PulsePoint helps employers listen to their teams through short, recurring pulse surveys. Because we handle sensitive workplace feedback, we treat privacy as a product feature — not a footnote. This policy explains what we collect, why, where it lives, and the rights you have over it.
Plain-language summary. We collect only what running a pulse survey needs — your admin's account details, your employee roster, and survey responses. We never show individual answers to a named person, never sell data, and never let AI models train on your team's feedback. Everything lives in India. If you have a concern, a named Grievance Officer must respond within 48 hours.
1 Who we are
PulsePoint is operated by FirstHR Services Pvt. Ltd. ("PulsePoint", "we", "us"), a company incorporated in India, registered at Kokum HQ, Mumbai, Maharashtra 400013 (GSTIN 27AABCF7821K1Z4). For the personal data of your employees, your employer is the Data Fiduciary and PulsePoint acts as a Data Processor under the Digital Personal Data Protection Act, 2023 (DPDP Act). See our Data Processing Agreement.
2 The data we collect
We collect only what a pulse survey tool needs to function. We deliberately do not collect the contents of anyone's work, files, or private messages.
| Category | Examples | Purpose | Retention |
|---|---|---|---|
| Account data | Admin name, work email, company name & size | Create and secure the account | Life of account + 90 days |
| Employee roster | Name, work email, team, role, tenure band | Send surveys, segment results | Until removed by admin |
| Survey responses | Ratings and free-text comments | Produce sentiment scores & insights | Aggregated after 24 months |
| Billing data | GST details, payment token (via Razorpay) | Process subscription payments | 8 years (tax law) |
| Technical logs | IP, device/browser, timestamps | Security & abuse prevention | 180 days |
We never sell personal data, and we do not use employee survey responses to train third-party AI models.
3 How employee anonymity works
Anonymity is the reason people answer honestly, so we protect it by design:
- Results are only ever shown to admins in aggregate. Individual responses are never attributed to a named person in the dashboard.
- We enforce a minimum group size of 5 — if a team or segment has fewer than five respondents, its scores are hidden so no one can be singled out.
- Free-text comments are shown to admins without the author's identity and are scanned to strip obvious identifiers before display.
The employee's promise. When your team opens a pulse, they are told in plain language that their manager cannot see who said what. We honour that promise technically, not just contractually.
4 How we use data
We process personal data to: deliver the service (send surveys, compute scores, generate alerts); produce the weekly AI narrative summary; keep the platform secure; handle billing; and provide support. Legal bases under the DPDP Act are the employer's lawful processing for employment purposes and, where required, consent captured at the point a survey is answered. Every consent we rely on is recorded together with a timestamp and the IP address it was given from, so it can be produced as evidence of lawful processing on request.
5 AI processing
PulsePoint's weekly narrative and open-text themes are generated using Anthropic's Claude models. Data sent for AI processing is limited to de-identified, aggregated survey signals. Under Anthropic's commercial terms, this data is not used to train their models and is not retained beyond what's needed to return a result. Customers on any paid plan may bring their own key (BYOK) for additional control.
6 Where your data lives & who processes it
All customer data is stored and processed in India (AWS Mumbai, ap-south-1). We use a small set of vetted sub-processors:
| Sub-processor | Function | Location | Data residency |
|---|---|---|---|
| Amazon Web Services | Hosting & storage | Mumbai, India | In India |
| Razorpay | Payments | Bengaluru, India | In India |
| Anthropic (Claude) | AI summaries | United States | De-identified |
| Email delivery | Survey invites | India / EU | Metadata only |
7 Your rights
Under the DPDP Act, Data Principals (the individuals whose data we hold) may request access to, correction of, or erasure of their personal data, and may nominate another person to exercise these rights. Employees should raise requests with their employer (the Data Fiduciary); we will support the employer in fulfilling them. You can also contact our Grievance Officer directly.
8 Security
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Role-based access controls and least-privilege internal access.
- Optional customer-managed encryption keys (BYOK) on any paid plan.
- Regular backups and a documented incident-response process. In the event of a reportable personal data breach, we notify affected customers and the Data Protection Board of India within 72 hours of becoming aware of it.
9 Our Grievance Officer
[Name], Grievance & Data Protection Officer
FirstHR Services Pvt. Ltd.
Email: grievance@pulsepoint.in
Post: Kokum HQ, Mumbai, Maharashtra 400013
Hours: Mon–Fri, 10:00–18:00 IST · Acknowledges within 48 hours, resolves within 15 days
This is required under the DPDP Act 2023 and the IT (Intermediary Guidelines) Rules, 2021. Full detail on what you can raise, how we handle it, and how to escalate is on the Grievance Officer page.
10 Changes & contact
We'll post material changes here and notify account admins by email at least 14 days before they take effect. Questions? Write to privacy@pulsepoint.in.