Privacy Policy

Last updated: 30 October 2026

This Privacy Policy explains how Pulse (by AIVCJ) ("we", "us") collects, uses, shares and protects personal data when you use https://portfolio.aivcj.com (the "Site"). We are the data fiduciary / data controller for the data described here. We collect as little as we can, never sell your data, and do not use advertising trackers.

1. Summary

• Browsing the Site needs no account and sets no tracking or advertising cookies. We measure visits with our own cookie-less analytics.
• Opening a demo or buying requires a one-time verification by WhatsApp or email. We keep your contact details to give you access, deliver purchases and support you.
• Payments are handled by Paddle, our Merchant of Record. We never see or store your card details.
• You can ask us to access, correct or delete your data at any time: hello@aivcj.com.

2. Data we collect

2.1 Data you give us

• Verification and account: WhatsApp number, email address, name and the location (city/country) you enter when you request a demo or buy.
• Messages: what you write to us by email, and what you type into the AI concierge chat.
• Purchases: your order details (Theme, price, currency, order ID and the email used at checkout), as reported to us by Paddle.

2.2 Data collected automatically

• Analytics (cookie-less): pages viewed, the referring website, UTM campaign tags, approximate country, device type and browser. To count unique visitors without cookies, we combine your IP address and browser user-agent with a secret value that changes every day and store only the resulting one-way hash; we do not store your IP address in our analytics.
• Security data: IP address and request metadata, used briefly for rate-limiting, fraud prevention and the human-verification check (Cloudflare Turnstile).
• Approximate location: your country is looked up from your IP address to pre-select your phone country code; it is not stored with your profile unless you submit the form.

2.3 Data from third parties

• Paddle tells us when an order is completed or refunded, with the buyer's email and order details.

We do not knowingly collect special-category or sensitive personal data, and we ask you not to share it in chat or emails.

3. Why we use your data (purposes and legal bases)

Where we rely on consent, you can withdraw it at any time (see section 9); this does not affect processing already done.

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not use your chats or personal data to train AI models.

4. Cookies and similar technologies

We use only what is strictly necessary:

• Session cookie (cid) — set after you verify, so you stay signed in and can open every demo without re-verifying. It is HTTP-only, secure and expires automatically (by default after 30 days) or when you sign out.
• Admin session cookie — used only by our staff on the admin area.
• Session storage — a random per-tab identifier for analytics sessions and your recent chat history kept in your own browser so you can resume a conversation; it never leaves your device except as part of your chat requests.
• Cloudflare Turnstile — may set technical data needed to tell humans from bots when you request a verification code.

Because we do not use advertising or cross-site tracking cookies, no cookie banner is needed for them; you can still block or clear cookies in your browser, but demo access will then require re-verification.

5. Who we share data with

We share personal data only with service providers who process it on our behalf under contract, and only as needed:

• Paddle (Merchant of Record) — checkout, payment, tax, invoicing, refunds and fraud prevention.
• Messaging providers — our WhatsApp Business messaging provider and our email provider(s), to send verification codes and service emails.
• Cloudflare — Turnstile human verification.
• Anthropic — generates the AI concierge's replies from your chat messages and our catalogue.
• OpenAI — creates search embeddings of our catalogue content so the concierge can find relevant Themes (your personal data is not sent for this).
• IP geolocation service — derives your approximate country from your IP address.
• Hosting — our Site runs on a private virtual server rented from our hosting provider.
• Professional advisers and authorities — where required by law, to protect our rights, or in connection with a business transfer (with the recipient bound by this Policy).

We never sell or rent your personal data.

6. International transfers

Our providers may process data outside India and outside your own country (for example in the European Union, the United Kingdom or the United States). Where required, we rely on appropriate safeguards such as standard contractual clauses and the providers' own data-protection commitments, and transfers are made only to jurisdictions not restricted under Indian law.

7. How long we keep data

• Verification codes: stored only as one-way hashes and expire within minutes.
• Sessions: until they expire (30 days by default) or you sign out.
• Customer profile (leads): while you keep using the Site, and for up to 24 months after your last activity, then deleted or anonymised.
• Orders and invoices: for as long as tax and accounting law requires (typically 8 years in India).
• Analytics events: up to 13 months, then automatically deleted; they contain no IP addresses.
• Chat: our server does not keep a permanent transcript beyond what is needed to answer and to prevent abuse; your conversation history lives in your own browser.

8. Security

We protect data with TLS encryption in transit, encryption of stored provider credentials, hashed verification codes, HTTP-only session cookies, strict access controls for staff, rate-limiting and human-verification checks. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the relevant authorities as the law requires.

9. Your rights

Depending on where you live (including under India's Digital Personal Data Protection Act, 2023, the EU/UK GDPR and US state laws such as the CCPA), you can:

• access a summary of the personal data we hold about you and how it is used;
• correct or complete inaccurate data;
• erase your data (subject to legal retention, e.g. tax records);
• withdraw consent and object to processing based on legitimate interests;
• restrict processing or receive your data in a portable format;
• nominate another person to exercise your rights in the event of your death or incapacity (India);
• lodge a complaint with your data-protection authority (in India, the Data Protection Board of India).

To exercise any right, email hello@aivcj.com from the address (or mention the WhatsApp number) you verified with. We may ask you to confirm your identity and will respond within 30 days. We will not discriminate against you for exercising your rights.

10. Grievance Officer

In accordance with Indian law, you can contact our Grievance Officer about any concern relating to your personal data or this Policy:

Grievance Officer, Pulse (by AIVCJ) — Email: hello@aivcj.com — Response: acknowledgement within 72 hours; resolution within 30 days.

11. Children

The Site is not directed to children and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this Policy

We may update this Policy as our Site or the law changes. The "Last updated" date shows the current version; for material changes we will place a notice on the Site and, where appropriate, email verified customers.

13. Contact

Pulse (by AIVCJ) — hello@aivcj.com — https://portfolio.aivcj.com