Privacy notice

A data protection officer is not currently required or appointed. Privacy requests are handled through the address above.

When you open the site, our hosting and delivery systems process the IP address, request time, requested URL, response status, referrer, user-agent and technical security data. This is necessary to deliver the page, prevent abuse, diagnose faults and protect the service.

The legal basis is Article 6(1)(f) GDPR (secure and reliable operation). Where a request is necessary to provide a service you asked for, Article 6(1)(b) GDPR also applies. Operational logs are normally removed or anonymised within 30 days, unless a security event, legal claim or statutory duty requires longer retention.

We count page views with Outeva, our own growth tool, which runs on the same servers in the EU. It sets no cookie and stores no identifier: each view sends only the page address without its query, the referring site and the UTM parameters of the landing page. The legal basis is Article 6(1)(f) GDPR (knowing which pages and channels bring visitors).

The request-access form collects your name, work email, organisation, optional role and note, @handle when you are signed in, language selection, submission time and limited request metadata. We use it to assess enterprise access requests, prevent abuse and document our business communication.

The legal bases are Article 6(1)(b) GDPR (steps at your request before a possible agreement) and Article 6(1)(f) GDPR (qualified access management and business communication). We generally retain declined or inactive requests for up to 12 months. Contract records and legally relevant correspondence may be retained for statutory limitation, tax and commercial-law periods.

The contact form collects your name, email, optional company and your message. We use them only to answer your request. The message is sent to our team by email through Resend and recorded in Outeva, our own tool on our servers in the EU, so the reply can be tracked. To prevent abuse, we limit how many messages one IP address can send per minute. The legal basis is Article 6(1)(f) GDPR (answering the people who write to us), and Article 6(1)(b) GDPR where your message concerns a possible agreement. We generally keep contact messages for up to 12 months after the matter is closed; legally relevant correspondence may be kept for the statutory periods.

If you claim an @handle, create an identity or use managed OpenPulse, we may process your email address, handle, decentralised identifier (DID), public encryption material, verification status, account and realm membership, session and device metadata, routing metadata, security events and support communication. In sealed modes, managed relays process encrypted envelopes and the metadata required to route them; they are not intended to receive message plaintext. An envelope waits at a relay until its recipient fetches it, and is deleted unread after 30 days; prekeys stop being handed out when they expire and are then deleted. Realtime rooms are held in memory only.

Processing is based on Article 6(1)(b) GDPR to provide the requested account or service and Article 6(1)(f) GDPR to secure identities, prevent impersonation and abuse, and operate the network. Account records remain while the identity or service is active. After deletion, we remove or irreversibly anonymise personal data according to the service deletion flow, except for short-lived backups, fraud-prevention records and data we must retain by law.

Sign-in links and verification codes are sent by email through Resend. To prevent abuse, we limit how many links can be requested per IP address and per email address. Sign-in links, one-time codes and the records of a sign-in in progress are deleted a day after they expire.

For your account's security page we keep a log of security events: sign-ins and sign-outs (with the app used), passkey and authenticator changes, and blocked session reuse. It records the type of event, the app and the time, not IP addresses. We keep the latest 500 events per identity. We also list the apps and browsers where you are signed in, so you can sign them out. On your Identity page you can download everything OpenPulse Auth, the handle directory and Pulse Pay hold about you as one file; only secrets such as authenticator seeds and digests of tokens and codes are left out, and each download is recorded in your security activity.

Usage and invoicing. We measure each organisation's usage (for example messages sent and active identities) to apply the free amounts and fair use and, where an organisation has an agreement with us, to invoice it as the agreement states. The OpenPulse directory stores the organisation's plan and its monthly usage totals. For an agreement we process the business contact's name, email and address, the organisation's VAT ID, the agreement, our invoices and the bank transfers that pay them; no payment provider takes part. The legal bases are Article 6(1)(b) GDPR (performing the agreement) and Article 6(1)(c) GDPR (tax and commercial records, which German law requires us to keep for up to ten years).

When an app built on OpenPulse, such as AUVY, holds a meeting, audio, video and the list of participants pass through OpenPulse's own media servers in Helsinki. OpenPulse processes this data on behalf of the organisation that runs the meeting.

Meetings are not stored unless the meeting is recorded. Recordings are kept on the same servers in Helsinki until the app that started them deletes them. The app is responsible for telling participants that a meeting is recorded.

OpenPulse Mail receives and sends email for mailboxes that organisations create on OpenPulse, such as the mailboxes of AUVY's assistants. For the mail in those mailboxes we act as processor for the organisation that owns them (Article 28 GDPR) and follow its instructions; that organisation is the controller. For our own mail (sign-in links, verification codes, service notices and the addresses postmaster@ and abuse@openpulse.org) and for keeping the service secure, we are the controller.

We process sender and recipient addresses and the names that come with them, subject, message body and attachments, message and thread identifiers, the date, the address and name of the server that delivered or received a message, details of the encrypted connection, the results of SPF, DKIM and DMARC checks, delivery outcomes (accepted, delayed, bounced, reported as spam), unsubscribe and suppression entries, and the aggregate reports that mail providers send about our mail.

We deliver and receive mail on the mailbox owner's instructions or, for our own mail, to provide the service you asked for (Article 6(1)(b) GDPR). We check incoming mail for forgery and abuse, keep suppression lists so nobody receives mail they refused, and process bounce and spam reports to protect recipients and the service (Article 6(1)(f) GDPR).

