Privacy policy

Effective from 22 October 2026 · Last updated 27 October 2026. Applies to pagepulse.one, the app.pagepulse.one application and the PagePulse API. The Vietnamese version prevails if the two differ.

1. Who we are

PagePulse ("we") helps businesses and agencies manage many Facebook Pages from one screen. This policy explains what data we collect, why, who we share it with, where it is stored, how long it is kept and how you can exercise your rights. Contact for personal data matters: contact@pagepulse.one.

For your PagePulse account data, we decide the purposes and means of processing. For data of Facebook Pages that a workspace connects (Page information, posts, images, comments), we process it on that workspace's instructions and only to provide the features the workspace uses.

2. Data we collect

Account and workspace

• Email address, display name, chosen language and time zone.
• Password: stored only as a hash (argon2id); nobody can read the original password.
• Two-factor authentication: the TOTP secret is encrypted before storage; recovery codes are stored only as hashes.
• Workspaces, members, roles and invitations.

Security logs

• IP address, time, browser (user agent) and outcome of sign-in, sign-out, password reset, API key use and administrative actions.

Data from Facebook when you connect a Page

• Page ID and name, and the permissions and tasks you grant PagePulse on that Page.
• Page access tokens: encrypted (AES-256-GCM, with PagePulse's own key) as soon as they are received and never shown to anyone again, including you. Facebook user access tokens are used only during the connection and are not stored.
• Webhook events that Meta sends for a connected Page (for example a new post or comment): the raw delivery record, and the original event record delivered to the Page's workspace.
• The app-scoped Facebook user ID of the person who connects, and the permissions that person granted: stored per connection and kept after disconnecting, until you ask for deletion.

Page content and commenters

• Posts you write, schedule or submit for approval in PagePulse, and the result of publishing them to Facebook.
• Images you upload to publish (JPEG, PNG, GIF) and the technical information that comes with them.
• Comments on connected Pages: content, time, hidden or deleted status, the ID Meta assigns to the commenter, and the commenter's name when Meta provides it (the name is shown to the workspace only when that feature is permitted). We do not store commenters' profile pictures.
• Actions to reply to, hide, unhide or delete comments and to approve posts, together with the member or API key that performed them.
• Posts your Page published in the last 30 days, including posts not published through PagePulse, are read from Facebook once a day. For each post we store its link, publishing time and the number of reactions, comments and shares. For posts not published through PagePulse we also store the beginning of the text, up to 280 characters. We do not store images, videos or information about the people who interacted. The text is deleted 30 days after the post was published. All of this data is deleted when you disconnect the Page or request deletion of your data.

Transactional email

• Recipient address, message type (password setup, invitation, security alert) and delivery status.

If you comment on a Page that uses PagePulse

The Page owner (the workspace that connected the Page) decides how your comment is used; PagePulse receives the comment through Meta and processes it on their behalf. Comments are kept for 180 days from the time Meta records them (creation or last edit), longer when there are actions on the comment (up to 180 days after the last action ends). If you delete your comment on Facebook while the Page is still connected, about 30 days later its content, your name and your ID are removed from the comment stored in PagePulse; the original event record from Meta is deleted on the schedule in section 7 (180 days from receipt). To make a request about your data, contact the Page owner or follow the data deletion instructions.

We do not intentionally collect sensitive personal data; however, content that Facebook users write themselves (posts, comments) may contain such data. We do not sell data, do not use your data or Facebook data for advertising, and do not use Facebook data to train artificial intelligence models.

3. Why we use it

• To provide the service you ask for: sign-in, managing workspaces, members and invitations (including sending invitation email), connecting Pages, receiving and showing Page events and comments.
• To publish posts and images to Pages on the workspace's behalf, on the schedule set and through an approval step if the workspace uses one.
• To reply to, hide, unhide or delete comments when a workspace member asks.
• To check the format of images and scan them for viruses before use.
• To let tools that the workspace connects itself with an API key (including AI assistants through MCP) read data and take actions on the workspace's instructions.
• To protect accounts and systems: detecting unusual sign-ins, rate limiting, investigating incidents.
• To send operational email needed for your account (no marketing email without your consent).
• To help you when you contact us, and to handle deletion and other data requests.
• To comply with Vietnamese personal data protection and cybersecurity law.

PagePulse does not send data to AI providers on its own and does not use data to train models. Data received from Facebook is used only to perform the features the workspace uses, in line with Meta's Platform Terms.

4. Legal basis

• Account and workspace: to perform the service agreement (the terms of service) you accept when you create an account or accept an invitation; this is a case of processing without consent under Article 19 of the Law on Personal Data Protection No. 91/2025/QH15. Consent is used only for optional purposes; PagePulse currently has none.
• Security logs: to protect systems and accounts, and to meet legal obligations where they apply.
• Page and comment data: processed on the workspace's instructions; the workspace is responsible for having a lawful basis towards the people concerned.

