Privacy policy

Who we are

The data controller for the personal data collected through Pulzeo is:

• Ecom Liberty, a company registered in Mauritius, BRN I21008419
• Royal Road, Les Terrasses du Barachois, 90901, Tamarin, Mauritius
• DPO / GDPR email: privacy@pulzeo.com

Although Ecom Liberty is based in Mauritius (and therefore subject to the Mauritius Data Protection Act 2017), we also apply the General Data Protection Regulation (GDPR) whenever we process the data of residents of the European Economic Area.

Representative in the European Union

Ecom Liberty is established outside the European Economic Area (Mauritius). At this time, Pulzeo has not appointed a representative in the European Union within the meaning of Article 27 of the GDPR, under the exemption in Article 27.2.a (occasional processing, not including special categories of data or criminal conviction data on a large scale, and unlikely to result in a high risk to the rights and freedoms of the data subjects).

This analysis is based on the following:

• Pulzeo is a strictly B2B service for digital marketing professionals (agencies, freelancers, advertisers). It is not offered to consumers.
• Processing the data of EU residents is occasional relative to Ecom Liberty’s overall activity and does not amount to regular, systematic monitoring of data subjects’ behavior.
• Pulzeo does not process any special category of data within the meaning of Article 9 of the GDPR (health, political opinions, biometric data, sexual orientation, and so on), or any data relating to criminal convictions or offenses (Art. 10).
• Given the nature, scope, context and purposes of the processing, the risk to data subjects’ rights and freedoms is assessed as low.

This position is reassessed whenever the service changes significantly. Should Pulzeo’s scope widen (opening the service to consumers, advertising profiling features, processing of special categories of data, significant growth in EU user numbers), an EU representative would be formally appointed under Article 27 of the GDPR and this policy updated accordingly.

In the meantime, data subjects residing in the European Union can exercise all of their rights directly with our GDPR point of contact listed at the top of this policy. They also retain the right to lodge a complaint with the supervisory authority of their country of residence (in France, the CNIL).

Data we collect

Account information

• Email address (needed to create an account and to sign in)
• Password (hashed with a robust one-way function, never stored in cleartext), only if you create your account with an email and password
• Sign in with Google (optional): if you choose to sign up or sign in through your Google account, we receive from Google your email address, your name and basic profile picture, and a Google account identifier (the openid, email and profile scopes). This information is used only to create and identify your Pulzeo account. Signing in with Google does not grant any access to your Google Ads or Google Tag Manager accounts, which are connected separately and explicitly (see the next section).
• Organization name (defaults to your email address and can be changed)
• Display preferences (light or dark theme, language, time zone)

Billing information

• For paid plans: name, billing address, payment details (processed exclusively by Stripe; we do not store any card data).
• The Stripe customer identifier linked to your organization.

Technical data

• IP address, to rate-limit requests and detect abuse. It is never linked to an advertising profile.
• Browser and operating system, to diagnose display problems.
• Application error logs, from which credentials and secrets are stripped before anything is recorded.
• Where your visit came from: how you reached the site (search engine, social network, ad, article), determined from the page URL and the referring site. This tells us which channels help people discover Pulzeo. It contains no identifier and is linked to your account only when you sign up. The cookies involved and their lifetimes are described in our cookie policy.
• Your optional answer to the question “How did you hear about Pulzeo?”, asked when the account is created.

Google Ads data accessed through OAuth

Pulzeo connects to your Google Ads account through Google’s OAuth 2.0 mechanism. You explicitly authorize us to access your account and can revoke that authorization at any time from your Google account.

Google permissions requested

Pulzeo performs no write action unless you explicitly trigger it. Every write action is preceded by your confirmation and recorded in our logs. Details on each permission can be expanded below.

• .../auth/adwords: read and write access to your Google Ads accounts
  Why this permission

  The Google Ads API does not offer a read-only scope; this single scope covers both modes of access.

  Read access: syncing accounts, campaigns, ad groups, ads, keywords and performance metrics to populate the dashboard, reports and analyses.

  Write access, only when you initiate it: pausing or resuming keywords and campaigns, adjusting budgets, and applying recommendations from our Zeo assistant.

• .../auth/tagmanager.edit.containers: creating conversion tags (optional)
  Why this permission

  Creating and updating conversion tags and triggers in your Google Tag Manager container (through the setup assistant), and reading your accounts and containers so you can choose the right one. Enabled only if you start this flow.

