Disclosures & Policies

These Terms of Service (“Terms”) govern access to and use of the Pulse platform (the “Service”), provided by Pulse Payments LLC (dba Pulse Technologies) (“Pulse”, “we”, “us”). By accessing or using the Service, the customer organization (“Customer”, “you”) and its authorized users agree to these Terms. If you use the Service on behalf of an organization, you represent that you are authorized to bind it.

1. The Service

The Service lets Customers draft, schedule, and publish social content to connected networks (LinkedIn, Facebook, Instagram, X, TikTok, YouTube, Pinterest, Threads, Google Business Profile, Bluesky, Mastodon, Discord, Telegram, Tumblr), including AI-assisted content. It also includes Pulse SMS (business messaging), Pulse Email / PulseEngage (opt-in email marketing — campaigns, automations, and signup forms — offered both within Social Command and as a standalone application at pulseengage.pulsetechnologies.ai), Pulse Voice (a business phone system and AI voice platform — inbound and outbound calling through web, desktop, and mobile softphone apps, voicemail with transcription, call recording, fax including an optional write-once fax archive, Microsoft Teams, Zoom, and Webex calling integrations, video meeting rooms with optional recording, transcripts, and AI recaps, AI voice agents built in AI Studio including the PiP phone agent, outbound AI calling, and collections and pay-by-phone calling), PulseConnect (a contact center — voice, SMS, web chat, and email queues, customer-satisfaction surveys, the Agent Console on the web and as a desktop app, and CRM connectors), PulseMeet (appointment scheduling at meet.pulsetechnologies.ai — booking pages, Google Calendar and Microsoft 365 calendar sync, Zoom meeting links, reminders, and the optional PiP Notetaker that joins and summarizes meetings), PiP for Outlook and Teams (the PiP assistant as a Microsoft 365 add-in), Pulse RFP (RFP discovery, drafting, pricing, and submission — including sending response documents for e-signature at the Customer’s direction), Pulse Deals (the Pulse Partners portal for deal registration, commissions, and partner onboarding), Pulse SSO / PulseAdmin (unified sign-in and cross-product access management), PulseBill (recurring billing and invoicing for the Customer’s own customers, including usage rating and tax calculation), PulsePay (payment acceptance — merchant processing itself is provided under separate merchant agreements with the payment processor), a public API and webhooks, native CRM connectors, a support help desk, in-product usage analytics, and native mobile apps. These Terms govern each Pulse product a Customer uses, whether accessed within the Social Command workspace or as a standalone application. Individual features may depend on third-party approvals or be offered in beta.

2. Accounts, organizations & eligibility

• Organizations are provisioned by Pulse; an admin may invite users and assign roles (admin, editor, viewer).
• You are responsible for all activity under your organization and for keeping credentials — including API keys and webhook secrets — confidential.
• Users must be 18 or older and provide accurate information.

3. Customer content & license

You own the content you create or upload (“Customer Content”). You grant Pulse a limited, non-exclusive license to host, process, transmit, and display it solely to provide the Service — including sending it to the third-party platforms and AI providers you direct us to use. You are responsible for having the rights to what you upload and publish.

4. Acceptable use

You agree not to use the Service to: violate any law or a connected platform’s policies; post unlawful, infringing, deceptive, harassing, or harmful content; send spam or publish to accounts you are not authorized to manage; breach, disrupt, or reverse-engineer the Service or other tenants’ data; exceed API rate limits or circumvent security; or submit payment card numbers or sensitive data into post content (the Service screens for and blocks card numbers and detected secrets).

5. Third-party platforms & AI output

• Connected platforms are governed by their own terms; Pulse is not responsible for their availability, decisions, or actions.
• The AI assistant (“PiP”) and other AI features act on your instruction. PiP is an assistant, not an autonomous publisher: content it prepares is presented for your review and requires your approval before it is published or sent. You remain responsible for reviewing all content for compliance with law and platform policies.
• AI output may contain errors and is treated as your Customer Content. Prompts and relevant content are sent to our AI provider (Anthropic) and are not used to train its models. Where a Customer selects an alternative AI model, speech-to-text, or text-to-speech provider for a feature (for example a Pulse Voice AI agent), the relevant content is sent to that provider (see the sub-processors in the Privacy Policy).

