Privacy Policy

Last updated: 12 October 2026

This Privacy Policy explains how Power Digital Limited Company ("PulseFlowAI", "we", "us") handles personal data when you visit pulseflowai.com or use the PulseFlowAI app at app.pulseflowai.com (together, the "Service").

1. Who we are

The Service is operated by Power Digital Limited Company, a company registered in Vietnam. For account data, website data and technical logs, we decide how and why the data is processed (we are the "controller").

For the content that a business puts into its workspaces (posts, images, captions, brand guidelines and the personal data inside them), the business that owns the workspace decides what goes in and why. We process that content on the business's behalf to provide the Service (we are the "processor"). If you are a member of someone else's business, questions about that content should go to that business first.

2. Data we collect

Account data: your name, email address and a hashed password when your account is created, and the business and workspaces you create or join, with your role in each.
Content: posts, captions, images, sources, schedules, campaigns, brand guidelines and channel settings that you, your team or your agents create.
Connected social accounts: when you connect Facebook or Instagram, the IDs, names, usernames and profile pictures of the Pages and Instagram professional accounts you choose, the access tokens Meta issues for them, and the IDs of posts we publish for you.
API tokens: the name you give each token and a hash of the token. We never store the token itself in readable form.
Activity records: who created, edited, submitted, approved, scheduled or published each post, and when, including actions taken by agent users.
Technical data: IP address, browser type, request logs and error logs, used for security and to keep the Service running.
Demo requests: when you fill in the form at /demo, your name, work email, optional phone number, company, website and role, your answers about your company, brands, channels and timeline, your message, the time you gave consent, your IP address and browser type (to fight spam), and campaign (UTM) parameters if your visit came from a campaign link.
Communications: the emails you send us and our replies.
Website cookies: your cookie choice on pulseflowai.com, and analytics or marketing cookies only if you allow them. See our Cookie Policy.

We do not ask for and do not want special category data (such as health data about you) in your account. If your posts contain such data, you are responsible for having a lawful basis to publish it.

3. How we use data and our legal bases

To provide the Service (performance of our contract with you): create and run your account, show your workspaces, store and display content, run the approval workflow and publish approved posts at the scheduled time.
To keep the Service secure (legitimate interests): detect abuse, enforce workspace isolation, investigate errors and keep audit records.
To communicate with you (contract and legitimate interests): reply to support requests and send service notices such as changes to these terms or to pricing.
To answer demo requests (consent, which you give on the form): contact you about your request, prepare the demo and send you a confirmation email. We do not add you to a newsletter.
To improve the website (consent): only if you accept analytics cookies.
To meet legal obligations (legal obligation): for example keeping records required by law or responding to valid requests from authorities.

We do not sell personal data and we do not use it for advertising profiles.

4. Facebook and Instagram (Meta) data

When you connect a channel, you sign in with Facebook Login for Business and choose which Pages and Instagram professional accounts to share. We request the following permissions and use each one only for the purpose shown.

Permission	What we use it for
`pages_show_list`	List the Facebook Pages you manage so you can choose which ones to connect.
`pages_read_engagement`	Read basic Page details (name, picture, linked Instagram account) needed to connect and publish to the Page.
`pages_manage_posts`	Publish the posts you approve and schedule to your Facebook Page.
`instagram_basic`	Read the ID, username and profile picture of the Instagram professional account linked to your Page.
`instagram_content_publish`	Publish the posts you approve and schedule to that Instagram account.
`business_management`	List Pages and Instagram accounts that you manage through a Meta Business portfolio.

We use Meta data only to show you the accounts you can connect and to publish content you have approved, at the time you set.
We do not sell Meta data, use it for advertising, share it with data brokers, or use it to build profiles of people.
Page and Instagram access tokens are encrypted at rest and are used only by our publishing service.
Removing a channel in PulseFlowAI deletes its tokens immediately. Removing PulseFlowAI in your Facebook settings under Business integrations also triggers deletion through Meta's callback.
Our handling of Meta data follows the Meta Platform Terms and Developer Policies.

See Data deletion for step-by-step instructions.

5. AI agents and the API

Businesses can create agent users and API tokens so that software, including AI assistants run by third parties, can read workspace context and create posts. When you connect an agent:

The agent can access the workspaces and actions that its role allows, just like a human user.
The agent itself (for example a model provider's assistant or your automation tool) is operated by you or your provider under their own terms. Data the agent reads from PulseFlowAI is sent to wherever that agent runs.
We do not send your content to AI model providers ourselves and we do not use your content to train AI models.
Agent actions are recorded in the activity log and labelled as agent actions.

Meta: when you publish, we send the post content and images to Facebook or Instagram through Meta's APIs.
Service providers: companies that host our servers, store backups or deliver email (we send email through Alibaba Cloud DirectMail), under contracts that limit their use of the data to providing services to us.
Members of your workspace: content in a workspace is visible to its members according to their roles.
Authorities: when the law requires it, or to protect the rights and safety of users or the public.
Business transfers: if our company is merged or sold, data may transfer to the new owner, who must keep honouring this policy. We will tell you before that happens.

7. International transfers

We are based in Vietnam and our servers or service providers may be located in other countries. When personal data moves across borders, we take the steps required by applicable law, such as Vietnam's personal data protection rules and, where the GDPR applies, appropriate safeguards such as standard contractual clauses. You can ask us for details at [email protected].

8. Data retention

Account data and content: kept while your account or the owning business is active. After a deletion request, we delete it within 30 days.
Facebook and Instagram tokens: deleted as soon as you remove the channel, remove the app in Facebook, or delete your account.
Activity records: kept as long as the post they belong to.
Technical logs: kept for up to 90 days, unless needed longer to investigate a security incident.
Backups: deleted data can remain in encrypted backups for up to 30 more days until those backups expire.
Support emails: kept for up to 2 years after the conversation ends.
Demo requests: kept for up to 2 years after our last contact, unless you become a customer, or deleted sooner if you ask.

9. Security

We use HTTPS for all traffic, encrypt social account tokens at rest, store passwords and API tokens only as hashes, and check workspace membership on every request so that one business cannot see another's data. Access to production systems is limited to people who need it. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

10. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you and get a copy;
correct data that is wrong or incomplete;
delete your data or your account;
restrict or object to some processing;
receive your data in a portable format;
withdraw consent at any time, for example for cookies, without affecting earlier processing;
complain to a data protection authority, such as the authority in your country of residence.

Email [email protected] from the address on your account. We may ask you to confirm your identity, and we reply within the time the law requires, normally within 30 days.

11. Cookies

The website uses necessary cookies and, only with your consent, analytics and marketing cookies. The demo form sets no cookies. The app and the website's admin area use cookies needed to keep staff and customers signed in. Details are in the Cookie Policy, and you can change your choice at any time with "Cookie settings" in the footer.

12. Children

The Service is a business tool and is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children; if you believe a child has given us data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the Service changes. We will change the "Last updated" date above, and for significant changes we will tell account owners by email or in the app before the change takes effect.

14. Contact

Power Digital Limited Company, Vietnam.
Privacy questions and requests: [email protected]
Other questions: [email protected]