Privacy Policy
Draft, not yet in effect. Last updated 28 September 2026.
1. Who we are
PulsIoT is a service of CLS Technologies LLC, a limited liability company organized in Puerto Rico, [ADDRESS] ("PulsIoT", "we", "us").
PulsIoT helps businesses watch their commercial freezers. Wireless sensors measure the temperature of each freezer; the readings travel through a gateway to our cloud service, which scores each freezer's health and warns before it is likely to need service.
This policy explains what personal information we handle in the PulsIoT web app (app.pulsiot.ai), the phone web app (app.pulsiot.ai/m), our support, and emails the service sends. It does not cover our marketing website (pulsiot.ai), which has its own notice.
2. Our role
- For our clients' data — the sensor data, freezer information, service records and the accounts of the people the client authorizes — we act on behalf of the client. The client decides who gets an account and what is recorded. In privacy terms, the client is the controller (or "business") and we are its processor (or "service provider"). Our Data Processing Addendum with the client governs this processing. If you are a client's employee, questions about your data may also be directed to your employer.
- For our own purposes — securing the service, preventing misuse, answering support, managing our client relationship and meeting legal obligations — we decide how the data is used.
3. What we collect
| Category | What | From whom |
|---|---|---|
| Account data | Username, email address, first and last name, role (Admin, Operator or Viewer), organization, account status | The client's administrator, or you |
| Sign-in security data | Password (stored only as a one-way hash), two-step verification secret (encrypted), recovery codes (hashed), password-reset requests (hashed tokens, kept 30 days), session version | You and the system |
| Audit log | Who did what and when: sign-ins and failed sign-ins (including the username typed), changes to settings, sensors, freezers and users, alert acknowledgements, the IP address of each request | The system, when you use the apps |
| Business contact data | Organization name, address, contact email and telephone; site names and addresses; the site manager's name | The client |
| Notification data | Your email alert preferences; a record of each alert email sent or held back and to whom | You, the client and the system |
| Support data | Support tickets and messages: subject, description, category, the conversation, and who wrote each message | You |
| Service log entries | Maintenance and breakdown records typed by users; free text may include names of technicians or companies | You and other users |
| Sensor and equipment data | Temperature, battery level, signal strength, times, sensor and gateway hardware IDs (MAC addresses), gateway network address, freezer names and types, health scores, warnings | The sensors and gateways, and the client |
| Phone app device token | Only if a native phone app registers for notifications (none is distributed today): device token, platform, app version | Your device |
| Browser storage | Your session token and display preferences, kept in your own browser (see the Cookie Policy) | Your browser |
Sensor and equipment data is business data about machines, not about people. It is protected as the client's confidential data.
We do not collect: payment card data, government identifiers, precise location of individuals, health information, or browsing behaviour. We use no analytics, advertising or tracking cookies.
4. How we use it
- To provide the service: sign-in, showing freezer health and warnings, sending alert emails and daily summaries (when email is enabled for the client), exports and reports.
- To keep the service secure: two-step verification, rate limits, detecting misuse, and investigating incidents through the audit log.
- To answer support requests, including preparing proposed answers with an AI assistant (section 5).
- To improve our models, using aggregated, de-identified data that cannot be tied to a client, a site or a person.
- To meet legal obligations and to establish or defend legal claims.
We do not sell personal information, share it for cross-context advertising, or use it to build profiles of individuals.
AI features in the platform (a chat assistant, AI diagnosis and AI calibration) exist in the code but are switched off. If we switch them on, freezer data and the text you type would be sent to an AI provider; we will update this policy and tell clients first.
5. Who we share it with
We share personal information only with the service providers below, under contracts that limit their use of it, and when the law requires.
| Provider | What it does for us | Data involved | Location |
|---|---|---|---|
| Amazon Web Services (App Runner, IoT Core, Lambda, DynamoDB, S3, CloudWatch) | Runs the application, receives and stores sensor data, keeps application logs | All data processed by the service | United States (Ohio, us-east-2) |
| Amazon Simple Email Service (SES) | Sends alert and account emails — currently switched off | Recipient email addresses, alert text | United States (us-east-2) |
| Neon | Hosts the database | Account, audit, support, configuration and recent sensor data | United States (Virginia, us-east-1, on AWS) |
| Anthropic (Claude) | AI assistant used by our staff to read new support tickets with the client's sensor context and draft a proposed answer; a person reviews every draft before anything is sent | Ticket text, the client's sensor and alert summary | United States |
| Google (Workspace) | Company email, including support emails you send us | What you write to us | |
| Google Fonts | Serves the web app's typefaces; your browser connects to it directly | Your IP address and browser details | Google's servers |
We may also disclose information: to comply with law or a valid legal request; to protect the rights, safety and security of our clients, users or the company; and to a buyer or successor if the business is sold or merged, under this policy's protections.
6. How long we keep it
| Data | Period |
|---|---|
| Sensor readings in the platform | 730 days, rolling |
| Raw sensor archive (hardware IDs and readings; no names or emails) | Indefinitely |
| Audit log (including usernames and IP addresses) | About 7 years |
| Password-reset tokens | 30 days |
| Accounts, support tickets, service log, alerts and settings | While the client's contract is active; then exported and deleted under our Data Retention Policy |
Accounts that are closed are first deactivated; deletion is done by a person, on request or at the end of the client's contract. See the Data Retention Policy.
7. Security
We protect personal information with encryption in transit (HTTPS/TLS 1.2) and at rest (provider encryption; passwords hashed; two-step secrets encrypted), database-level separation of each client's data, mandatory two-step verification for administrators, session limits, rate limits and an audit log. No system is perfectly secure; if an incident affects your personal information we will notify the client and, where the law requires, you. Details are in our Cybersecurity Policy.
8. Your choices and rights
- Access and correction. You can see and change your name and preferences in the app; your organization's administrator can correct your account.
- Email alerts. You can switch alert emails on or off, and choose severities, in your notification settings.
- Copy or deletion. Write to privacy@pulsiot.ai. If your account belongs to a client, we will involve the client, because the client controls that data. We answer within [30] days. Some data may be kept where needed for security or legal reasons (for example, the audit log), and we will tell you what and why.
- We will not discriminate against you for making a request.
9. Children
PulsIoT is a business service. It is not directed at children, and we do not knowingly collect information about children.
10. Where data is kept
Data is stored and processed in the United States (AWS Ohio and Virginia regions). If you use PulsIoT from outside the United States, your information is transferred to the United States.
11. Changes
We will post any change here with a new date. For material changes we will notify client administrators by email or in the app at least [30] days before they take effect.
12. Contact
CLS Technologies LLC — PulsIoT, [ADDRESS] — privacy@pulsiot.ai.