6. Business messaging, voice & email

• Consent & your responsibility. You may only message individuals who have given you prior express consent, and are solely responsible for that consent and for compliance with the TCPA, CTIA guidelines, and A2P 10DLC registration. You are the sender of all messages you send.
• Rates & opt-out. Message and data rates may apply; recipients may reply STOP to unsubscribe and HELP for help, handled automatically. Mobile numbers and SMS consent are not shared with or sold to third parties for their own marketing.
• Outbound AI voice (Pulse Voice). Automated, prerecorded, and AI-generated calls carry heightened requirements. You may place these calls only with the consent required by law — including prior express written consent where applicable — and are solely responsible for TCPA compliance, calling-time windows, and do-not-call obligations. You are the caller. Pulse provides the tooling and is not a party to the call.
• Text-to-pay. You — not Pulse — are the merchant of record. Charges are processed under your own gateway/merchant account; you are responsible for the goods or services, amounts, taxes, refunds, chargebacks, and card-network rules. Card details are entered on the gateway’s hosted page and are never received or stored by Pulse.
• Email marketing (Pulse Email / PulseEngage). Opted-in audiences only. Every message includes a one-click unsubscribe and your postal address; the Service enforces a suppression list. No unsolicited or purchased-list email.

7. Subscriptions, fees & billing

• Paid plans automatically renew (monthly or annually) at the then-current price using the payment method on file, until you cancel. Card details are entered on the gateway’s hosted page and never stored by Pulse.
• Plans that include text messaging carry a $50/year A2P 10DLC registration fee; you may opt out of SMS at checkout to avoid it.
• Free trials do not require a card and do not auto-convert. You may cancel any time from Admin → Billing; access continues through the paid period. Fees are non-refundable except where required by law. We may change pricing with at least 30 days’ notice.

8. Suspension & termination

Pulse may suspend or terminate access for breach, non-payment, or to protect the Service or third parties. You may stop using the Service at any time. On termination, Customer Content is handled as described in the Privacy Policy and DPA.

9. Disclaimers & liability

The Service is provided “as is” and “as available” without warranties of any kind. Pulse will not be liable for indirect, incidental, special, consequential, or punitive damages; its total liability will not exceed the amounts you paid for the Service in the 12 months preceding the claim.

10. Indemnification, changes & governing law

You will defend and indemnify Pulse against claims arising from your Customer Content, your use of the Service, or your violation of these Terms or applicable law. We may update these Terms; continued use after changes take effect constitutes acceptance. These Terms are governed by the laws of the State of Florida, with exclusive jurisdiction in the state and federal courts of Lee County, Florida.

11. Product-specific terms

The terms below apply in addition to Sections 1–10 when a Customer uses the product named.

Pulse Voice (phone system, fax, video meetings, and AI voice agents)

• Recording and monitoring consent. Before recording, monitoring, transcribing, or analyzing calls or meetings, you must obtain and maintain every legally required consent — including two-party/all-party consent where required — and give callers and called parties any legally required disclosures.
• Calling rules. For outbound calling you must also comply with robocall and caller-ID (STIR/SHAKEN) requirements and internal and national Do-Not-Call lists, and you are responsible for your AI voice agents identifying themselves as automated where the law requires.
• Emergency calling (E911). You must register and maintain accurate emergency address information for numbers that require it. Emergency calling over the Service may be limited or unavailable; you must maintain an alternative means of contacting emergency services.
• Protected health information. If you require processing of protected health information subject to HIPAA, a separate Business Associate Agreement (BAA) must be executed with Pulse. Absent a signed BAA, the Service must not be used to process PHI.
• Bring-your-own credentials. You may connect your own AI-provider or carrier accounts. When you do, you authorize Pulse to use those credentials to provide the Service to you, and you remain responsible for those accounts, their terms, their fees, and the acts performed with them. Provider credentials you store are encrypted at rest.
• Phone numbers. Numbers ordered, imported, or ported through the Service remain subject to the terms and portability rules of the underlying carrier. You are responsible for carrier and regulatory fees. On termination, numbers that have not been ported out may be reclaimed by the carrier.
• Model training. Pulse does not use Customer Content processed through Pulse Voice to train third-party foundation models.

