Legal
Privacy Policy
Effective
1. Overview
This Privacy Policy explains how PulseMail collects, uses, stores, and shares personal information when you use our website, waitlist, closed beta, email client, software, and related services, together called the Services.
This Privacy Policy should be read together with our Terms of Service.
PulseMail is currently in closed beta. Some features, integrations, infrastructure, and data practices may change as we develop the product. If we make material changes to this Privacy Policy, we will update this page and, where appropriate, notify users.
2. Who we are
PulseMail is provided by CloudBridge Capital Limited, a company incorporated in Hong Kong SAR. Its registered Chinese name is 雲橋資本有限公司.
Registered address: Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong SAR.
For privacy questions or requests, use our contact form (select Privacy).
3. Information we collect
We collect information you provide, information from connected email accounts, technical information needed to operate and protect the Services, and information created when you use the Services.
3.1 Information you provide
We may collect your name, email address, login credentials or authentication information, waitlist or beta signup information, profile information you choose to provide, support messages, feedback, survey answers, interview notes, and a phone number and call preference if you ask us to contact you for research.
3.2 Waitlist and survey information
When you join the waitlist we record your email address, the time and wording of the consent you gave, the versions of this Privacy Policy and the Terms in force, how you found us (for example a referral link), and your verification status. If you later tell us your first name, whether you are open to a call, the international phone number and call method you choose, or answer survey questions, we store those answers with your waitlist record.
If you join the waitlist or answer survey questions, we collect the information you submit. Providing survey answers is optional. We use this information to understand early user needs, prioritize product development, manage beta access, and communicate with you about PulseMail.
We also record the application time, source or campaign when available, application status, the consent wording and policy versions shown to you, and whether you separately opted in to marketing. Marketing consent is not required to apply. We may still send messages needed to process an application, issue an invitation, or operate the closed beta.
3.3 Information from connected email accounts
If you connect an email account, PulseMail may process information from that account so the Services can work. This may include email messages, email headers, sender and recipient details, subject lines, dates, message IDs, thread IDs, attachments and file metadata, folder and label information, archive status, read and unread status, drafts, replies, sent messages, contacts or recipient information contained in email, and calendar or event-related information where it appears inside your email account.
We process connected email information to provide user-facing features such as inbox display, email sync, search, organization, summaries, drafting assistance, attachment handling, and context management.
Connecting an email account is voluntary, but the core email features of PulseMail cannot work without access to the email account you choose to connect.
3.4 Information collected automatically
When you use the website or Services, we may collect IP address, device type, browser type, operating system, referring pages, pages visited, approximate location derived from IP address, log data, product usage events, performance data, error reports, security logs, and cookie or similar technology data.
We use this information to operate, secure, debug, and improve the Services.
4. How we use information
We use personal information to provide, operate, maintain, and improve the Services; create and manage accounts; connect and sync email accounts; display, organize, search, and process email; generate summaries, drafts, suggestions, and other AI-assisted features; provide customer support; send beta invites, product updates, security notices, service messages, and transactional emails; monitor performance and fix bugs; detect, prevent, and investigate abuse, spam, fraud, unauthorized access, and security issues; develop new features; analyze usage trends in aggregated or de-identified form; comply with legal obligations; and enforce our Terms of Service.
5. AI-assisted features
PulseMail uses automated processing where needed to operate, secure, sync, organize, and maintain the service. Some user-facing actions may also use AI systems to assist with tasks such as summarizing, drafting, search, or organization.
For external AI processing, PulseMail currently uses OpenRouter to route requests to selected third-party model providers. A request may include the task prompt and the message content, attachment-derived text, or metadata needed for that task. Some AI features run only when you request them; others may run automatically to organize, rank, or summarize information after you enable and use the Services.
PulseMail is built to send OpenRouter requests with OpenRouter's data-collection option disabled, and to ask OpenRouter to route every AI task that may carry email content only to a model provider that offers zero data retention, failing the task rather than sending it if no such provider is available. We are still verifying that the OpenRouter account configuration and the setting on our deployed servers match this design. Until that verification is complete we do not represent zero data retention as a guarantee; treat it as a control we apply and are confirming. Fixed synthetic health checks do not include email content and may omit that routing constraint. Prompt redaction is not applied by default.
