Privacy policy
Draft, under review by our privacy adviser. It describes how InviteLetter works today; the parts in [brackets] are still being confirmed.
InviteLetter is a product of Pulsar Interactive Pte. Ltd., Singapore. UEN 202550480W. Questions about this policy or your data: hello@pulsarinteractive.ai.
Two kinds of data, two roles
For your account (who you are, your organisation, your templates, your plan), Pulsar Interactive decides how the data is used: we are its controller. For the lists you load to make letters, you decide: we act as your data processor under Singapore's and Thailand's Personal Data Protection Acts, and only on your instructions.
Your lists of people: used, never kept
- Your list is read in your browser. It is not uploaded to be stored, and the app never saves it in your browser either; reloading the page clears it.
- To make PDFs, the rows go from your browser to our PDF service in Singapore, which holds them in memory while the letters are made and then discards them. They are never saved to a file, a database, a queue or a log.
- For Word letters, the converter needs files: each filled letter exists only in the PDF service's memory (never its disk) while its batch is converted, at most 2 minutes, and is then deleted.
- Finished letters and the review sheet are downloaded to your computer. We don't keep copies.
What we keep
- Your account: email address, name, organisation name.
- Your templates, including uploaded Word letters and their saved versions, and the logos and signatures you upload. These hold wording and images, not anyone's personal details from your lists.
- How many letters you made, and when, for your plan's limits and billing.
- Billing details for paid plans, held by our payment provider.
- If you request access on our website: your name, work email, organisation, the answers you give (what you would send, how many letters, when you need them) and what you tell us, plus the time of a call if you book one. We send you one email to confirm we have your request, and use these details only to contact you about it.
- If you request our data processing agreement: your organisation, country, name, role, work email, the plan you chose and what you tell us. We use these details only to send you the agreement and contact you about it.
- Technical logs with request ids, counts and timings, never list data.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Supabase | Sign-in: your email address and a hashed password | [region to confirm] |
| Vercel | This website, the details you send with the request forms (access and data processing agreement) on their way to us, and anonymous page-view counts and performance measurements (Web Analytics and Speed Insights, no cookies) | Form: Singapore. Pages: served worldwide |
| Railway | The InviteLetter app, the API and database (templates, usage counts, and requests sent from this website), and the PDF service | App and PDF service: Singapore. Database: [region to confirm] |
| Amazon Web Services (S3) | Your logos and signatures | [region to confirm] |
| Airwallex | Payments for paid plans | [to confirm] |
| Google (Calendar and Meet) | The name and email of people who book a call from this website, and the call itself | [region to confirm] |
| Cloudflare (Turnstile) | The bot check on the request forms and on booking a call: IP address and browser signals | Global |
How long we keep it
- Account data, templates and images: while your account is open, and deleted when you close it [period after closing to confirm].
- Usage counts and billing records: as long as the law requires for accounting [period to confirm].
Your rights
You can ask to see, correct or delete the personal data we hold about you, or withdraw consent where we rely on it, by writing to hello@pulsarinteractive.ai. For the people on your lists, you are the organisation responsible; we help you answer their requests as your processor.
If something goes wrong
If a breach affects data we process for you, we tell you without undue delay, so you can meet your own notification duties (72 hours under Thailand's PDPA, 3 calendar days under Singapore's).
Changes
We will post changes here and, for significant ones, tell account holders by email.