Privacy Policy.

English version

Version 1.6 · Effective from 10 October 2026

Controller (for the data described in Part A): VISUAL‑FIX DESIGNS S.R.L., J30/53/2021, tax ID (CUI) RO36987744, Str. Lucian Blaga, room no. 1, block CU4, apt. 6, Satu Mare municipality, Satu Mare County, Romania (“Boostetic”). Data protection contact: support@boostetic.com.

Pulse Analytics has two distinct roles under the GDPR, dealt with separately below:

• Part A — Boostetic as CONTROLLER: data about you, our customer (account, billing, waiting list, support) and about visits to our own pages (boostetic.com/pulse-analytics/).
• Part B — Boostetic as PROCESSOR: data about the visitors of our customers’ sites, collected through the Pulse Analytics script on the customer’s behalf. For this data, the controller is the customer (the site owner), and we process only on the customer’s instructions, under the Data Processing Agreement.

Part A — Data of customers and of visitors to our own site

A.1. What data we process and why

A.2. What we do NOT do

We do not sell the data. We do not use it for behavioural advertising. We do not train AI models on your data. We do not send newsletters without a legal basis.

A.3. Recipients

Your data may be accessed by our providers strictly for operating the Service:

• Hostriver (Romania): hosting and databases;
• Stripe Payments Europe, Ltd. (Ireland): card payments; card data does not pass through our servers, from Stripe we receive only the country that issued the card, as evidence of the place of supply for VAT;
• Oblio (Romania): issuing tax invoices and, where applicable, submitting them to the e‑Factura system (ANAF, the Romanian tax authority);
• Sendinblue SAS (“Brevo”) (France): service emails, when active; otherwise, emails are sent directly from our server;
• Dropbox (Ireland / US): daily backup copies of the server;
• Meta Platforms Ireland Ltd. (Ireland): only if you accepted the Meta pixel — the data in the rows above about the pixel and the Conversions API;
• Google Ireland Limited (Ireland): only if you accepted the Google Ads tag — the data in the row above about the Google Ads tag;
• TikTok Technology Limited (Ireland): only if you accepted the TikTok pixel — the data in the row above about the TikTok pixel.

The complete list, with the data that each provider touches, is on the Sub‑processors page and in Annex 3 of the DPA. Public authorities — only when the law obliges us.

A.4. Transfers outside the EU/EEA

The Service data is hosted in the European Union. Data may reach outside the EU/EEA in the following situations, all with the safeguards of Chapter V GDPR:

• backup copies kept at Dropbox may be stored in the US, based on the EU‑US Data Privacy Framework (Dropbox, Inc. is certified) and the standard contractual clauses;
• payment data may be transferred by Stripe to Stripe, Inc. (US), based on the standard contractual clauses and the EU‑US Data Privacy Framework;
• Meta pixel data (only with your consent) may be transferred by Meta to Meta Platforms, Inc. (US), based on the EU‑US Data Privacy Framework;
• Google Ads tag data (only with your consent) may be transferred by Google to Google LLC (US), based on the EU‑US Data Privacy Framework (Google LLC is certified) and the standard contractual clauses;
• TikTok pixel data (only with your consent) may be accessed or stored by other entities of the TikTok group outside the European Economic Area, based on the standard contractual clauses, according to TikTok’s privacy policy for the EEA.

If a new provider involved a transfer, we update the list of sub‑processors beforehand.

A.5. Your rights

You have the right of access, rectification, erasure, restriction, portability, objection and the right to withdraw your consent (without affecting earlier processing). Write to us at support@boostetic.com — we reply within one month at most. You also have the right to lodge a complaint with the ANSPDCP (the Romanian data protection authority; Bulevardul General Gheorghe Magheru 28‑30, Bucharest, dataprotection.ro) or, if you live or work in another EU/EEA country or if the alleged infringement took place there, with the data protection supervisory authority of that country.

We do not take solely automated decisions with legal effects on you.

Part B — Data of visitors to our customers’ sites

B.1. The roles

When you visit a site that uses Pulse Analytics, the controller of your data is the owner of that site, not Boostetic. We process the data on its behalf, as a processor. To exercise your GDPR rights in relation to a particular site, contact the site owner first; we assist it with any such request.

B.2. What the Pulse Analytics script collects — and what it refuses to collect

We collect pseudonymised and aggregatable usage events: the page visited and its title, the referrer, the source of the visit and the UTM parameters of campaigns, the device type, the browser, the operating system, the language, the resolution, the country and region (in Romania, the county) (derived offline from the IP address, which does NOT enter the analytics data), the active time of the visit, the scroll depth, the positions of clicks and mouse movements (normalised coordinates), the visible text of the buttons/links clicked and the address they lead to, the forms submitted (without their content), the events defined by the site owner, the variant shown in an A/B test, a session identifier, and, for online shops, the order data sent by the site (order number, value, products).

