Last updated: October 13, 2026
By installing PULSE on your Shopify store, or by using the PULSE API, you (the merchant, "Data Controller") and PULSE ("Data Processor") agree to the following.
PULSE sends WhatsApp order confirmations, shipping updates, restock offers and review requests; verifies shoppers by email or WhatsApp before checkout; offers a fast checkout sheet for Cash on Delivery and InstaPay orders; and lets your customers see their orders, download an invoice and read your FAQs on WhatsApp. Everything is sent on your behalf, to customers who ordered from you or asked PULSE a question.
PULSE processes your customers' name, email, phone, shipping/billing address and order details solely to provide the features above. It does not sell this data or use it for advertising. It is shared only with the service providers needed to run the App: the WhatsApp Cloud API (Meta) to deliver the message, Supabase for database and private file storage, and Railway for application hosting. Resend is used to email shoppers their verification code (when you choose email verification) and to email you (the merchant) order summaries and account alerts. See our Privacy Policy for the full list and the retention schedule.
PULSE has a Free plan and the paid plans Starter, Growth and Scale, billed monthly or yearly through Shopify's billing, with a 7-day free trial on a new install. Each plan includes a monthly number of WhatsApp messages and Fast Checkout orders, shown on the Billing page. Charges, approvals, upgrades and cancellations all happen through Shopify. If you reach a plan's limit, the affected feature pauses until the next period or until you upgrade; PULSE does not charge for messages beyond the plan. If you connect your own WhatsApp number, Meta bills you directly for the conversations on that number.
PULSE implements Shopify's mandatory GDPR webhooks (customers/data_request, customers/redact, shop/redact), so
data requests and deletions initiated through Shopify are honored automatically, including payment screenshots. See our
Privacy Policy for our retention schedule.
You remain responsible for your own compliance with applicable privacy laws (e.g. GDPR, CCPA) in how you run your store and communicate with your customers. PULSE provides the tooling described above to help you meet those obligations for the messages it sends.
PULSE depends on Shopify and Meta's WhatsApp service. We work to keep it running and to fall back safely (for example, an order is never lost if a message cannot be sent at once), but we cannot promise that third-party services will always be available.
PULSE is operated by a single individual (the "Operator"), who holds sole access to its Supabase database, Railway hosting, and Shopify Partner account -- there is no separate staff to coordinate, so the Operator is the incident owner for every step below.
Severity is assessed on first detection: Critical (confirmed unauthorized access to customer data, e.g. name/phone/address/email), High (suspected but unconfirmed unauthorized access, or a credential/key compromise with no confirmed data access yet), or Low (a vulnerability or misconfiguration found with no evidence of exploitation).
Immediate containment: rotate the affected credential(s) first (Supabase service role key, Meta/WhatsApp access token, Shopify API secret, or Railway deploy credentials, as applicable) via each provider's dashboard, then redeploy so the new credential takes effect. If a specific merchant's data is implicated, that merchant's session is invalidated by forcing re-authentication.
Evidence collection: before rotating credentials, the Operator preserves the relevant Railway deploy logs and Supabase query/API logs covering the suspected window, so the scope of the incident (which shops/customers, what data, over what period) can be established after containment rather than lost to the fix itself.
Notification: for any Critical or High severity incident, affected merchants are notified at the email associated with their Shopify account within 72 hours of the Operator confirming the incident, describing what happened, what data was involved, and what was done about it. Low severity findings with no evidence of exploitation are logged and fixed but don't require merchant notification.
Post-incident review: after containment and notification, the Operator documents the root cause and what changed to prevent recurrence (e.g. a new access restriction, a rotated key on a shorter schedule, an added validation check).
PULSE