← Pulsessivo
✕

Privacy Policy

Last updated: 25 April 2026

SeyedHossein JavadiZavieh is the data controller and provides the Pulsessivo.ai service (the “Service”) under the Pulsessivo.ai name (“we”, “us”, “our”). This Policy explains how we collect, use, disclose, and protect personal data, and your rights under applicable law (including the EU/UK GDPR).

1. Scope

This Policy applies to our website, applications, and related services. It does not apply to third‑party services outside our control.

2. Sources of Personal Data

  • Directly from you or the organization managing your team: account creation, billing, support communications, optional hardware orders (e.g., PULSESSIVO Smart Bracelets as discounted add-on, available exclusively with yearly subscription plans), and information provided by clubs, academies, schools, federations, or coaches acting on behalf of players in organization-managed youth programs.
  • Automatically: via your device/browser (e.g., IP address, user agent, usage events) and from wearable devices (e.g., biometric data from smart bracelets).
  • From service providers: fraud prevention, payments, hosting/transport, shipping carriers. We do not buy personal data.
  • Billing & Transactional Data: plan selection, purchase history, VAT/IVA number, billing address and country, applicable VAT/OSS rate, invoice metadata (including invoice number, totals, and stamp duty (imposta di bollo) applicability), voucher redemptions and discounts applied (e.g., annual-plan promotions), optional hardware purchases (including bracelet orders as discounted add-on at €39.99 per unit, available only with yearly plans, and shipping details).

3. Categories of Data We Process

  • Account & Identity Data: name, email, password (hashed), profile details, organization, role, and, where a customer operates an organization-managed youth program, team affiliation, age band, and parent/guardian contact details provided by the Controller.
  • Transactional Data: plan details, purchase history, VAT/IVA information, invoice details, hardware purchases (bracelet orders, shipping addresses).
  • Usage & Technical Data: IP address (with anonymization where feasible), device identifiers, browser type, pages viewed, actions taken, diagnostic logs.
  • Biometric & Health Data: where you use PULSESSIVO Smart Bracelets, we process biometric data (heart rate, activity levels, performance metrics) for the purpose of providing wellness monitoring and performance analytics. This data is processed under your instructions as controller (or with player consent where you act on behalf of players). See our DPA for processor obligations.
  • Support Data: messages and attachments you submit via email or our AI Chat Bot, plus related metadata.
  • Cookies & Similar Technologies: see our Cookie Policy.
  • Customer Content: data you upload or generate within the Service (processed as processor under our DPA when you control the data).
  • Do Not Track: we do not respond to DNT signals; we honor your cookie/consent preferences.

4. Purposes and Legal Bases (GDPR Art. 6)

We process personal data for:

  • Providing the Service and managing accounts – contract performance.
  • Billing, tax, and invoicing: to calculate and apply taxes (including VAT/IVA and, where applicable, EU OSS destination VAT), determine imposta di bollo (Italian stamp duty) eligibility for invoices issued without VAT, and to issue compliant e-invoices (SDI) and receipts.
  • Hardware fulfillment: to process, ship, and support optional hardware orders (e.g., PULSESSIVO Smart Bracelets as discounted add-on at €39.99 per unit, available only with yearly plans) – contract performance.
  • Biometric data processing: to provide real-time monitoring and analytics via smart bracelets – explicit consent (GDPR Art. 9(2)(a)) or necessary for health monitoring purposes where you act as controller on behalf of players (Art. 9(2)(h) with appropriate safeguards).
  • Security, fraud prevention, and abuse detection – legitimate interests and legal obligation.
  • Analytics and service improvement (via Google Analytics configured with privacy safeguards) – consent where required; otherwise legitimate interests (aggregate statistics, IP anonymization, limited retention).
  • Communications and support (email and AI Chat Bot powered by OpenAI API) – contract and legitimate interests. Chat conversations are processed by OpenAI to provide natural language understanding and automated assistance.
  • Marketing communications – consent (where required); you can withdraw at any time.
  • Compliance and enforcement – legal obligation and legitimate interests.

We do not use your data for automated decision‑making that produces legal effects (GDPR Art. 22).

We also process data as necessary to comply with tax, invoicing, and accounting laws (e.g., e-invoicing via SDI, VAT/OSS reporting, and record-keeping obligations).

5. Sharing of Personal Data

We may share personal data with:

  • Service providers under data protection agreements, including Hostinger (hosting and email infrastructure), Google (analytics), OpenAI (AI Chat Bot for customer support), and shipping carriers (for hardware delivery).
  • Professional advisors (legal, accounting) under confidentiality.
  • Authorities when required by law or to protect rights and safety.
  • Corporate transactions (merger, acquisition, financing) with appropriate safeguards.
    We do not sell personal data.

6. International Transfers

Where personal data is transferred outside the EEA/UK, we rely on adequacy decisions or Standard Contractual Clauses and implement supplementary measures as needed.

7. Data Retention

We retain invoices, VAT/OSS records, and related billing documentation for the period required by applicable law (typically up to 10 years in Italy), unless a longer period is required for the establishment, exercise or defense of legal claims.

We retain personal data only as long as necessary for the purposes described, including to comply with legal, accounting, or reporting requirements. Indicative periods:

  • Account data: life of the account + up to 6 years (tax/contract).
  • Support tickets/chats: 12–24 months.
  • Analytics events: typically 14 months (Google Analytics default options may apply).
  • Backups: up to 90 days.
    When no longer needed, data is deleted or anonymized.

8. Your Rights

Subject to conditions and exemptions under GDPR, you have the right to access, rectify, erase, restrict, object, and data portability, and to withdraw consent at any time. Where the data subject is a minor, a parent or legal guardian may exercise rights on the minor's behalf where permitted by applicable law. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) or your local authority. To exercise your rights, contact our Privacy Contact Point below. We aim to respond within 30 days (extendable where permitted).

9. Security

We implement appropriate technical and organizational measures (encryption in transit, access controls, logging, backups, secure development practices). No method of transmission or storage is 100% secure.

10. Children’s and Youth Teams Privacy

The self-service Service is not intended for children under 16 acting on their own, and we do not knowingly allow direct self-registration by children under 16.

However, the Service may be used by clubs, academies, schools, federations, and coaches to manage organization-managed youth teams, including athletes under 18, where the relevant organization acts as controller (or is otherwise authorized to instruct us) and complies with applicable law. In those cases, the organization is responsible for age verification, providing required notices, limiting access to authorized staff, and obtaining parent/guardian consent and player assent where required, especially for biometric or health data.

If smart bracelets or similar devices are used with minor athletes, collection must be limited to general wellness, workload, training, and sports performance purposes and must not be used for medical diagnosis or unlawful health surveillance.

See our Youth Privacy Notice and Parent or Guardian Consent Form for recommended implementation materials for youth-team deployments.

If we learn that data from a child under 16 was collected outside an organization-managed youth program or without the required authorization, we will delete that data or request the controller to do so.

11. Cookies and Tracking

We use cookies and similar technologies for authentication, preferences, analytics, and performance. See the Cookie Policy for details and choices, including how to withdraw consent for non‑essential cookies.

12. Acting as a Processor

For Customer Content that you control, we act as processor and process such data according to your instructions under our DPA.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a revised “Last updated” date and, where appropriate, notify you of material changes.

14. Contact