Pulse 1C Privacy Policy

Pulse account

If you register, we keep the following until you delete the account:

• your email address, name (if you gave one) and email language;
• your password — only as a scrypt hash; the password itself is not stored anywhere;
• the date of registration and of the last sign-in;
• if you linked Telegram — your numeric Telegram ID and username;
• the list of databases the account can open: database code, role, the database user login (if the database has users; the database user password is not stored), how and when access was granted.

Sign-ins, email codes and links

• Account sign-in: the server keeps only a SHA-256 fingerprint of the sign-in token and the times of sign-in and last activity. A sign-in lasts 12 hours, or 30 days with «remember me», extended while you use it.
• Database sign-in (including by database code without an account): likewise, only a SHA-256 fingerprint of the token, for up to 30 days, extended while you use it.
• An email code is stored only as a scrypt hash and is valid for 15 minutes; an email confirmation link — 48 hours, a password reset link — 2 hours, an invitation to a database — 14 days.
• Per-address email counters (protection against mass mailing) are kept for one day, with the address stored only as a fingerprint.

Data of your 1C database

1C data is read by the PulseBridge program on your computer or by the Pulse server through the web client of a cloud 1C database — using the connection you set up, and only to show it to you and the people you gave access to.

So that reports open quickly, the server keeps copies of what it has read (a cache): report results — from a few minutes to a few hours, reference lists (counterparties, items and the like) — up to 7 days, information about the database structure (chart of accounts, list of objects) and some prepared calculations (for example, the register of electronic documents) — while the database is connected to Pulse. The cache is refreshed when the database changes.

Bank statement reconciliation: the statement file is parsed in your browser and is not uploaded to the server as a whole. For reconciliation with 1C the server receives the parsed lines (document number and date, amount, counterparty with taxpayer number and account, payment purpose) and the file name, bank, account, balances and turnovers of the file. The server compares them with the 1C data and returns the result; statement lines are not written to disk (only 1C data stays in the cache, as for other reports).

Credentials and digital signature keys

If you save them in Pulse yourself: the login and password of a cloud 1C database, logins and passwords of electronic document operators, a digital signature key for signing in to portal cabinets. Passwords and keys are stored on the server encrypted (AES-256-GCM) and are used only to sign in and read. You can delete them in the database section where they were saved or by writing to info@pulse1c.uz.

Assistant

Questions to the assistant, its answers and your ratings of the answers are stored on our server. On the website and in the app the history is linked to the database and to a random browser identifier (the server keeps its hash); it is not linked to your email, name or account. In the Telegram bot the history is stored together with your Telegram ID. The history has no time limit: the assistant uses the messages of the last 24 hours in a conversation, and the whole history and your ratings let the Pulse administrator investigate the assistant’s mistakes. If an automatic check finds a number in an answer that does not match 1C, the question and the answer are written to a check log on the server for the same purpose.

Your conversations with the assistant are not used to train models: Pulse’s own model is trained only on questions to test databases.

Answers are prepared by Pulse’s own model on a server in Uzbekistan, on Pulse’s own hardware: it receives your question and the data from your 1C needed for the answer. Questions and data are not sent to external artificial intelligence services.

Questions to the assistant and its answers are not forwarded to the Pulse administrator in Telegram.

Hints for the assistant that you leave for your database are stored with that database together with a note of who left them. The Pulse administrator receives a Telegram message about new hints without their text: the database code, that a hint (or an «all databases» proposal) appeared, who left it (name or login in Pulse) and when. The administrator sees the text itself only on the Pulse server.

When you delete your account, the history of the Telegram bot linked to the account and the assistant history in the browser you delete the account from (for the account’s databases) are deleted. The rest of the history (from other browsers and devices) cannot be linked to the account by the server — you can have it deleted by writing to info@pulse1c.uz with the database and the approximate time of the questions.

Telegram bot and notifications

• Telegram bot: your Telegram ID, the database code you sent to the bot and the conversation with the assistant (see «Assistant»). If you opened Pulse inside Telegram — the name, username and language from your Telegram profile, and if the administrator opened a database for you through Telegram — the link between your Telegram ID and that database. Kept until you delete the account or ask for deletion by email. The conversation goes through Telegram and is also subject to its rules.
• Notifications in the app: if you allowed them, the server keeps the device token, platform and app version for that database — until the device unregisters or the notification service reports that the token is no longer valid. Notifications are delivered by Google Firebase Cloud Messaging.