Social Command, Pulse SMS, and Pulse Email

• WhatsApp and RCS. WhatsApp and RCS are delivered through Twilio and the underlying platforms (Meta/WhatsApp and Google/carriers). Where you use them, you must also comply with those platforms’ policies (including the WhatsApp Business Messaging Policy and approved message templates). Rich channels may carry an annual per-channel enablement fee and are metered against your message allowance.
• Prohibited messaging. You may not send messages that are unlawful, deceptive, or unsolicited, or that fall within carrier-prohibited categories (including SHAFT — sex, hate, alcohol, firearms, tobacco — content) except where lawfully permitted and properly registered.
• Anti-spam law. You must comply with all applicable anti-spam laws when sending email (including the U.S. CAN-SPAM Act and, where applicable, CASL and GDPR/PECR). Pulse Email may not be used for cold outreach or for lists the recipient did not opt into; doing so may result in suspension.
• Blog and CMS publishing. Where enabled, Pulse drafts long-form blog posts with AI and can publish them to a content management system you connect (for example WordPress, Webflow, Ghost, Hygraph, or Medium). You are responsible for the content you publish, for reviewing AI-assisted drafts before publishing, and for the CMS credentials you provide and the account they access. The CMS is your own system or vendor; Pulse publishes on your instruction and is not the CMS provider or a records custodian.
• Compliance capture and archiving. Regulated Customers may enable compliance capture to forward a copy of their communications (text, email, and social) to an archiving, supervision, or eDiscovery system they configure. That destination is your own system or vendor relationship: you are responsible for configuring it, for the credentials you provide, and for your retention and supervision obligations there. Pulse forwards the copy on your instruction and is not the archiving provider or a records custodian.
• Plan limits and non-payment. Plans carry usage limits (members, connected accounts, scheduled posts, messages, AI); exceeding a limit may require an upgrade or an add-on. Fees are exclusive of applicable taxes. If a renewal charge fails, Pulse may suspend or downgrade the account until payment is resolved. Cancellation does not produce prorated refunds for partial periods.

Contact

Pulse Payments LLC (dba Pulse Technologies)
9160 Forum Corporate Pkwy, Suite 350, Fort Myers, FL 33905
pulselegal@pulsetechnologies.ai

This Privacy Policy explains how Pulse Payments LLC (dba Pulse Technologies) collects, uses, and protects information in connection with the Pulse platform (the “Service”) — a multi-tenant service for social publishing, business messaging (Pulse SMS), business phone, fax, team chat, video meetings, call recording, and AI voice (Pulse Voice), contact center (PulseConnect), opt-in email (Pulse Email), appointment and team scheduling and meeting notes (PulseMeet), work management and service desk (PulseWork), billing and payments (PulseBill and PulsePay), RFP and partner tools (Pulse RFP and Pulse Deals), the PiP assistant (in our apps, in Microsoft Outlook and Teams, and on our website), a public API and webhooks, and native mobile and desktop apps. It also covers our website and Pulse Secure Transfer, the secure link through which customers and partners send files to Pulse.

1. Who we are and our role

• For account/identity data (login records of the people who use the Service), Pulse is a controller.
• For the content and connected-account data a Customer puts into the Service, the Customer is the controller and Pulse is a processor, processing on the Customer’s behalf. See the Data Processing Addendum.
• For information you send Pulse directly — website contact and demo requests, conversations with PiP on our website, merchant applications, and files sent to Pulse through Pulse Secure Transfer — Pulse is a controller.

2. Information we collect

3. How we use information

To authenticate users; generate, store, schedule, and publish content; send and receive messages and record opt-outs; orchestrate multi-channel journeys and place the outbound AI voice calls a Customer configures; route, connect, record (where turned on), archive, transcribe, and (where a recording policy asks) analyze inbound and outbound calls and voicemail, run team chat, and send, receive, and archive faxes; host video meetings and, where turned on, record, transcribe, and summarize them; run the Customer’s AI voice agents; publish booking pages, check calendar availability, create calendar and Zoom events for bookings, send booking confirmations and reminders, prepare pre-meeting briefs, and, where a user turns on the PiP Notetaker, join and summarize that user’s meetings; route contact-center calls, chats, texts, and emails to agents, run customer-satisfaction surveys, and log activity to a CRM the Customer connects; send push notifications to our mobile and desktop apps; run work-management projects and service desks; respond to website inquiries and process merchant applications; receive files sent to Pulse through Pulse Secure Transfer; send opted-in email with a working unsubscribe; enable text-to-pay (without processing the card itself); power AI features and the PiP assistant (which proposes, and never publishes on its own); provide API access and webhooks; screen content for sensitive data before publishing; operate support; manage billing; and secure and improve the Service with first-party analytics only.