Session recordings (only on sites where the owner turns them on): the displayed content of the page, cursor movements, clicks, scrolling and the address of the page, without parameters, played back as a reconstruction of the visit. What is typed into fields is masked in the browser, the choices in checkboxes and radio buttons do not enter the recording (you can see where you clicked, not what you chose), and the areas marked by the site owner are excluded completely. They are kept for 30 days at most (7 days, if the site owner is on the Free plan).

Held‑back orders. For online shops, orders that we do not add directly to the reports (for example, the same order number with a different amount, or an implausible amount) are kept separately for 30 days at most, with the same data as an order, so that they can be checked. If the database is unavailable when an order arrives, the request is kept temporarily on the server, with the IP address and the browser, so that it can be linked to the visit, and is replayed automatically when the database comes back; it is deleted immediately after the replay and in any case after 7 days at most.

By design, the script does NOT collect: the content of form fields (passwords, emails, cards — reading them is refused in the code), IP addresses in the analytics data (only a hash with a salt that changes daily and is not retained is used — after 24 hours the hash becomes impossible to recalculate, including by us; separately, like any web server, the server keeps access logs with the IP address, for security, archived monthly and kept for the current month and the previous month at most, about 2 months — Part A.1), advertising identifiers, data from other sites or browsing history.

B.2b. What we keep about YOU, as an account holder

Separately from your visitors’ data, for account security we keep technical logs that contain the IP address in clear form: active sessions (last activity, device) and the audit log of actions in the account. They are necessary so that we can investigate unauthorised access. Retention: 60 days for sessions, 12 months for the audit log.

B.2c. Requests concerning the data of a specific visitor

Visitor identifiers are recalculated from a salt that changes daily and is deleted — so after 24 hours, from the analytics data, we can no longer link visits to a particular person. For the purposes of Art. 11 GDPR, for this data we are no longer able to identify the data subject.

Exception: orders. For online shops, the order number remains linked to the visit from which the order came. The shop owner knows who placed the order and can therefore identify the person: for this data, access or erasure requests can be fulfilled, on the basis of the order number.

What we can do, at your request as a controller: erase the data linked to a specific order, erase an entire site or the entire account (you can also do these yourself, from the account; deleting a site is confirmed with the password, can be undone for 7 days, then it is final), and you can delete session recordings one by one, from the app. Other targeted erasures (for example, a specific day) we do manually, on request; aggregates already calculated (counts per day, without identifiers) may remain.

B.3. Cookies and storage on the device

Pulse Analytics does not use cookies. The aggregated identification of visitors is done through an ephemeral identifier calculated on our servers from the IP address, the browser used and a cryptographic salt that changes daily and is not retained — the identifier becomes impossible to recalculate after 24 hours and does not allow tracking across sites or across days.

The only write to the device is the opt‑out marker (if you explicitly choose not to be measured, by visiting the page with ?pulse_optout=1) — stored at your request. To respect your choice, the script reads this marker at every visit. The details are in the Cookie Policy.

B.4. Where the data is stored and for how long

On our infrastructure in the European Union; backup copies are stored at Dropbox (possibly in the US), in the application folder, with restricted access, based on the EU‑US Data Privacy Framework and the standard contractual clauses. Expired copies are deleted from the backup folder within 35 days at most; Dropbox may keep them in the account history for 180 days at most, then deletes them permanently. The retention period is set by the customer (the controller) in the account settings; when it expires, the data is deleted automatically. Visit‑level data (each visit and each click) is kept for 90 days at most (30 days on the Free plan), even if the chosen retention is longer. After that only statistics aggregated by day remain (number of visits, average time, pages, sources, click maps by area), without visitor identifiers, for as long as the data history of the customer’s plan lasts. When the customer’s account is closed, the data of its sites is deleted in accordance with the DPA.

B.5. Bot filtering and Do Not Track

Crawler/bot traffic is filtered. The script always respects the browser’s “Do Not Track” and “Global Privacy Control” signals, as well as the refusal requested with ?pulse_optout=1: when one of them is on, it sends nothing (neither the visit, nor the clicks, nor the recording, nor the order). The script does not collect anything either on the sites of a suspended or cancelled account or on sites scheduled for deletion.

Changes to the policy

We publish here any change, with the date of the version; for significant changes we notify customers by email. We keep earlier versions in full and send them on request, at support@boostetic.com.