OpenRouter may retain request metadata such as timestamps, model choice, token use, and cost. A selected model provider processes the request to return a response; the zero-data-retention routing control described above is how we instruct it not to retain email-content requests. We may change selected model providers as reliability, availability, quality, and privacy requirements evolve while preserving these controls.
Not all essential automated processing can be disabled while using the Services. Optional AI assistance can be limited or unavailable during beta, and available privacy controls are described inside PulseMail.
We do not use the contents of your connected email account for advertising. We do not use connected email content to train generalized AI or machine learning models.
You are responsible for reviewing AI-generated or AI-assisted content before using, sending, or relying on it.
6. Google and Microsoft account data
If you connect a Google account, PulseMail's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
If you connect a Microsoft account, PulseMail will request only the permissions needed to provide the Services, and your use of Microsoft services remains subject to Microsoft's own terms and policies.
You can revoke access through your Google or Microsoft account settings, and you may also disconnect an account inside PulseMail where that feature is available.
7. Human access to email content
We do not allow PulseMail personnel to read the contents of your connected email account except in limited circumstances: with your explicit permission for support; to investigate security, abuse, or technical issues; to comply with law; or where necessary to protect the rights, safety, or integrity of PulseMail, users, or others.
Internal access is intended to be limited to authorized personnel and logged or controlled where technically feasible.
8. Legal bases for processing
Where the GDPR or UK GDPR applies, each purpose has its own legal basis. Providing personal information is voluntary unless a purpose cannot work without it. Open any item for the information used, why we use it, and what happens if you do not provide it. Where consent is the basis, you can withdraw it at any time without affecting what happened before.
Information we use
Email address, name if you provide it, and application and verification records.
Why we use it
To send verification codes, confirm your application, and provide waitlist or invitation updates you asked for. The legal basis is taking steps at your request before providing the beta service.
Your choice
We cannot run your waitlist application without an email address. You do not need to provide a name.
Information we use
Survey answers, signals derived from those answers such as inbox count and email provider, and a fit score.
Why we use it
Our legitimate interest is inviting people the closed beta can serve first and learning which needs to prioritize during product development.
Your choice
Answering the survey is optional. A team member can review or change the result, and you can ask us to explain or reconsider it.
Information we use
First name, international phone number, regular or WhatsApp call choice, and the time you opted in.
Why we use it
Your consent, given when you choose yes and provide the call details.
Your choice
You can decline or withdraw later. If you withdraw, we clear the phone number and call method from the active waitlist record.
Information we use
Email address and first name if you provide one.
Why we use it
Your consent, recorded with the wording you saw when you selected the optional product-news box.
Your choice
You can withdraw at any time. This stops product news and does not remove you from the waitlist.
Information we use
Email address, message, topic, and name if you provide it.
Why we use it
Our legitimate interest in answering you, or taking steps you request where the message concerns an account or service.
Your choice
We cannot answer without an email address and a message. You do not need to provide a name.
Information we use
IP address and browser signals processed by Cloudflare Turnstile, plus delivery events returned by our email provider.
Why we use it
Our legitimate interests in preventing automated abuse, keeping the service secure, confirming delivery, and honoring unsubscribes and holds.
Your choice
These checks and records are necessary to use the affected forms and communications safely.
Information we use
Account data and connected mailbox content described in sections 3, 5, 6 and 7.
Why we use it
To connect and sync the account you choose, provide mailbox features, and carry out features you request. The legal basis is performing our agreement with you or taking steps at your request. We rely on consent only for a feature that is separately offered on that basis.
Your choice
You can use the website and waitlist without connecting an inbox. The application cannot provide mailbox features without a connected account. Optional features can remain disabled.
Information we use
Public page paths, predefined application-step events, broad traffic-source categories and basic technical request information. Temporary technical identifiers help process measurement requests; they are not joined to your PulseMail account or waitlist identity.
Why we use it
With your consent, we measure website use and application steps to understand acquisition and improve the waitlist experience. This is separate from processing your application and from product-news consent.
Your choice
Measurement starts only after you allow it. You can decline or stop future collection through Analytics preferences, without affecting your application. We do not replay activity from before your choice.
Information we use
The records needed for the relevant obligation.
Why we use it
To meet legal, tax and accounting obligations and respond to valid legal requests.