4. Multi-tenancy & data isolation

Each organization is a separate tenant; content, connected accounts, members, and queues are segregated per organization. Contact data (names, emails, and phone numbers) a Customer imports is held in a shared per-tenant contact graph so it is available across the Pulse products that Customer uses — for example Pulse SMS and Pulse Email; it remains isolated to that Customer’s tenant and is never shared across Customers. Within the same tenant, PiP’s pre-meeting briefs may draw on that Customer’s own records of the same contact in other Pulse products (earlier bookings and meeting notes, Pulse SMS threads, and Pulse Voice call summaries). To troubleshoot, Pulse administrators may start a time-limited support session that acts within a Customer’s workspace; every such session is recorded in the audit log. Where a Customer is served through a Pulse reseller partner, that partner’s authorized administrators can enter and manage the Customer’s workspace; access runs downward only (a sub-reseller cannot reach its parent).

5. Sub-processors

We use the service providers below to run the Service, sharing only what each needs to perform its function. This is the same list published on the Sub-processors tab, which is the maintained copy.

Some sub-processors are engaged only when a Customer enables the related feature (marked “if enabled”). Where a Customer connects its own third-party provider account with its own credentials (for example its own AI provider or carrier account in Pulse Voice), that provider acts under the Customer’s own agreement and is not a Pulse sub-processor for that data. Where a Customer turns on compliance capture, the archiving, supervision, or eDiscovery system it configures (for example an HTTPS/webhook endpoint, an SMTP journaling address, a Microsoft 365 / Purview mailbox, Proofpoint, or an SFTP feed to Smarsh or Global Relay) is the Customer’s own system or vendor, not a Pulse sub-processor.

YouTube API Services

When you connect a YouTube channel, the Service uses YouTube API Services to upload the videos you create and read your channel name. By connecting YouTube you agree to the YouTube Terms of Service and the Google Privacy Policy. We access your data solely to provide the publishing features you request; we do not use it for advertising or sell it. We store your YouTube access and refresh tokens only while your channel is connected and delete them when you disconnect. You can disconnect the channel at any time in the Service under Admin → Connections, or revoke access from Google’s security settings at security.google.com/settings/security/permissions (also reachable at myaccount.google.com/permissions).

Google Calendar and Microsoft 365 calendars (PulseMeet)

PulseMeet, the Pulse scheduling product, lets a user connect a Google Calendar or Microsoft 365 calendar so that booking pages only offer times that are genuinely free. When you connect a calendar, PulseMeet requests: (a) free/busy information for the calendars you select, used to hide times that are already busy; (b) your list of calendars, so you can choose which to check for conflicts and which one receives bookings (for Microsoft 365, PulseMeet also reads your account email address); and (c) permission to create, update, and delete the booking events PulseMeet itself writes to the calendar you chose. For Google, event access is limited to calendars you own; for Microsoft 365, the permission Microsoft grants is read and write access to your calendars. PulseMeet reads the details of your other events (title, time, location, description, video-meeting link, organizer, and attendees) only to provide these PiP features: (i) if you turn on the PiP Notetaker (off by default; only you can turn it on), to find the upcoming meetings on your primary calendar that have a video link so the notetaker can join them; (ii) to prepare a pre-meeting brief for a booking, by finding your earlier and upcoming events with that invitee (this calendar search is on by default, and you can turn it off on PulseMeet’s Calendars page); and (iii) to answer your own questions to PiP about your meetings, including from PiP for Outlook. Event details used for these features are sent to our AI provider (Anthropic) to write the brief or notes and are not used to train its models. Access and refresh tokens are stored encrypted at rest, are used only to provide these features, and are deleted when you disconnect the calendar. Calendar data is never used for advertising, never sold, and never shared with third parties except the sub-processors that provide the Service (our hosting providers; for the PiP features above, our AI provider; and, if you turn on the PiP Notetaker, Recall.ai, which receives the meeting link and time so the notetaker can join). PulseMeet’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect a calendar at any time from PulseMeet’s Settings, or revoke access at myaccount.google.com/permissions (Google) or myaccount.microsoft.com (Microsoft).

6. Mobile information & SMS

Mobile phone numbers and SMS consent are not shared with, sold, or rented to third parties or affiliates for their own marketing. Mobile information is used only to deliver the messaging the Customer configured, including through Twilio. Recipients may reply STOP/HELP at any time.

7. Retention, your rights & security

We retain account and content data while the organization account is active. From Security in the app you can export your data (JSON) and delete your account. To exercise other rights, contact pulselegal@pulsetechnologies.ai; we action verified requests within 30 days.

