Privacy policy

The controller of data for the PULSHEX service is Dionysis Karamitopoulos, who determines the purposes and means of processing. This policy is drawn up in accordance with Regulation (EU) 2016/679 (GDPR). Communication takes place exclusively through the form on the home page.

What data we collect

• Email address, for purchase, provision of access and replying to a contact message.
• Name, subject and content when you use the contact form.
• Technical data necessary for operation and security (e.g. a cryptographic hash of the IP address to limit abuse).

Card details are processed by Paddle; we do not store card numbers or security codes. The service retains the purchase email address, transaction and subscription identifiers, access status, expiry date and a cryptographic hash of the key. The key itself is stored in your browser for reuse and sent to your email address when issued.

If you enable notifications, the Web Push endpoint and the technical keys of the device subscription are retained, linked to the access licence. No name or account is required for the subscriber. Administrator login is a separate function.

Public reports and supporting evidence

Public articles and metadata, such as the title, available excerpt, publisher, link and dates, are collected to identify and document incidents. Articles may include public references to individuals. Internal supporting evidence and findings that are insufficiently substantiated do not form part of the public archive available to subscribers. We do not collect stolen passwords or searches of personal accounts; unconfirmed public metadata are not presented as confirmed incidents.

Purpose and legal basis

Performance of a contract (provision of access), compliance with legal obligations and legitimate interest (service security).

Contact messages are used to provide a reply and, where a potential purchase is concerned, to take steps prior to entering into a contract. An acknowledgement of receipt is sent, informing you that contact will be made within 1–2 days. The evaluation of public reports is based on the legitimate interest in providing information about cybersecurity incidents. Optional notifications require user permission, which may be withdrawn through browser settings.

Recipients

Paddle.com as Merchant of Record for sales, payments, tax compliance and invoicing, Lovable Cloud for hosting and storage, the email delivery infrastructure and your browser’s notification provider for the respective deliveries. The contact message and reply address are forwarded to the service administrator. Confirmation and key emails use notify.pulshex.com. We do not sell personal data.

Also, professional advisers (lawyers, accountants) where necessary, and public authorities where required by law. Where data are transferred outside the EEA, appropriate safeguards apply, such as the European Commission’s Standard Contractual Clauses or adequacy decisions.

Retention period

Subscription data are used to manage access and the related obligations. They are retained only for as long as necessary for the purposes above or as required by law (e.g. tax obligations). Contact messages are retained for as long as necessary to handle the request. Notification subscriptions are deleted when revoked or when the key expires. When data are no longer needed, they are deleted or anonymised.

Security

Optional Business Website Exposure Assessment

This feature is in development and is not currently included in the subscription; processing is not active. Once activated and if you choose this option, we store your business’s public URL, your consent, the profile derived from public information and the relative-exposure analyses. Reading and analysis begin only after a confirmed purchase. Firecrawl is used to read public content, Lovable AI to compose the analysis and Brevo to send it to the purchase email address. Access keys or card details are not sent to AI.

The optional processing is based on your consent. You may change or delete the website and related analyses, and stop the assessment from the Access page using your active key or through Contact. Stopping the assessment does not cancel the purchase. The index concerns the business website/domain, not you or any other natural person, and is not used for decisions regarding your purchase, pricing or exclusion; they do not represent a percentage probability of a breach. Expiry or revocation of access stops deliveries.

We implement appropriate technical and organisational measures, such as encryption in transit, storage of keys only as cryptographic hashes and restricted administrator access.

PULSHEX Browser Intelligence Extension

This section covers the “PULSHEX Browser Intelligence” Chrome extension (version 0.1.0 on the Chrome Web Store) and is based on the actual code of the published version. The extension requests only the activeTab and storage permissions. It has no content scripts and no background service worker, and it does not read cookies, form fields, page content or your browsing history.

When it runs. Only when you open the extension and click “Analyze Website” or “Submit Public Report”. At that point it reads the address of the active tab. If the page is not a public HTTPS page, nothing is sent.

What is sent. Only to https://pulshex.com: your access key and the page address limited to hostname and path, without query parameters, fragments or login details. The key is used only to verify on the server that a subscription is active. The key is stored locally in the extension’s storage in your browser until you click “Delete key” or uninstall the extension.

Incident lookup. The address is compared with the sources of recorded incidents. We do not store the address or any lookup history.

Public report submission (optional). Before sending, a confirmation shows the exact address to be sent. We store the article address, its hostname, the submission time and a one-way hash of your key, not the key itself. The hash is used to enforce the limit of 10 submissions per 24 hours. Submissions are visible only to the administrator and are never published automatically. They are kept as long as needed for review and documentation, and deleted on request.

Third parties. This data is processed only on PULSHEX’s hosting infrastructure (Lovable Cloud). It is not used for advertising, analytics, tracking or AI model training, and it is not sold or transferred to third parties.

Chrome Web Store. Use of this data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only for the extension’s core functionality and is not transferred for unrelated purposes. To request deletion of submissions or for any other request, use the Contact page.

Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw consent at any time, through the Contact page. We respond within one month. You have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).