Pulse – Privacy policy

Last updated: 20 October 2026

Who we are

Pulse is a Shopify app operated by Night Eagle Studios Kft. (Night Eagle Studios Korlátolt Felelősségű Társaság), 2000 Szentendre, Kadarka utca 21., Hungary; company registration number 13-09-210010, tax number 28994372-2-13 (“we”). Contact: hello@nighteaglestudios.com, nighteaglestudios.com.

Our role

For the visitor data of a store, the merchant who installs Pulse is the controller and we are the processor acting on the merchant's instructions, under our Data Processing Addendum. For the merchant's own account data (store name, contact e-mail, plan) we are the controller.

What Pulse processes

• Store visitors – only after they allow analytics in the store's cookie banner: pages viewed, clicks, scrolling, cart and discount code actions, site search terms, messages shown, text copied from the page, page speed, checkout steps (with cart totals, line items and the shipping country) and a visual recording of the page. Input fields are masked, and the merchant can hide further elements or all text; we do not record names, addresses, e-mail addresses, phone numbers, passwords or payment data, and we do not store IP addresses (only the country and city derived from them; an IP address is compared with the merchant's exclusion list and then discarded). Visits are identified by a random ID, and a random visitor ID kept in the visitor's browser links the visits of the same browser; an order is linked by its Shopify order ID. Bots and automated browsers are not recorded, only counted.
• Merchants – the store domain, store name, contact e-mail, time zone, currency, plan and settings, and an encrypted Shopify access token.

Purpose

Showing the merchant how visitors use the store (recordings, heatmaps, funnels, errors), AI summaries of visits and daily reports, and operating the subscription.

Sub-processors

• Cloudflare, Inc. – hosting and storage (data centres in Europe and worldwide).
• Anthropic PBC and OpenAI, L.L.C. – AI summaries of pseudonymous, text-only session logs (no recordings, no personal data typed by visitors).
• Resend (if e-mails are enabled) – delivery of reports, alerts and failed-purchase notifications to the merchant.

Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses.

Retention and deletion

Visitor data is kept for the retention period of the merchant's plan (30 or 90 days) and then deleted automatically; on paid plans, visits the merchant marks as favourites are kept for up to one year. A merchant can delete any single visit. When the app is uninstalled, all data of the store is erased within 48 hours (Shopify's shop/redact request) and at the latest after 30 days. Customer data requests and erasure requests sent by Shopify are honoured. Shared replay links expire after 14 days and can be revoked by the merchant at any time. Bug reports a merchant sends us from the app (which may include a recording of the merchant's own screen in the app) are deleted after 90 days. To limit abuse, a store counts the new visits of each address per day with a keyed one-day hash of the IP address (the address itself is not stored; the hash cannot be reversed without the app's secret and is deleted after two days). To give each store one free trial only, we keep a one-way hash of the store's myshopify address and the date its trial started, also after uninstalling; it contains no personal data.

Rights

Store visitors should contact the store, which can delete their visits in Pulse. Merchants can contact us at hello@nighteaglestudios.com.