• .../auth/tagmanager.edit.containerversions: creating a container version (optional)
  Why this permission

  A technical step behind the “Publish” button, just before your tags go live. Triggered only by your click, never in the background.

• .../auth/tagmanager.publish: publishing the container (optional)
  Why this permission

  Publishing your Google Tag Manager container at your request, so your tags go live without leaving Pulzeo. A version note listing the changes is recorded.

• .../auth/tagmanager.readonly: read-only access to the container (optional)
  Why this permission

  Detecting the published version of your container, to check that conversion tracking really is live.

What we actually store

The application stores the following in its database:

• The access authorizations issued by Google, encrypted before being recorded.
• The list of connected Google Ads accounts (ID, name, currency, status).
• Metrics aggregated by day (impressions, clicks, cost, conversions, ROAS, CPA and so on), so that historical comparisons do not require fetching the data again.
• The list of campaigns, ad groups, ads and keywords synced from Google Ads.
• Each account’s business configuration: the type of business you specify (lead generation, online store, appointment booking, awareness, app installs), the corresponding performance target (CPA, ROAS, CPV or CPI depending on the type), the display order you set by drag and drop, and your answers to the business profile questionnaire (industry, website, objectives, audience, regulatory constraints and so on), which you fill out to tailor the analyses Zeo produces.
• Branding per account: the client company’s trade name and logo, used to brand the reports you generate and share.

We never store your Google password, your banking details linked to Google Ads, or your Google Ads billing data.

Compliance with the Google API Services User Data Policy

Pulzeo’s use and transfer of information received from Google APIs (Google Ads and Google Tag Manager) adheres to the Google API Services User Data Policy, including its Limited Use requirements. In practice:

• Google Ads and Google Tag Manager data is used only to provide user-facing features of the Pulzeo service (dashboard, reports, analyses, conversion tracking audits, optimization actions triggered by the user), for the benefit of the user who connected the account.
• None of that data is sold or transferred to third parties for advertising, targeting, data brokering or resale.
• The only transfers to third parties are to our technical subprocessors (see the “Subprocessors” section), strictly to provide the service and subject to a confidentiality commitment.
• None of that data is used to develop, train or improve artificial intelligence or machine learning models, whether internal or third-party.
• No human reads that data, except at your explicit request (technical support), with your consent, for security reasons or where the law requires it.

Purposes and legal bases

Profiling and automated decision-making

The Pulzeo application includes an AI assistant called Zeo, built on language models provided by a specialized third party, to produce campaign analyses, optimization recommendations and report summaries.

Within the meaning of Article 22 of the GDPR, this processing constitutes decision support, not an automated decision producing legal effects or significantly affecting the data subject. In practice:

• No contractual, financial or legal decision enforceable against a third party is made by Pulzeo solely on the basis of Zeo’s output, without human intervention by the professional user.
• The analyses Zeo produces are advisory suggestions intended for the user, who remains the sole decision-maker as to how they are used, in their own campaigns or those of their clients.
• No automated score is assigned to Pulzeo users or to the people involved in the campaigns analyzed (employees, customers, audiences).
• No advertising profiling of Pulzeo users is carried out for targeting, analytics or resale to third parties.
• The Google Ads data sent to the AI provider as part of a Zeo analysis is not used to train its models and is not retained by the provider beyond the time needed to process the request. This commitment is contractual, and the provider’s identity is disclosed to our business customers upon request.

If you believe an analysis produced by Zeo has misled you, or you wish to contest it, write to us through our contact form. Human review is always available on request.

Retention periods

• Active account: for as long as your Pulzeo account is active.
• After account deletion: data is deleted within 30 days, except for accounting data, which is kept for 10 years (a Mauritian tax obligation).
• End of access (trial not converted, or subscription canceled): access to the service stops as soon as the trial ends or the cancellation takes effect. Data is then deleted in stages: the advertising data synced from Google Ads after 30 days, then the organization as a whole after 60 days. After that, we keep only your email address and first name to send you marketing communications, on the basis of your consent and with an unsubscribe link in every message.
• Error logs: 30 days, then automatic purge.
• Synced Google Ads metrics: kept for as long as the Google Ads account is connected; deleted if you disconnect it.
• Google Ads access authorizations: deleted immediately if you disconnect the account or if Google revokes the token. When access ends (trial not converted, or cancellation), they are revoked as soon as access stops: we never retain active access to a Google Ads account we no longer sync.
• Site chat conversations: 6 months, then automatic deletion. The email address is kept until you object or request erasure.
• Conversations with Zeo in the application: 6 months, then automatic deletion. They help us understand what you expect from the assistant and improve it.
• Session cookies: the length of the session, plus a 7-day refresh period.
• Consent preferences cookie: 13 months.
• Attribution cookies: the length of the session without consent, or 90 days once analytics cookies are accepted. The attribution data copied to your organization at sign-up is kept for the lifetime of that organization.

