Privacy Policy

The information you give us to have an account and a subscription: your name, email address, password, workspace and billing details. We decide how this is used, so we are the data controller (the “Data Fiduciary” under India’s DPDP Act).

When you connect an Instagram Business or Creator account, a LinkedIn profile, Company Page or ad account, a Shopify store, a Klaviyo account, we pull its data through the platform’s official API and store it for you. We do that on your instructions and use it only to provide the service. For that data you are the controller and we are the processor, so requests about it go to you first, not to us. The terms of that processing are in our Data Processing Agreement, which is part of the Terms of Service.

The same holds for people who are not our customers at all. If you switch on the comment-to-DM automation, we handle data about the people who comment on your posts — on your instructions, and only to send what your own rule tells us to send. You are their controller too, and section 2 sets out exactly what is stored.

• Name, email address and workspace name.
• A password, stored only as a one-way hash. We never store or see the password itself.
• Whether your email address has been verified, and your role in the workspace.

We receive your name, email address, whether Google considers that address verified, and your profile picture URL. We do not receive your Google password, and we ask for no permission beyond your basic profile and email.

Payments are processed by Razorpay. Card numbers and bank details go to Razorpay directly and never reach our servers. We keep your plan, billing currency, subscription status and the payment references Razorpay returns, which we need for invoicing and support.

• Session records: an opaque session token, your IP address, your browser’s user agent, and when the session was created and expires.
• Security audit entries: actions such as sign-in, connecting an account or creating an API key, with the IP address they came from.
• API usage counts per day, used for rate limiting and plan enforcement.
• Server logs. Access tokens, API keys and passwords are redacted before anything is written.

We use Google Analytics 4 to understand how the site is used. It runs only after you accept analytics cookies, and never before. Decline and no analytics cookies are set and no data goes to Google.

Under your instructions we store, for each connected account: the Instagram account ID, username, display name, profile picture URL, account type, biography, website, follower and following counts, media items with their captions, media URLs, permalinks and timestamps, and daily snapshots of the insight metrics Meta exposes. Access tokens from Meta are encrypted before storage.

We use Meta’s official Instagram API with Instagram Login. We do not scrape, and we never ask for or accept Instagram passwords.

We use LinkedIn’s official APIs with LinkedIn sign-in. We do not scrape, we never ask for or accept LinkedIn passwords, and we only ever read: Pullsy never posts, comments, reacts, messages or changes anything on LinkedIn. Access tokens from LinkedIn are encrypted before storage. What we store depends on what you connect:

• Your LinkedIn profile. Your LinkedIn member ID, name, headline, profile URL name and profile picture URL, your follower count, and daily and period totals of how your posts performed across all of them — impressions, members reached, reactions, comments, reposts, saves, sends, link clicks, profile views and followers gained from your content. We do not store the text of your posts.
• A LinkedIn Company Page you administer. The Page’s name, description, website, logo, industry and size; daily follower gains, page views and organic post statistics; the Page’s own posts with their performance figures; and aggregate breakdowns of the Page’s followers and visitors by job function, seniority, industry, company size and location.
• A LinkedIn ad account. The account’s name, currency and status; its campaign groups, campaigns, ads and conversion rules; daily performance and spend; and aggregate audience breakdowns (for example by job function or company size) as LinkedIn reports them.

We never collect data that identifies other LinkedIn members — who reacted to a post, who commented, who follows a Page or who saw an ad. Every audience figure is an aggregate count that LinkedIn has already anonymised.

LinkedIn’s terms restrict what may be done with this data, and we hold to them: it is shown only inside the workspace that connected it; data from your personal profile is shown only in the Pullsy dashboard and is never exported, including through our API; it is never combined with data from other sources or other customers; and it is never used for advertising, sales, recruiting or building audience lists.

We use Shopify’s official Admin API, with access you grant when you install Pullsy on your store, and we only ever read: Pullsy never creates, changes or deletes anything in your store. Access tokens from Shopify are encrypted before storage. For each connected store we store:

• The store’s name, domains, currency, time zone, plan and locations.
• Orders: order number, dates, statuses, sales channel, tags, discount codes and discount applications, taxes, shipping, tips, duties, totals, refunds, fraud-risk level, the payment transactions with their gateway, card brand and fees, the fulfilments with their carrier and delivery times, and returns with their reasons.
• Each order’s line items: product, variant, title, SKU, vendor, quantity and price.
• The marketing visits Shopify attributes each order to: when they happened, the source, the referring site, the landing page, any referral code, and UTM parameters.
• Products and variants with their prices, cost per item, stock at each location, a daily record of that stock, and collections.
• Your discount definitions, marketing activities, draft orders, abandoned checkouts (their value and products only), gift cards (their value and balance only), and Shopify Payments payouts and disputes.
• Shopify’s own analytics reports — sessions, conversion, search, page speed, attribution, inventory and payments — as daily totals.

