What wehold

Two roles

For your account, we decide how Pulsar uses that data. We are the controller of host accounts.

For guest lists, the host decides what to collect and why. The host is the controller of that list. We store it so the door can run.

Account data

When you sign up we store your name, email, a hashed password (not the password itself), organization name, and your role. We keep a signed session cookie so you stay signed in.

Guest data we store for hosts

What a host's form collects, we store so staff can find a name and let the right people through.

• First name, last name, and email, which every registration includes.
• Answers to questions the host adds: phone, company, ticket type, address, and similar.
• Registration status, check-in time, and payment status the host records by hand.
• A snapshot of the host's disclaimer if they used one, and when the guest accepted it.
• Which staff member scanned a credential, plus limited device details on a scan (browser, platform) so a failed scan can be understood.

Credentials

The QR encodes a random token, not a name. The server looks up the token to see if that person may enter. If a credential is revoked or expired, the door should refuse it.

Email

If a host's event is set to confirm registration, we send the guest a message with a link to their credential. We send that through Resend. We log that we tried, including the address and whether it sent.

Cookies

We set only what the product needs to run. We do not currently set analytics or advertising cookies.

• ew_session: keeps a host signed in. HttpOnly, about 30 days.
• NEXT_LOCALE: remembers English or Spanish.

Where it lives

Guest and account data sit in a PostgreSQL database hosted by Neon. The application is hosted by our hosting provider. Confirmation email goes through Resend. Those processors see only what they need to provide the service.

Why we use it

To run the product you asked for: accounts, lists, credentials, check-in, and an audit of sensitive actions such as edits and revokes.

We do not sell lists. We do not use guest names to advertise Pulsar to those guests.

Who sees it

People the host adds to the organization, with the slice their role allows. Our processors (Neon, Resend, hosting) as needed to keep the door live. We share data if the law requires it.

How long

Account data lasts while the account exists. Guest data lasts while the host keeps the event or attendee. Hosts can delete attendees. If you want an organization removed, write us.

Your rights

You can ask to see, correct, or delete personal data we hold, or get a copy. Hosts should handle guest requests for their own lists first. We will help when we must.

Write hello@hipulsar.com. We may need to verify it is you.

Children

Pulsar is built for hosts running nights, not for children to use on their own. Hosts must not collect data from children where the law does not allow it.

Transfers

We and our processors may store data in the United States or other countries. If you access Pulsar from elsewhere, you understand that.

Security

Passwords are hashed. Session cookies are httpOnly. Credential tokens are random and not derived from a guest's name. No system is sealed. Tell us if you think a door was left open.

Changes

We will post updates on this page.

Contact

Privacy questions: hello@hipulsar.com