5. Sharing

• Workspace members see data according to the role and Page access granted by the workspace owner or admins.
• Meta receives content when you publish posts or act on comments through PagePulse.
• Tools or AI assistants that the workspace connects itself with an API key or MCP receive data on the workspace's instructions and responsibility; PagePulse does not send data to these tools on its own.
• Meta may receive the workspace's name and contact details when Meta requests them under its platform terms.
• Competent government authorities receive data when they make a valid request under the law, limited to the minimum necessary.
• The service providers in section 6 process data for us within the scope of what they do.
• If responsibility for the data moves to a company that operates PagePulse, we will notify you by email in advance and follow the law and Meta's terms.

Apart from the cases above, we do not share or sell data.

6. Where data is stored and service providers

PagePulse's server is located in Vietnam; data is processed and primarily stored there. Traffic passes through Cloudflare's network. Encrypted backups are stored on Cloudflare R2 in the Asia-Pacific region, and a second encrypted dump is kept on the operator's administration machine in Vietnam. Images you upload to publish are stored on Cloudflare R2 in the Asia-Pacific region.

Meta is the platform you connect, not a service provider to us: data you exchange with Facebook is processed by Meta under Meta's own terms and policies, not on our behalf.

Some providers are outside Vietnam. We prepare and file the impact assessment for transferring personal data abroad under Law No. 91/2025/QH15 within the statutory time limit. When we add or change a service provider that processes personal data, we update this table and give advance notice as described in section 13.

7. Retention

When you disconnect Facebook or remove PagePulse

• Disconnecting Facebook in PagePulse: PagePulse deletes that connection's tokens, unsubscribes from events, stops syncing and stops receiving new data for the Pages that belong only to that connection. Scheduled posts are not cancelled automatically; if the Page is still disconnected at the scheduled time, the post is not published.
• Removing PagePulse under Business Integrations on Facebook: Facebook revokes PagePulse's access, the tokens you granted stop working, PagePulse can no longer act on your behalf and the Pages need to be connected again.
• In both cases: stored data is deleted according to the table above, or earlier when you send a deletion request; nothing on Facebook is deleted; backups expire after 35 days, and if we have to restore from a backup, recorded deletion requests are applied again before the system runs again.

8. Cookies and tracking

• Sign-in cookies on app.pagepulse.one: a session cookie (valid for about 15 minutes), a session refresh cookie (up to 30 days) and a cookie that binds the session against forgery. All three are required to sign in.
• The light or dark theme cookie (when you choose one) lasts 1 year. The language cookie records the interface language and lasts only for the browser session.
• The pagepulse.one site can set only the light or dark theme cookie, when you choose one.
• We do not use analytics, advertising tags, the Facebook Pixel or reCAPTCHA. PagePulse email does not track opens or link clicks.
• Because only essential cookies are used, PagePulse has no cookie consent banner.

9. Security

• Connections from browsers and applications to PagePulse use HTTPS and then pass through an encrypted tunnel to the server; connections from PagePulse to service providers use TLS.
• Facebook tokens and two-factor secrets are encrypted with AES-256-GCM using PagePulse's own key before storage. Passwords are stored only as argon2id hashes.
• Images are stored privately, checked for format and scanned for viruses, and can be accessed only through temporary links valid for at most 15 minutes.
• Each workspace's data is separated by database-level access control; members only see Pages they are granted.
• System administration is logged; backups are encrypted before they leave the server.

If a data incident occurs, we notify affected workspace owners without undue delay and no later than 48 hours after discovery; we notify the competent authority within 72 hours as required; and we notify affected people where the law requires.

10. Possible risks

• Without an email address you cannot create a PagePulse account.
• When you disconnect, or Meta revokes access, the features for the affected Page stop.
• A leaked password or API key can expose workspace data. Turn on two-factor authentication and tell us at once if you suspect a leak.
• An incident at a service provider can interrupt PagePulse.

11. Your rights and response times

You have the right to be informed, to access, correct, obtain a copy of and delete your data, to withdraw consent, to object to or restrict processing. You also have the right to complain, to denounce, to sue and to claim compensation for damage under the law; the specialised personal data protection authority is under the Ministry of Public Security.

Send requests to contact@pagepulse.one. If you have a PagePulse account, send from your account's email address; if you do not (for example you commented on a Page that uses PagePulse), follow the data deletion instructions. We verify identity before acting on a request. Copies of data are provided in electronic form.

12. Who may use PagePulse

PagePulse is a tool for businesses and professionals and is not intended for anyone under 18.

13. Changes

When this policy changes we publish the new version on this page with its effective date. For material changes, including adding or changing a service provider that processes personal data, we email workspace owners at least 15 days before the effective date. Changes required by law, by Meta or for security reasons may apply sooner, with the reason stated.