Privacy policy
Draft, under review by our privacy adviser. It describes how InviteLetter works today; the parts in [brackets] are still being confirmed.
InviteLetter is a product of Pulsar Interactive Pte. Ltd., Singapore. UEN 202550480W. Questions about this policy or your data: hello@pulsarinteractive.ai.
Two kinds of data, two roles
For your account (who you are, your organisation, your templates, your plan), Pulsar Interactive decides how the data is used: we are its controller. For the lists you load to make letters, you decide: we act as your data processor under Singapore's and Thailand's Personal Data Protection Acts, and only on your instructions.
Your lists of people: used, never kept
- Your list is read in your browser. It is not uploaded to be stored, and the app never saves it in your browser either; reloading the page clears it.
- To make PDFs, the rows go from your browser to our PDF service in Singapore, which holds them in memory while the letters are made and then discards them. They are never saved to a file, a database, a queue or a log.
- For Word letters, the converter needs files: each filled letter exists only in the PDF service's memory (never its disk) while its batch is converted, at most 2 minutes, and is then deleted.
- Finished letters and the review sheet are downloaded to your computer. We don't keep copies.
- The AI never sees your list: it receives your letter, your column names, and any description or images (such as a logo) you choose to give it.
What we keep
- Your account: email address, name, organisation name.
- Your templates, including uploaded Word letters and their saved versions, and the logos and signatures you upload. These hold wording and images, not anyone's personal details from your lists.
- How many letters and AI readings you used, and when, for your plan's limits and billing.
- Billing details for paid plans, held by our payment provider.
- If you request access on our website: your name, work email, organisation and what you tell us, so we can reply. We use them only to contact you about your request.
- Technical logs with request ids, counts and timings, never list data.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Supabase | Sign-in: your email address and a hashed password | [region to confirm] |
| Vercel | This website, and the details you send with the request-access form on their way to us | Form: Singapore. Pages: served worldwide |
| Railway | The InviteLetter app, the API and database (templates, usage counts), and the PDF service | App and PDF service: Singapore. Database: [region to confirm] |
| Amazon Web Services (S3) | Your logos and signatures; blank letters uploaded for conversion, deleted after 24 hours | [region to confirm] |
| [AI provider to confirm] | Your blank letter and your column names, to build a template. Never your lists. Set to no training and no retention. | [region to confirm] |
| Airwallex | Payments for paid plans | [to confirm] |
How long we keep it
- Account data, templates and images: while your account is open, and deleted when you close it [period after closing to confirm].
- Blank letters uploaded for AI conversion: deleted automatically after 24 hours.
- Usage counts and billing records: as long as the law requires for accounting [period to confirm].
Your rights
You can ask to see, correct or delete the personal data we hold about you, or withdraw consent where we rely on it, by writing to hello@pulsarinteractive.ai. For the people on your lists, you are the organisation responsible; we help you answer their requests as your processor.
If something goes wrong
If a breach affects data we process for you, we tell you without undue delay, so you can meet your own notification duties (72 hours under Thailand's PDPA, 3 calendar days under Singapore's).
Changes
We will post changes here and, for significant ones, tell account holders by email.