For site owners
PullsyBrandBot
The reader Pullsy uses when an agency asks it to read a brand's website. This page says when it visits, what it does there, how to recognise it, and how to allow or block it.
Why it visits
A marketing agency using Pullsy asks it to read a brand's own website, so the brand's logo, colours, fonts, products and voice can be kept in one place for that client. A visit is always started by a person, for one site. There is no background crawl of the web.
What it reads
At most 25 pages per visit: the home page, then pages about the brand, its collections and products, contact and a few posts, chosen from the site's own links and sitemap. It renders each page as a browser would, so it can see the colours and fonts the site actually shows.
How it behaves
It obeys robots.txt. It sends only GET requests: no forms, no logins, no purchases, no cookies kept between visits. One visit at a time per client, and each organization is limited to ten visits a day.
What it keeps
The brand's logo and images, its colours and fonts, its published product details, and short passages quoted word for word, each with the page it came from. These belong to the agency's client and are used for that client's own marketing. Pullsy does not use them to train AI models.
How to recognise it
Anyone can copy a User-Agent, so every request is also signed. Check the signature, not the name.
- User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 PullsyBrandBot/1.0 (+https://getpullsy.com/bot)- robots.txt token
PullsyBrandBot- Signed requests (Web Bot Auth)
- Every request carries
Signature,Signature-InputandSignature-Agent: "https://api.getpullsy.com"headers: an HTTP Message Signature (RFC 9421) with an Ed25519 key over the host and the signature agent, valid for one minute. The public keys are published at https://api.getpullsy.com/.well-known/http-message-signatures-directory.
How to allow or block it
Block it
Add this to your robots.txt. It stops at the home page and reads nothing else.
User-agent: PullsyBrandBot Disallow: /
Allow it
If your agency uses Pullsy and your bot protection turns it away, allow requests signed by the key directory above, or add a rule for the PullsyBrandBot User-Agent. It does not try to get past bot protection on its own; if you have not allowed it, it stops and tells your agency.
Questions, or a visit you did not expect? Write to support@getpullsy.com with the time and the site, and we will tell you which account asked for it.