Your choice
We process these records only where the law requires it.
Invitation prioritisation. We use a score from survey answers to help decide invitation order. It can affect when you are invited. A team member can review or change the result. You can ask us to explain or reconsider it through our contact form.
9. How we share information
We do not sell your email content.
We share personal information with service providers when they are needed to run, protect or support a feature, and with other recipients when you direct us, a transaction requires it, or the law permits or requires it. Open an item below for the providers and information involved.
Contabo GmbH hosts the application, databases, attachment storage and our Matomo analytics service. Resend (Plus Five Five, Inc., United States) delivers verification codes, waitlist and system messages and returns delivery, bounce and complaint signals.
Cloudflare (Cloudflare, Inc., United States) provides DNS and protects forms with Turnstile. Turnstile processes limited browser and connection information, such as IP address, browser characteristics and the site key, to distinguish people from bots. Cloudflare acts as our processor for that protection and as an independent controller when improving Turnstile, as described in its Turnstile Privacy Addendum. We do not use Turnstile to track you across sites.
Sentry (Functional Software, Inc., United States) receives server error reports. We configure it to omit mailbox content and minimize identifiers, but technical information such as route, release, IP address or stack details may still be processed.
OpenRouter and the model provider selected for a task receive the prompt and the message content, attachment-derived text or metadata needed to return the requested result. Section 5 explains the routing, retention controls and current verification limits.
When you connect Google, Microsoft or another supported email service, we exchange information with that provider as needed to sync, send, receive, display, search and manage your email.
Logo.dev and Brandfetch may receive a correspondent's email domain, and Gravatar may receive a hashed form of a correspondent's email address, to show a logo or avatar. We are reviewing these lookups as part of our data-minimisation work and may remove them.
WhatsApp Ireland Limited serves people in the European Region and WhatsApp LLC serves people elsewhere. If you choose a WhatsApp call, WhatsApp receives the number you provided so we can place that call. We do not use it for WhatsApp marketing. A regular phone call does not disclose your number to WhatsApp.
We may also disclose information where reasonably necessary to comply with law or a valid government request, enforce our Terms, protect rights or safety, or investigate fraud, abuse, security issues or technical problems.
If PulseMail is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, personal information may be transferred as part of that transaction, subject to appropriate safeguards where required.
We may also share information with your consent or at your direction.
10. Cookies and analytics
We use self-hosted Matomo to understand how people use this website and to improve the waitlist application process. It measures website page views and application steps, such as requesting a verification email and completing the optional survey.
Optional website measurement starts only if you allow it. You can change your choice in Analytics preferences without affecting your waitlist application.
We use browser storage for security, forms, beta or signed-in access, and to remember your measurement choice in this browser. That choice records the purpose version, decision and time, not a visitor identifier. Website measurement uses no analytics cookies, advertising trackers or cross-site tracking. We disable browser feature detection, mask the request address Matomo receives and use randomized request identifiers. Our hosting and security services still process connection information as described above.
Cross-site tracking. We do not track visitors across other websites or allow other parties to collect activity on this site for their own advertising purposes.
11. Data retention
We keep personal information only as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and protect the Services.
Raw website-measurement records in the live analytics database are scheduled for deletion after 30 days, and aggregate reports after 12 months. Automated deletion follows calendar cutoffs and scheduled processing, which can add a short delay. These measurement records are separate from your waitlist application.
For the website: waitlist records, survey answers, call-contact details and consent evidence are kept while you remain on the waitlist and for up to 24 months after your last interaction with us, or until you ask us to delete them. If you withdraw your request for a call, we clear the phone number and call method from the active waitlist record. Contact form submissions are kept for up to 24 months. We run a periodic retention sweep that removes records past these limits. When you unsubscribe or ask us to delete you, we keep a minimal record that the address must not be emailed again, so that a later mistake cannot bring it back onto a list.
PulseMail provides in-app controls to disconnect an inbox, to reset imported mailbox data, and to delete your account. Disconnecting an inbox stops new access but does not by itself remove data already processed, and it does not revoke the permission you granted at your email provider; you can revoke that in your Google or Microsoft account settings. Deleting your account removes your account, connected inboxes, stored mail and files from our live systems; copies in backups are removed as the backups rotate out. You can also use the privacy contact form to request access, correction, deletion, or a copy of your information. We will delete or de-identify data within a reasonable period where applicable, but security logs, legal records and fraud-prevention records may remain for limited operational retention periods.
