Privacy Policy

This policy applies to two groups. First, the businesses and their team members who create a Staffra account to hire and manage AI employees ("Customers"). Second, the end customers of those businesses who exchange messages with an AI employee over channels such as Instagram or a website chat widget ("End Users").

For the account and business information a Customer provides to us directly, Pulsar is the controller of that information. For End User data processed through an AI employee, the business that operates the AI employee is the controller and Pulsar acts as its processor; that business's own privacy policy governs how it uses the conversation data it collects through Staffra.

Account information: name, email address, password (stored only as a secure hash by our authentication provider), company name, and role, provided when a Customer signs up or is invited to a team.

Business information: the descriptions, policies, product catalog, pricing, opening hours, bookable services, and other content a Customer adds so its AI employees can answer questions accurately.

Conversation content: the messages, attachments, and contact identifiers (such as an email address, a phone number, or a social handle) exchanged between an End User and an AI employee, along with any appointments, orders, or checkout links generated during a conversation.

Connection data: access tokens and account identifiers we store when a Customer connects a third-party channel or tool, such as a messaging platform (WhatsApp, Instagram, Telegram) or a calendar (Google Calendar).

Billing information: for paid subscriptions, the plan a Customer selects and the customer and subscription identifiers returned by our payment processor. We do not receive or store full card numbers.

Usage and device data: log data, IP address, browser type, pages viewed, and actions taken in the dashboard, collected automatically to operate and secure the Service.

Cookies: we use strictly necessary cookies to keep you signed in and to remember your language preference. We do not use advertising cookies.

To provide, maintain, and improve the Service, including letting AI employees answer questions, book appointments, and create checkout links on a Customer's behalf.

To send transactional messages to End Users on a Customer's behalf when they provide contact details for that purpose, such as an appointment confirmation or a reminder by email.

To authenticate users, secure accounts, prevent fraud and abuse, bill paid subscriptions, and enforce our Terms of Service.

To provide support, respond to requests, and send service-related notices such as security alerts and changes to our terms or policies.

To analyze usage in aggregate so we can understand which features are useful and improve performance and reliability.

To comply with legal obligations and to establish, exercise, or defend legal claims.

AI employees generate replies using large-scale language models operated by trusted third-party providers. To produce a response, the relevant conversation content and the business information needed for context are sent to that provider for processing and are returned to Staffra.

Under our agreements with these providers, they may process this data only to generate the response and may not use it to train their general-purpose models. We do not sell personal information and we do not use conversation content for advertising.

Where a Customer connects a Google Calendar, our access to and use of information received through Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google Calendar data only to check availability and to create, update, or cancel appointments on the Customer's behalf, and we delete it when the Customer disconnects the calendar or closes their account. We do not use Google user data for advertising, do not transfer it to data brokers, do not use it to determine creditworthiness or for lending purposes, and do not use it to train generalized (non-personalized) AI or machine learning models.

Google Calendar event contents (titles, descriptions, attendees) are never read by Staffra and never sent to an AI provider. The only information derived from a connected Google Calendar that is used when an AI employee replies is availability, meaning which time slots are free or busy. Our AI provider processes it only to provide the Service to us, under terms that prohibit using it to train their models.

Service providers: cloud hosting, database, email delivery, error monitoring, and the AI model providers described above, each acting on our instructions under a data processing agreement.

Messaging and calendar platforms: when a Customer connects a channel such as Instagram, or a calendar, we exchange the data needed to send and receive messages or manage events through that platform, subject to that platform's own terms.

Payment processors: subscription payments and any payments made through a checkout link are handled by a third-party payment processor (such as Stripe). Pulsar does not collect or store full card numbers and is not a party to a checkout-link transaction between a Customer and its End User.

Within a Customer's team: account and conversation data is visible to other authorized members of the same business account, according to their role.

Legal and safety: we may disclose information if required by law, regulation, or legal process, or to protect the rights, property, or safety of Pulsar, our Customers, or the public.

Business transfers: if Pulsar is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

Pulsar is headquartered in Brazil and operates the Service from there, using infrastructure and providers that may be located in other countries, including the United States and the European Union. Where personal information is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses and the protections offered by our providers.

We keep account and business information for as long as a Customer's account is active. Conversation data is retained while it is needed to operate the Service and for a reasonable period afterward for security, dispute resolution, and legal compliance.

A Customer can delete business content and disconnect channels at any time from the dashboard. When an account is closed, we delete or anonymize associated personal information within a reasonable period, except where we must keep it to meet a legal obligation.

We protect information with encryption in transit, access controls, and row-level database policies that isolate each business account's data. Sensitive credentials for connected platforms are stored with restricted server-only access.

No method of transmission or storage is completely secure. If we become aware of a security incident that affects your personal information, we will notify you and the relevant authorities as required by law.

Depending on where you live, you may have the right to confirm whether we process your personal information and to access, correct, delete, anonymize, or receive a portable copy of it, to object to or restrict certain processing, to information about the entities we share it with, and to withdraw consent. Brazilian users have these rights under the LGPD; users in the European Economic Area and the United Kingdom have equivalent rights under the GDPR.

Customers can exercise most of these rights directly in the dashboard. For anything else, or if you are an End User, contact us using the details in the "Contact us" section and we will respond within the time required by applicable law. You also have the right to lodge a complaint with your local data protection authority — in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD).

The Service is intended for businesses and is not directed to children or adolescents. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us information, contact us and we will delete it.

We may update this policy from time to time. If we make a material change, we will notify Customers by email or through the dashboard before it takes effect. The "last updated" date at the top shows when this version was published.

Pulsar LTDA operates the Staffra platform. For privacy questions or to exercise your data rights, email contato@staffra.io.

This address also reaches our Data Protection Officer (Encarregado pelo Tratamento de Dados Pessoais under the LGPD).