Shopify grants Pullsy access to protected customer data, including customers’ names, email addresses, phone numbers and addresses, because its analytics reports cannot be read without that approval. We store none of those fields. A customer is represented only by a one-way code that groups their orders together (so we can count repeat purchases and lifetime value) and cannot be turned back into who they are; an address is kept only as its country and region codes; and no analytics report we store is broken down by an individual. Because of that, a Shopify request to return or erase one customer’s data finds nothing that identifies them in Pullsy; a request to erase a store’s data deletes everything we hold for it. Every time anyone views a store’s data in Pullsy or through our API, the access is logged.

We use Klaviyo’s official API, with read-only access you grant by signing in to Klaviyo yourself; Pullsy never sends, edits or deletes anything in your Klaviyo account. Access tokens from Klaviyo are encrypted before storage, and disconnecting in Pullsy also revokes our access in Klaviyo. For each connected account we store:

• The account’s name, website, industry, time zone and currency.
• Your campaigns, flows, sign-up forms, lists, segments, tags and metric names, with each campaign message’s subject line and preview text.
• Klaviyo’s own performance reports for them — recipients, deliveries, opens, clicks, bounces, unsubscribes, spam complaints, conversions and revenue, form views and submissions, and segment growth — as totals and daily figures.
• Each list’s and segment’s size, as a daily record.
• Daily totals of each Klaviyo metric (how many events, and their value).

We never read your subscribers’ profiles or individual events: no names, email addresses, phone numbers or anything else that identifies a person on your lists. Every figure we store is a total across many people.

This feature is off until you switch it on, and switching it on asks you to re-authorise your Instagram account for two further permissions — one to read and reply to comments on your own posts, one to send messages. None of the data below is collected before that, and turning the feature off stops it.

When somebody comments on a post one of your rules watches, we store the comment’s Instagram ID, the post’s Instagram ID, the text of the comment, which of your keywords it matched, when it was written, and the commenter’s username and Instagram-scoped ID. That ID is issued by Instagram separately for every business, so it identifies the person to you and is meaningless to anyone else.

We store each message your rule sends, exactly as it was sent, together with whether Instagram accepted it and the error if it did not. Where you use a follow gate, we also store whether Instagram told us the commenter follows you, and when. We do not read your inbox: we see the comments on your own posts and the replies your rules trigger, and nothing of the conversations you hold with anyone yourself.

Links your rules hand out are tracked, because Instagram reports nothing about a link inside a message and it is otherwise impossible to tell you whether the automation worked. For each opening we store the browser’s user agent, a one-way hash of the IP address and, only where you switch on device binding, a one-way hash of a cookie we set on the recipient’s browser. The address itself is never written down.

Files you upload for a rule to hand out are held in a private bucket that is never publicly readable, and are served only through single-use addresses that stop working after sixty seconds.

We keep the raw notification Instagram sends us for each comment, which repeats the details above, for 30 days and no longer. It is what lets an automation that went wrong be diagnosed and run again, and it is the only copy — Meta does not let us ask for yesterday’s notifications a second time.

A single session cookie keeps you signed in. It is HttpOnly, restricted to our own site, and cannot be read by JavaScript. Without it the dashboard cannot work, so it is set without asking — this is what “strictly necessary” means in law.

Google Analytics 4 cookies are set only after you accept them in the cookie banner. Choose “Cookie preferences” in the footer of any page to change your mind. If you withdraw consent we stop setting them and delete the ones already on your device.

• Ask what we hold about you, and get a copy.
• Correct anything wrong or incomplete.
• Delete your account and the data tied to it.
• Withdraw consent for analytics, without affecting anything else.

You also have the right to restrict or object to processing, the right to portability in a machine-readable format, and the right to complain to your supervisory authority. You do not have to come to us first, though we would rather you did.

You may nominate another person to exercise your rights if you die or become incapacitated, and you may raise a grievance with our grievance officer, named in section 12. If unresolved, you may approach the Data Protection Board of India.

You may request the specific pieces and categories of personal information we have collected, the purposes, and the categories of third parties involved; request deletion or correction; and not be discriminated against for asking. We do not sell or share personal information as the CCPA defines those terms, so there is nothing to opt out of.