Website database backups are encrypted and kept for a short rolling period. Copies are removed as the backups rotate out. The application describes its own backup and deletion behavior inside PulseMail.
12. Security
We use reasonable technical, organizational, and administrative measures designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. These measures may include encryption in transit, access controls, logging, monitoring, secure authentication, and limited internal access.
No system is perfectly secure. We cannot guarantee absolute security, and users are responsible for keeping account credentials and devices secure.
13. International data transfers
Some providers and CloudBridge process information outside the country where you live. Where European or UK transfer rules apply, we use or are completing the provider's recognized transfer mechanism and other appropriate safeguards. The current arrangements and any verification still in progress are set out below.
Contabo's network records place the waitlist servers in the European Union, but we are confirming the exact data-centre region in the provider account. CloudBridge Capital Limited operates from Hong Kong and accesses that data there. Hong Kong has no European adequacy decision, so this is a transfer under European data protection law. The Contabo data processing agreement and the Standard Contractual Clauses it offers are being concluded and this notice will be updated when that is complete.
Resend relies on its certification under the EU-U.S. Data Privacy Framework and its UK Extension, with the Standard Contractual Clauses and UK International Data Transfer Addendum in its data processing agreement as fallbacks. Cloudflare's data processing addendum includes the Standard Contractual Clauses. Section 5 explains the controls that apply when an AI task is routed to a model provider. We are still collecting the account-level transfer and retention records for every provider used in the closed beta.
WhatsApp's business data transfer terms use the EU-U.S. Data Privacy Framework and, where needed, Standard Contractual Clauses. A regular phone call does not disclose your number to WhatsApp.
14. Your choices and rights
Depending on where you live, you may have the right to access your personal information and receive a copy; to correct it; to have it deleted; to restrict or object to processing, including an absolute right to object to direct marketing; to receive the information you gave us in a portable, machine-readable form; to withdraw consent at any time where consent is the basis, without affecting processing before the withdrawal (withdrawing marketing consent stops product news and nothing else); not to be subject to a decision based solely on automated processing with legal or similarly significant effects (invitation ordering is reviewed by a person, as section 8 explains); and to lodge a complaint with a data protection authority, for example the Office of the Privacy Commissioner for Personal Data in Hong Kong, the authority in the EU country where you live, or the UK Information Commissioner.
For the waitlist, an email address is required. Your name, survey answers, call details and product-news choice are optional. In the app, an account connection is required for mailbox features. Section 8 explains what each choice affects.
To exercise rights, use our contact form (select Privacy). We may need to verify your identity before responding to a request. Waitlist members can also change product-news consent or leave the waitlist directly from the preferences link in any email we send.
15. Waitlist and marketing communications
When you join the waitlist we email you what the waitlist needs: verification codes, confirmation of your application, and messages about your place on the waitlist and beta access. These are service messages and do not require separate consent.
Product news is sent only if you tick the optional box on the signup form, on the completion step or in the preference centre. CloudBridge Capital Limited, trading as PulseMail, then uses your email address and any first name you provide to send product updates, build notes and early-access opportunities, at most twice in any rolling 30-day period. We do not use open or click tracking. Joining the waitlist never depends on this choice. Every product-news message has a one-click unsubscribe link, and the preference centre lets you change your choice at any time. We record the wording you saw, when and where you selected it, the policy version in force, and any later withdrawal. Withdrawing stops product news but does not remove you from the waitlist.
We may still send messages needed to operate the Services, such as verification codes, security alerts, account notices, invitation emails and other transactional messages.
16. Children
The closed beta is for adults. Do not apply or connect an account if you are under 18 or below the age of majority where you live. If you believe a child has provided personal information, contact us so we can take appropriate action.
17. Sensitive information
Email may contain sensitive information. We process it only to provide and protect the Services, subject to the controls in this notice. Do not use the closed beta for workloads subject to sector-specific or professional-secrecy requirements unless we agree in writing.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the Last updated date and, where appropriate, provide additional notice.
19. Contact
For privacy questions or requests, use our contact form (select Privacy).