Website feedback form

If you write to us through the form on the pulse1c.uz website, we receive your name (if you gave one), email address and/or phone number, the message text and your IP address. Why: to reply to you. Where: the server immediately forwards all of it in one message to the Pulse administrator in Telegram; the message is not saved in the Pulse database; Telegram is only the delivery channel, and no one other than the Pulse administrator receives it. How long: in the administrator’s Telegram chat — for as long as it is needed to handle your request; you can have it deleted by writing to info@pulse1c.uz.

Technical logs and statistics

• Server logs — for troubleshooting and protection against password guessing: IP address, request time and address, database code, report name, errors; for the Telegram bot — your Telegram ID and the beginning of your message to the bot (up to 100 characters); for some assistant answers — the beginning of the question (up to 80 characters); the values of changed database settings; when an email is sent — the email address in shortened form. Logs are kept for 30 days.
• Service messages to the Pulse administrator in Telegram (they contain no assistant questions, answers or hint texts): about a new database being connected, a cloud database request or a database connecting from another computer — database code, organisation name, computer name, IP address, cloud database address; about failures and delays — database code, report name, response time, error text (it may contain the path to the database file on the computer); about an assistant answer not matching 1C — database code, the number in the answer and the number in 1C; about discrepancies found by automatic report checks (for example, a report total did not match its breakdown, or 1C totals lag behind) — database code, report name, account code, period and amounts; about report values that could not be shown in words — database code, report name and up to 8 examples of such values (up to 60 characters each; these may be fragments of report data); about new hints — database code, who and when; about changed database settings — database code and settings section, without values; about administrator actions on a database; a daily summary — the number of questions and hints per database.
• Outgoing email log: address, subject, time sent; the text of an email with a code is erased after sending. The last 500 emails are kept.
• Our own statistics of moves between pages (page address, time, a random tab identifier) — to prepare the reports you are likely to open next. Kept on our server, archived parts are deleted after 30 days; not shared with third-party services.

Backup copy

Every time the server is updated, the previous version of its folder is kept together with a copy of the data as of the update — so that a failed update can be rolled back. This copy is kept until the next server update. If an update is rolled back, the server returns to the data in this copy, and anything deleted after the last update (including a deleted account) may come back; deletion is not repeated automatically — write to info@pulse1c.uz and we will delete it again. The copy of the data taken during a rollback is kept until the administrator clears it manually.

Browser storage

The browser keeps the sign-in token, language, theme, a random browser identifier for the assistant history and similar settings. The server sets one service cookie (pulse_code_bind, 2 days) so that an email code is accepted only in the browser where registration started. There are no advertising or analytics cookies.

Who receives data

We do not sell data, do not show ads and do not use third-party counters or trackers. Data reaches third parties only as follows:

• Brevo — the email provider that delivers our emails (recipient address and email text);
• Telegram — if you sign in with Telegram or use the bot; service messages to the Pulse administrator and messages from the website feedback form also go through Telegram (their contents are listed under «Technical logs and statistics»; they contain no assistant questions or answers);
• Google Firebase Cloud Messaging — delivery of app notifications, if you allowed them;
• Google Fonts and telegram.org — the website pages load a font and the Telegram script from these addresses, so they receive your IP address and browser details;
• electronic document operators and government portals — only when you have connected a cabinet yourself: Pulse signs in with your key or password and reads your data;
• government authorities — only when the law requires it.

Where data is stored

The Pulse server is located in Tashkent (Uzbekistan). The assistant model server is also in Uzbekistan, on Pulse’s own hardware.

Deletion and your rights

You can delete your account in the app or on the website: sign in and press «Delete account» at the bottom of the «My databases» page. What is deleted and what is not is described at https://pulse1c.uz/account-deletion/.

To find out what data about you is stored, to correct or delete it (including database data, assistant history and logs), write to info@pulse1c.uz.

Children

Pulse is intended for accountants and managers of organisations. We do not knowingly collect children’s data.

Changes

A new version is published on this page with its version date.