Privacy policy

LocalPulse is provided by Prompt6 Limited, a company registered in New Zealand (“we”, “us”). This policy explains how we handle personal information when you visit our website, use the LocalPulse service, subscribe to our emails or contact us. We follow the New Zealand Privacy Act 2020 and, where they apply to you, the Australian Privacy Principles and the UK General Data Protection Regulation.

Questions or requests: email support@prompt6.com.

The short version

• We collect what we need to run your account and to reply to you.
• We store your business’s demand as one total per day. We never store your customers’ names or phone numbers.
• We don’t sell personal information and we don’t use advertising cookies or trackers.
• Marketing emails are opt-in, and every one has a one-click unsubscribe.

What we collect

Account and team. Your email address, an optional display name, your password (stored only as a secure hash by our authentication provider), the organisations you belong to and your role in each, and invitations you send or receive.

Business data you add. Business name, type and location (town and map coordinates), daily demand totals, optional booking-date counts, optional counts of customers by home country, events you log and web pages you add as sources. When you import a file, its raw rows are read during the import and then discarded. Only the daily totals and the per-country counts are kept.

Billing. Payments are handled by Stripe. We receive your Stripe customer reference, plan, billing currency, subscription status and invoice records. We never see or store full card numbers.

Email preferences. Your choices for the newsletter, product tips and briefing emails, and a record of each consent: when and where you gave it, the wording shown, and a salted one-way hash of your IP address. We also receive delivery events (for example a bounce or a spam complaint) so we can stop sending to addresses that can’t or don’t want to receive our email.

Enquiries. If you contact us or ask for a demo: your name, email, company, business type, number of locations, town and your message. We don’t ask for a phone number.

Technical information. Our hosting providers process IP addresses and request details to deliver the site and keep it secure. Where we keep an IP address ourselves (for rate limiting, abuse prevention and consent records) we store only a salted one-way hash of it. We measure page views with cookieless, aggregated analytics that do not identify you or follow you across sites.

What we don’t collect. We don’t collect information about your customers as individuals, and our import is built to discard it. Please don’t type customer names or contact details into free-text fields such as event notes.

How we use it

• To provide the service: sign-in, your dashboards, forecasts, explanations and briefings, team access and support.
• To bill you and keep the records the law requires.
• To send account and service emails, including trial reminders and a few onboarding tips. You can switch tips off at any time; account and billing notices are part of the service.
• To send the newsletter, only if you have opted in and confirmed.
• To keep the service secure: rate limits, bot checks and audit logs of sensitive actions.
• To improve LocalPulse, including the starting assumptions every new business begins with (see “Pooled learning” below).

If UK GDPR applies to you, our lawful bases are: performance of our contract with you (providing the service and billing); legitimate interests (security, service emails and tips, product improvement and pooled learning, replying to enquiries); legal obligation (tax and accounting records); and consent (the newsletter, which you can withdraw at any time).

Pooled learning

Each business’s model learns how much drivers such as rain, events or holidays move its demand. We combine these learned effects across businesses of the same type, as anonymous medians, to set better starting assumptions for new businesses. What is pooled is a set of percentages per driver, not your demand figures, your name or your location, and no customer can see another customer’s data.

AI processing

Some features use AI services: Anthropic’s Claude writes explanations, briefings and researches unexplained days, and TypeSafe’s System One classifies events and headlines. For these we send aggregated figures, your business type and town, and public information such as event listings and news headlines. We don’t send your customers’ personal information, and we don’t use AI to make decisions about you that have legal or similarly significant effects.

Who we share it with

We use trusted providers (sub-processors) to host and run the service. Each processes personal information only on our instructions and under contractual privacy and security commitments. The current list, with what each one does and where, is on our sub-processors page.

We will also disclose information if the law requires it, to protect our rights or someone’s safety, or to a buyer of our business, who would have to honour this policy. Members of your organisation can see the organisation’s business data and the names and emails of other members.

Where it is stored

Our main database is in Sydney, Australia. Some providers process information in other countries, including Singapore, Japan and the United States. When we send personal information overseas we take reasonable steps to make sure it is protected in a way that is comparable to New Zealand law, through the provider’s contractual commitments. For UK users, transfers rely on adequacy regulations or the UK’s approved data-transfer agreements.

How long we keep it

• Account and business data: while your account is active. After a trial or subscription ends, your account stays read-only for 90 days; after that we ask you before deleting anything.
• When you delete your account, we delete your personal information and any organisation you are the only member of, within 30 days, except as listed below.
• Unsubscribes and bounces: we keep the email address on a suppression list so we don’t email you again. If you ask us to erase your data, we keep only a one-way hash of the address for this purpose.
• Consent records: for as long as we rely on the consent, and up to two years after, so we can show it was given.
• Billing records: seven years, as New Zealand tax law requires.
• Enquiries: up to two years after our last contact, unless you become a customer.

Security

Data is encrypted in transit and at rest by our providers. Access is restricted to people who need it, every request to the app is checked against your role, sign-in tokens and invitation links are signed or hashed, and sensitive actions are logged. No system is perfectly secure; if a breach is likely to cause serious harm we will notify you and the relevant regulator as the law requires.

Your rights

You can ask for a copy of the personal information we hold about you and ask us to correct it. If UK GDPR applies, you can also ask us to erase it, restrict or object to how we use it, or give you a portable copy, and you can withdraw consent at any time. Most of this you can do yourself on your account page and email preferences page; for anything else, email support@prompt6.com. We will reply within 20 working days (or one month under UK GDPR) and may need to confirm your identity first.

Complaints

Please talk to us first at support@prompt6.com. If you are not satisfied, you can complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz), the Office of the Australian Information Commissioner (oaic.gov.au) or the UK Information Commissioner’s Office (ico.org.uk).

Cookies

We use only the cookies needed to sign you in and remember your settings. See our cookie notice for the full list.

Children

LocalPulse is a business service and is not intended for anyone under 16. We don’t knowingly collect information from children.

Changes

We will update this policy when our practices change and show the date at the top. If a change is significant, we will tell account holders by email before it takes effect.