Received and sent mail, with the records of its delivery, is kept for the retention period the mailbox owner sets, 90 days unless they choose another. Raw copies of incoming messages are deleted after 7 days, and logs of notifications we send to an organisation's systems after 30 days. Suppression entries are kept as long as they are needed to honour a refusal. Server logs follow section 2.

OpenPulse Mail runs on our servers in Hetzner's data centres in Helsinki. Mail travels encrypted wherever the other server supports it, and signing keys and secrets are sealed at rest. Mail leaves and arrives through Amazon SES in Ireland, which also checks incoming mail for spam and viruses; received messages wait in Amazon S3 in Ireland for at most seven days. Mail for openpulse.org addresses and sign-in mail still pass through Resend until they move too (section 9). For mail in a mailbox an organisation runs on OpenPulse, please contact that organisation first; we pass on requests we receive and help it answer them.

Pulse Pay gives your OpenPulse identity self-custodied wallets on the Base blockchain. Pulse Pay currently runs on the Base Sepolia test network, where tokens have no value. For each wallet we store your DID, the wallet address and label, the public key and credential ID of the wallet's passkey, and, if you set one up, the address of your recovery key. We never receive the passkey's private key or your recovery phrase; they stay on your device or with you.

For each payment we record the sender and recipient addresses and, where known, their DIDs, the amount and currency, status changes, and the blockchain transaction. We read transfers into and out of your wallets from the public blockchain to show balances and history.

Blockchain transactions are public and permanent. Anyone can see transfers between addresses, and neither we nor anyone else can delete them. We do not publish which identity owns an address, but an address you share, or a payment you make, can link it to you.

Circle provides the wallet infrastructure: it registers and checks the wallet passkey for pay.openpulse.org, submits the operations your passkey signs, and pays their network fees. For this, your browser sends Circle the passkey public key, your @handle and wallet label (as the passkey's display name), the wallet address and the signed operation, along with its IP address. Circle also issues EURC and USDC; its own terms and privacy notice apply to the tokens.

The legal bases are Article 6(1)(b) GDPR (providing the wallet and payment service you use), Article 6(1)(f) GDPR (preventing fraud and misuse, reconciling payments), and Article 6(1)(c) GDPR where sanctions or anti-money-laundering law requires checks or records. Wallet and payment records are kept while your account is active and afterwards only as long as statutory retention duties require. Records that must remain accurate for reconciliation are append-only: we correct them with new entries rather than overwriting them.

We do not currently use advertising or audience-measurement cookies on the OpenPulse site. A consent banner is therefore not shown. The following storage is technically necessary when you use the corresponding feature:

• Sign-in sessions: on openpulse.org and pay.openpulse.org, one secure, HTTP-only, encrypted cookie per site. It holds short-lived OpenPulse sign-in tokens, is renewed automatically, and lasts up to 12 hours. Page scripts cannot read it.
• OpenPulse sign-in: OpenPulse Auth (openpulse.org/auth) keeps you signed in with its own secure, HTTP-only cookie. It holds a random session reference, lasts up to 30 days after you sign in, and ends after 14 days without use or when you sign out. Page scripts cannot read it.
• Passkeys: created and kept by your device or password manager. OpenPulse and Circle receive only the public key.
• Handle claim: local and session storage for a claim draft (normally two hours), verification state and the recently claimed handle.
• Device identity: the private key your browser makes when you claim a handle, and its DID. It proves the claim, binds your first passkey and makes this browser your first messaging device; once both are done, the site deletes it. The private key is not sent to OpenPulse; signatures and public key material are sent when required.

You can clear browser storage through your browser. Doing so may sign you out. Before your first passkey, it also removes the key that proves your claim: you then finish with an email link to the address you verified.

These providers process personal data for OpenPulse:

• Hetzner Online GmbH (EU (Helsinki)): hosting of identities, accounts, relays, meetings, recordings and payment records in its Helsinki data centres
• Resend Inc. (EU (Ireland), US company): sending sign-in links, verification codes and notification emails, and receiving mail sent to openpulse.org addresses, delivered through Amazon SES in Ireland
• Amazon Web Services EMEA SARL (EU (Ireland), US group): sending and receiving mail for OpenPulse Mail through Amazon SES in Ireland, and holding received messages for seven days in Amazon S3 in Ireland
• Circle (Circle Internet Group, Inc. and affiliates) (US): Pulse Pay wallet infrastructure (Circle Modular Wallets): registering and checking wallet passkeys for pay.openpulse.org, submitting signed wallet operations to the blockchain and paying their network fees; Circle also issues the EURC and USDC tokens
• Base (Coinbase Technologies, Inc.) (US): public blockchain endpoints that pay-api reads to show balances and confirm payments (wallet addresses and transaction hashes; no names or handles)

We may also disclose data to professional advisers, authorities or courts where required by law or necessary to establish, exercise or defend legal claims. OpenPulse does not sell personal data.

Identities, accounts, relays, meetings, mail and payment records are hosted in Helsinki. Resend, Circle and Base (Coinbase) are US companies, and the European entity of Amazon Web Services is part of a US group, so data may be accessed from the United States. Data written to a public blockchain is available worldwide. For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.

Subject to the GDPR conditions, you may request access, rectification, erasure, restriction, data portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it for the future. You may also lodge a complaint with a supervisory authority.

Our competent lead authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. lda.bayern.de. Contact us first at privacy@auvy.ai if you want us to resolve a concern.

We do not use personal data from these flows for decisions with legal or similarly significant effects under Article 22 GDPR. Automated abuse controls may temporarily reject a request; you can ask for manual review.

We update this notice when services, providers or legal requirements change. Material changes are identified by the date at the top of this page.