Closing an account is not the same as deleting every record

Closing or deleting an account ends access to it and removes the account’s content and settings, subject to the legal and contractual exceptions in this section and the Data Processing Addendum. It does not by itself delete every record associated with the account. The records below are kept after closure, for the reasons and periods shown. If you ask us to delete data that falls in one of these categories, the request is completed when the period ends.

Customers control the period for recordings and the fax archive from the settings of their workspace’s recording policy and fax archive. Pulse does not use records kept under this section for any purpose other than the reason shown.

Security

We protect data with encrypted transport (HTTPS), salted-hash passwords, httpOnly session cookies, optional two-factor authentication (which an organization can require), single sign-on (OpenID Connect or SAML 2.0, and Sign in with Microsoft) and SCIM provisioning, organization-set session limits and sign-out everywhere, server-side session checks, role-based access with tenant isolation, rate limiting, pre-publish screening, encryption of recordings, transcripts, and archived files before storage, and audit logs. The Service is for business use by adults and is not directed to children.

8. Product-specific disclosures

Pulse Voice

• Call recording and monitoring. Pulse Voice can record, transcribe, and analyze calls where a Customer turns it on. The Customer is responsible for giving any legally required notice and obtaining any required consent from call participants. If you are a caller and have questions about a recording, contact the business you called.
• Compliance recording. Where a Customer enrolls a workspace in compliance recording, calls are recorded as its recording policy provides. Recordings are encrypted and stored write-once, so they cannot be altered or deleted, by the Customer or by Pulse, until the retention period in the policy ends; a legal hold extends it. Transcripts and AI analysis are produced only if the policy asks for them.
• Callers and end users. Pulse processes data about the people a Customer’s users call, or are called by, as that Customer’s processor. Please contact the relevant Customer about its handling of your data; if Pulse receives a request about such data, we refer it to that Customer.
• Fax archive. Where a Customer turns on the fax archive, the fax documents it sends and receives are encrypted and stored write-once for the retention period set for the Customer’s account, and may be placed on legal hold.
• Provider credentials. AI-provider and carrier credentials a Customer stores are encrypted at rest. Where a Customer connects its own provider account, that provider processes the data under the Customer’s own agreement with it.
• No sale; no model training. Pulse does not sell personal data processed through Pulse Voice and does not use it to train third-party foundation models.

PulseMeet

• Team availability. Members of the same PulseMeet organization can see one another’s working hours and free/busy time, never event titles or attendees.

PulseWork

• Isolation and access. Each organization’s PulseWork data is isolated to that organization. Sessions are kept server-side (only a hash of the session token is stored) and are ended when a person signs out or is removed.
• Email-in. Where a Customer connects a Microsoft 365 mailbox, PulseWork reads messages arriving in that mailbox to open and update tickets.
• Pulse’s own support desk. Pulse’s support desk runs on PulseWork. From June 2026 until October 2026, its tickets were also mirrored to Atlassian Jira Service Management; that mirroring has ended.

Pulse SMS

• Records. Account administrators can place litigation holds (a held message cannot be deleted by anyone), hand a departed employee’s lines to a successor, and export messages. These actions are recorded in an audit log.

Pulse Secure Transfer

• Storage and deletion. Files are encrypted with per-file keys, scanned for malware, and stored write-once for a retention period set by the request’s category. Deleting a request removes it from the staff console but does not destroy the stored files, which cannot be deleted sooner than that period.

Social Command

• Connected platform data. We access only the social accounts you explicitly authorize during connection. Access tokens are stored server-side only and never exposed to the browser. We use platform data solely to provide the posting and engagement features; we do not sell it or use it for advertising or profiling. We post only on an action initiated by an authorized user or a job that user scheduled. Disconnecting an account removes its stored tokens.
• Cookies in the app. The Social Command app uses only strictly necessary cookies: an httpOnly session cookie that keeps you signed in and a short-lived cookie used while you connect an account. It uses no advertising or third-party tracking cookies. Cookies on our website are described in Disclosures & Policies.
• Compliance capture. Where a Customer turns on compliance capture, a copy of its communications is forwarded to the archiving, supervision, or eDiscovery system the Customer configures and controls. That destination is the Customer’s own system or vendor, not a Pulse sub-processor.