Subprocessors

To provide the service, Pulzeo relies on technical providers who may process your data on our behalf. All are bound by contract and committed to GDPR compliance.

An up-to-date list of these providers by name is provided to our business customers upon request, through our contact form.

Transfers outside the European Union

Several of our subprocessors are based in the United States. To govern these transfers, we rely on:

• The EU-U.S. Data Privacy Framework, for subprocessors certified under it.
• The European Commission’s Standard Contractual Clauses (SCCs) in all other cases, supplemented where needed by additional measures.

Mauritius is not covered by an adequacy decision of the European Commission. Transfers of data from the European Union to Ecom Liberty (Mauritius) are therefore governed by the European Commission’s Standard Contractual Clauses (SCCs), supplemented where needed by additional measures. Mauritius also has its own data protection legislation (the Data Protection Act 2017), which we apply as well.

Your rights

Under the GDPR and the Mauritius Data Protection Act 2017, you have the following rights over your personal data:

• Right of access: to obtain a copy of the data we hold about you.
• Right to rectification: to correct inaccurate data.
• Right to erasure (the “right to be forgotten”): to request the deletion of your data, subject to our legal obligations.
• Right to restriction of processing.
• Right to data portability: to receive your data in a structured, readable format (JSON), upon request.
• Right to object to processing based on legitimate interest.
• Right to withdraw your consent at any time, where processing is based on consent.
• Right to lodge a complaint with a supervisory authority (the CNIL in France, or the Data Protection Office in Mauritius).

To exercise these rights, write to the GDPR point of contact listed at the top of this policy, or use our contact form. We respond within 30 days.

Cookies

Pulzeo uses cookies to run the service and, subject to your consent, to measure its audience or improve the experience. For the full list of cookies, their lifetime, their purpose and details of the consent mechanism, see our dedicated cookie policy.

In short: strictly necessary cookies (authentication session, remembering your preferences) are set without consent; audience measurement and advertising cookies are set only after you give your explicit consent through our banner. You can change your preferences at any time using the “Cookie preferences” link at the bottom of the page.

Security

The technical and organizational measures we have implemented to protect your data are described on our Security page. In short: traffic and sensitive data are encrypted, each organization is isolated from the others, passwords are never stored in cleartext, and the critical parts of the service are monitored continuously.

Notification in the event of a data breach

Under Articles 33 and 34 of the GDPR and the equivalent provisions of the Mauritius Data Protection Act 2017, Ecom Liberty has established an internal procedure for handling security incidents affecting personal data.

Notification to the supervisory authority

Any personal data breach likely to result in a risk to the rights and freedoms of the data subjects will be notified to the competent supervisory authority (the CNIL for residents of the European Union, the Data Protection Office in Mauritius) no later than 72 hours after we become aware of the incident. The notification will include, to the extent the information is available at that stage:

• The nature of the breach, the categories of data and the approximate number of people and records concerned.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its possible consequences.
• The name and contact details of Pulzeo’s GDPR point of contact.

Notification to the data subjects

Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly, by email, as soon as possible. The notification will describe, in plain language:

• The nature of the incident.
• Its potential consequences for you.
• The measures we have taken and those we recommend you take (changing your password, revoking tokens, monitoring your connected accounts, and so on).
• The contact details of our GDPR point of contact, for any further information.

Internal breach register

Every data breach, including those that did not require notification (low risk), is documented in an internal register kept by Ecom Liberty, in accordance with Article 33.5 of the GDPR. This register is made available to the competent supervisory authority upon request.

Changes to this policy

We may update this policy to reflect changes to the service, new legal obligations or new subprocessors. The date it was last updated is shown at the top of the page. If we make material changes, we will notify you by email before they take effect.

Contact

For any questions about this policy or your personal data:

For GDPR questions and to exercise your rights, write to the GDPR point of contact listed at the top of this policy (the “Who we are” section). For anything else, use our contact form.

This English version is provided for convenience only. If it differs from the French version, the French version prevails.