Privacy and cookies

PulseCheck is run by NimblePanda Ltd, registered in England and Wales, company number 17122751, registered office 30 Grange Road, Barnton, CW8 4PE. Email hello@nimblepanda.co.uk about anything on this page.

PulseCheck shows a one-question survey on a customer's website and collects the answers. That means we hold two different kinds of data, and it matters which is which.

For account data, meaning the details of the customer who signs up, we are the data controller. For survey responses collected through a customer’s own website, that customer is the controller and we are their processor: we hold and display the data on their instructions and do nothing else with it.

Your email address, used to sign you in and to send service email such as a magic link or a notification you asked for. Your projects and their settings. Nothing else: there are no marketing lists and no profiling.

The legal basis is performing the contract you entered into when you signed up.

The answer given, the page it was given on, a coarse timestamp, and a randomly generated identifier so the same person is not asked twice. We do not ask for a name or an email, and we do not use tracking pixels or cross-site identifiers.

If a survey asks a free-text question, whatever the respondent types is stored. Customers choose their own questions, so a badly worded one could invite personal information. Ask for opinions, not identities.

We never sell this data, never use it to build advertising profiles, and never combine it across different customers.

Essential cookies keep you signed in to the dashboard. They cannot be switched off without breaking sign-in, and they need no consent because the service does not work without them.

Anything beyond that is optional and stays off until you accept the notice. If you accept, we use Google Analytics and Microsoft Clarity on our own marketing pages to see what people struggle with. Decline and neither loads, and no analytics cookie is set.

The widget itself sets no advertising or tracking cookies on a customer’s website.

Supabase hosts the database and handles sign-in. Vercel serves the application. Resend sends transactional email. Each acts on our instructions only, and we use no advertising networks anywhere in the product.

Account data stays while your account exists. Submitted data stays until the customer who owns it deletes it or closes their account. Ask us to delete an account and we remove the personal data within 30 days, keeping only what the law requires.

You can ask for a copy of your data, ask us to correct or delete it, or withdraw analytics consent at any time. Email us and we will deal with it.

If you submitted a response or a report through a widget on somebody else’s website, that company is the controller, so ask them first. Contact us and we will pass the request on and help them action it.

If you are unhappy with how we have handled your data and we have not put it right, complain to the Information Commissioner’s Office at ico.org.uk.

You are the controller for what your visitors submit. That means your own privacy notice needs to mention it, you need a lawful basis for collecting it, and you must not use PulseCheck to gather data you would not otherwise be entitled to collect. Our terms cover this in more detail.