9. Changes & contact

We may update this policy; material changes update the effective date. Pulse Payments LLC (dba Pulse Technologies)
9160 Forum Corporate Pkwy, Suite 350, Fort Myers, FL 33905
pulselegal@pulsetechnologies.ai

This Data Processing Addendum (“DPA”) forms part of the agreement between Pulse Payments LLC (dba Pulse Technologies) (“Pulse”, “Processor”) and the customer organization (“Customer”, “Controller”) for use of the Pulse platform. Where Customer Personal Data is processed, this DPA applies.

1. Roles & scope

The Customer is the Controller and Pulse is the Processor of Customer Personal Data. Pulse processes it only to provide the Service and in accordance with the Customer’s documented instructions (these Terms, the Privacy Policy, and this DPA), unless required by law.

2. Processor obligations

• Instructions: process only on the Customer’s documented instructions.
• Confidentiality: personnel are under confidentiality obligations.
• Security: implement the measures in Annex II.
• Sub-processors: engage only those in Annex III, under terms no less protective, and inform the Customer of intended changes.
• Assistance: help with data-subject requests, breach notification, and impact assessments.
• Breach notification: notify the Customer without undue delay.
• Deletion/return: on termination, delete or return within 60 days, except where retention is required by law.
• Audits: make available information to demonstrate compliance and allow reasonable audits.

3. International transfers

Customer Personal Data may be processed in the United States. Transfers from the EEA, UK, or Switzerland to a country without an adequacy decision are governed by the applicable Standard Contractual Clauses (and the UK IDTA), incorporated by reference.

4. Special categories & HIPAA

The Customer must not submit special-category data unless its configuration and legal basis permit it. The Customer may process protected health information subject to HIPAA only under an executed Business Associate Agreement that expressly covers the relevant Pulse services and the configuration the Customer uses. Without such an agreement for a service, that service must not be used to process PHI.

Annex I — Details of processing

Annex II — Security measures

Annex III — Approved sub-processors

The sub-processors below are those Pulse engages as a processor of Customer Personal Data. The maintained list, including providers Pulse uses only for its own controller data, is on the Sub-processors tab.

Some sub-processors are engaged only when a Customer enables the related feature (marked “if enabled”). Where a Customer connects its own third-party provider account with its own credentials (for example its own AI provider or carrier account in Pulse Voice), that provider acts under the Customer’s own agreement and is not a Pulse sub-processor for that data. Where a Customer turns on compliance capture, the archiving, supervision, or eDiscovery system it configures (for example an HTTPS/webhook endpoint, an SMTP journaling address, a Microsoft 365 / Purview mailbox, Proofpoint, or an SFTP feed to Smarsh or Global Relay) is the Customer’s own system or vendor, not a Pulse sub-processor.

Contact

Pulse Payments LLC (dba Pulse Technologies)
9160 Forum Corporate Pkwy, Suite 350, Fort Myers, FL 33905
pulselegal@pulsetechnologies.ai

To deliver the Pulse platform — Social Command, Pulse SMS, Pulse Email / PulseEngage, Pulse Voice, PulseConnect, PulseMeet, PiP for Outlook and Teams, PulseBill and PulsePay, Pulse RFP, Pulse Deals, PulseWork, Pulse SSO / PulseAdmin, and our mobile and desktop apps — Pulse Payments LLC (dba Pulse Technologies) engages the third-party sub-processors below. This is the single list for every Pulse product; the Privacy Policy (Section 5) and the Data Processing Addendum (Annex III) show the same list. Sub-processors are engaged under terms no less protective than the Data Processing Addendum, and Pulse informs Customers of intended changes as described there.

October 2026 update. Beginning October 22, 2026, PulseBill uses CereTax as its production provider for telecom and sales-tax calculation. For invoices issued on or after November 1, 2026, tax associated with issued invoices is also recorded with CereTax for tax reporting.

Some sub-processors are engaged only when a Customer enables the related feature (marked “if enabled”). Where a Customer connects its own third-party provider account with its own credentials (for example its own AI provider or carrier account in Pulse Voice), that provider acts under the Customer’s own agreement and is not a Pulse sub-processor for that data. Where a Customer turns on compliance capture, the archiving, supervision, or eDiscovery system it configures (for example an HTTPS/webhook endpoint, an SMTP journaling address, a Microsoft 365 / Purview mailbox, Proofpoint, or an SFTP feed to Smarsh or Global Relay) is the Customer’s own system or vendor, not a Pulse sub-processor.

Payment card data is entered only on the payment gateway’s hosted pages or passed once to the gateway for tokenization, and is never stored in full by Pulse. To ask about this list, contact pulselegal@pulsetechnologies.ai.