and from your use of Pulse: identifiers (name, email, IP address); commercial information (subscription and billing records); internet or network activity (logs and usage of the service); professional information (company and role); and account login credentials (sensitive personal information, used only to sign you in). We use them for the business purposes in the table above, disclose them to the service providers listed above, and keep them for the periods shown in the retention section. We don't sell or share any of them.

• Right to know what personal information we collect, use and disclose, and to get a copy.
• Right to delete and right to correct.
• Right to opt out of sale or sharing (we don't sell or share) and to limit use of sensitive personal information (we only use it as the law permits).
• Right not to be discriminated against for using any of these rights. We won't deny service, charge different prices or provide a different quality of service because you exercised them.

We confirm receipt within 10 business days and respond within 45 days. If we need more time, up to 45 more days, we'll tell you why.

Residents of other US states

Several states give their residents similar rights, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Depending on your state, these include the rights to confirm whether we process your data, access, correct, delete and port it, and opt out of sale, targeted advertising and significant profiling. Some states also let you ask for a list of the specific third parties we've disclosed data to. We don't sell data, use targeted advertising or profile people in ways that produce legal or similarly significant effects.

We respond within 45 days, and may extend by another 45 days where reasonably necessary, telling you why. If we decline your request, we'll explain why and how to appeal.

Texas residents

Under the Texas Data Privacy and Security Act, you have the rights described above. We respond within 45 days (extendable once by 45 days). If we deny your request, you may appeal, and we'll answer the appeal in writing within 60 days. If we deny your appeal, you can file a complaint with the Texas Attorney General at texasattorneygeneral.gov. We don't sell sensitive personal data, and we don't sell any personal data.

1. 1Email support@innostak.com from the email address on your account, and tell us which right you want to use. There's no charge.
2. 2We verify your identity by matching your request to your account, usually by confirming it from your account email. For sensitive requests we may ask for more. We use the information you give us for verification only.
3. 3We respond within the time your law allows (see above). Where the monitoring data belongs to a customer's workspace, we may pass your request to that customer and help them respond.

Authorized agents

You can have someone else make a request for you. We'll ask the agent for your signed permission, and we may ask you to confirm your identity with us directly, unless the agent holds a valid power of attorney.

Appeals

If we decline your request, you can appeal by replying to our decision or emailing support@innostak.com with "Privacy appeal" in the subject line. Someone who wasn't involved in the original decision will review it, and we'll answer in writing within 60 days (or sooner where your law requires), including how to contact your state attorney general if you disagree.

When we process customer monitoring data for your business, these commitments apply. They form part of our Terms of Service. A full Data Processing Addendum is available on request, and it controls if it conflicts with this summary. [Attorney to confirm: whether to publish the full DPA and how it is accepted]

• We process customer monitoring data only on your documented instructions, which are your use of Pulse and your settings, and only to provide the service.
• We don't sell or share it, keep it for other purposes, or combine it with other data except as the law permits a service provider to.
• Our staff and subprocessors are bound by confidentiality, and staff support access is read-only and audited.
• We use the security measures described in this policy and on our Security page.
• We use the subprocessors listed above under written terms, and we'll give customers notice of new subprocessors (by updating this list and, for material changes, by email) so they can object.
• We help you respond to data subject requests and, where relevant, with data protection impact assessments.
• We notify you without undue delay after becoming aware of a personal data breach affecting your monitoring data.
• At the end of the service, we delete or return customer data as described in the retention section, except where the law requires us to keep it.
• International transfers use the safeguards described above.
• We give you the information reasonably needed to show that we meet these commitments.

Our cookie settings use four categories: Strictly necessary (always on), Analytics & performance, Marketing & targeting, and Functionality. Today we use only strictly necessary cookies: to keep you signed in, remember your selected workspace and remember your cookie choice. The optional categories are off by default, and we'd place such cookies only after you give explicit consent. You can change your choice at any time with the "Cookie settings" link in the footer. The Pulse status widget that customers embed on their sites shows public status only and is designed to set no tracking cookies. Details are in our Cookie Policy.

Pulse is a business service for adults. It is not directed to children, and you must be 18 or older to use it. We don't knowingly collect personal information from children under 13 (or under 16 where local law sets a higher age). If we learn that a child has given us personal information, we'll delete it promptly. Please contact us if you believe this has happened.

Email

We send transactional and operational emails, such as sign-in links, invitations, incident and recovery alerts, reports and billing notices. These are part of the service, so you can't unsubscribe from them while you have an account, but you can adjust alert settings in the app. If we send marketing email, it will identify us, include our postal address and have a working unsubscribe link, and we'll honor unsubscribes promptly, as the CAN-SPAM Act requires.

SMS alerts

• SMS is off unless you turn it on. We send texts only to numbers you verify and only after you give express consent.
• Texts are operational alerts about your monitors and incidents. We never send marketing texts.
• Reply STOP to opt out at any time, or turn SMS off in the app. Reply HELP for help. We honor opt-outs made by any reasonable means.
• Message frequency varies with your alert settings and incidents. Message and data rates may apply.
• We keep records of your consent and opt-outs. Mobile numbers and consent are not shared with third parties for their marketing.

Pulse uses an AI model provider to write health reports and answer questions about your monitoring data. Here's how that works:

• Pulse calculates metrics first, then sends the AI only bounded, redacted evidence from the time period in question, scoped to what the requesting user is allowed to see.
• We never send passwords, provider tokens or payment data to the AI provider.
• The provider processes the data under contract to generate the response. We configure providers not to use your data for training where that option is offered.
• The AI can't take actions, change your systems or read other customers' data.
• AI output can be wrong. Reports link claims to evidence so you can check them. See our Terms of Service.

Our website, app, emails and reports may link to third-party sites and services, such as provider dashboards, documentation or Stripe's billing pages. We don't control their privacy practices, and this policy doesn't cover them. Please read their privacy policies.

We'll update this policy as Pulse and the law change, and update the "Last updated" date at the top. If we make a material change, we'll notify account owners by email or in the app before it takes effect. We won't use personal information in a materially different way from what we told you when we collected it without notice and, where the law requires, your consent.

For privacy questions, requests and complaints, email support@innostak.com or call 346-480-7666. Please send rights requests by email so we can verify them against your account.

RealTek Automation LLC, doing business as InnoStak. Spring, Texas, USA.