Pulse – Data Processing Addendum
Last updated: 20 October 2026
1. Parties and scope
This Data Processing Addendum (“DPA”) is made between the merchant who installs and uses the Pulse app on a Shopify store (“Merchant”, controller) and Night Eagle Studios Kft., 2000 Szentendre, Kadarka utca 21., Hungary, company registration number 13-09-210010 (“we”, processor). It applies to the personal data of the Merchant's store visitors and customers that Pulse processes for the Merchant, and supplements the Pulse privacy policy. By installing or using Pulse the Merchant accepts this DPA. It is meant to meet Article 28 of the EU General Data Protection Regulation (GDPR).
2. Subject matter, duration, nature and purpose
- Subject matter and purpose: showing the Merchant how visitors use the store – session recordings, heatmaps, funnels, errors, failed-purchase alerts, AI summaries of visits and daily reports.
- Nature: collection (only after the visitor allows analytics in the store's cookie banner), storage, analysis, display to the Merchant, AI summarisation and deletion.
- Duration: as long as Pulse is installed, plus the deletion periods in section 8.
3. Data subjects and categories of data
- Data subjects: visitors and customers of the Merchant's store.
- Categories: pages viewed, clicks, scrolling, cart and discount code actions, site search terms, messages shown, text copied from the page, page speed, a visual recording of the page with input fields masked, checkout steps (step names, cart totals and line items, shipping country, the messages shown at checkout), the Shopify order ID, the country and city derived from the IP address, a random visit ID and a random visitor ID kept in the visitor's browser.
- Not processed: names, e-mail addresses, postal addresses, phone numbers, passwords and payment data. IP addresses are not stored (only a keyed one-day hash, deleted after two days). No special categories of data (Article 9 GDPR) are processed; the Merchant should not ask Pulse to record pages that show them, and can hide elements or all text.
4. Our obligations
- We process the data only on the Merchant's documented instructions: this DPA, the app's settings and the Merchant's use of the app. If we believe an instruction breaks data protection law, we tell the Merchant.
- Everyone who processes the data for us is bound to confidentiality.
- We do not sell the data, do not use it for our own purposes and do not combine it with other stores' data.
- We help the Merchant answer data subject requests (access, erasure) – a single visit can be deleted in the app, and Shopify's customer data and erasure requests are handled automatically – and with data protection impact assessments where needed.
- We tell the Merchant about a personal data breach affecting its data without undue delay, at the latest within 48 hours after we become aware of it, with the information we have.
5. Security measures
- Encryption in transit (HTTPS/TLS) and at rest (Cloudflare storage encryption); the Shopify access token is additionally encrypted.
- Each store's data is kept in a separate database; recordings are in private storage, accessible only through the app.
- Access to the dashboard only through Shopify's session tokens or signed, expiring links that the Merchant can revoke.
- Input fields are masked in the visitor's browser before anything is sent; access tokens and keys are kept out of logs.
- Request limits on every public endpoint, and a daily cap on the e-mails a store can send.
6. Sub-processors
The Merchant authorises the following sub-processors:
- Cloudflare, Inc. – hosting and storage.
- Anthropic PBC and OpenAI, L.L.C. – AI summaries of pseudonymous, text-only visit logs (no recordings).
- Resend (if e-mails are enabled) – delivery of reports and alerts to the Merchant.
We bind them to data protection obligations at least as protective as this DPA. We announce a new sub-processor on this page at least 30 days before it starts; the Merchant may object by e-mail and, if we cannot resolve it, uninstall Pulse.
7. International transfers
Where data is transferred outside the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.
8. Deletion and return
Visitor data is deleted automatically after the retention period of the Merchant's plan (30 or 90 days; visits marked as favourites on paid plans up to one year). When Pulse is uninstalled, all data of the store is erased within 48 hours (Shopify's shop/redact request) and at the latest after 30 days. On plans that include export, the Merchant can export visit lists as CSV before uninstalling.
9. Information and audits
We make available the information needed to show compliance with this DPA, and answer reasonable written questions of the Merchant or its auditor, at most once a year unless a breach occurred.
10. Liability and changes
Liability follows the agreement between the Merchant and us for the use of Pulse and the applicable law. If this DPA conflicts with another agreement about the Merchant's personal data, this DPA prevails. We may update it to follow the law or the app; material changes are announced on this page 30 days in advance. Hungarian law governs this DPA.