Privacy Policy

Titus Pulse is operated by Titus Hub Inc. (“we”, “us”). This policy explains what we collect, why, who we share it with, how long we keep it, and how to have it deleted. It covers the Titus Pulse web application at tituspulse.com and the emails it sends.

Who this policy is about

Titus Pulse is used by people who report on websites for their clients. Two groups of people appear in it:

• Account holders: the people who hold an account, sign in, connect a Google account and approve reports.
• Report recipients: the people an account holder nominates to receive a site's report by email. They have no account and we hold only what is needed to send and to stop sending.

For the data an account holder brings into the service about the sites they manage, the account holder is the controller and we act on their instructions as a processor. For account data, we are the controller.

What we store

• Account: your email address, display name, a hashed password (held by Firebase Authentication; we never see the password), whether your email is verified, and sign-in timestamps.
• Account settings: the account name, time zone and reporting settings.
• Sites: the site names and web addresses you enter, and which Google Ads account, ChatGPT Ads account, Google Analytics 4 property and Search Console property each one is mapped to.
• Report recipients: the name (optional) and email address of each person you choose to send a site's report to, plus a record of each report delivered to them and whether they have unsubscribed.
• Report data: the weekly and monthly metrics read from the Google account you connect and, if you connect them, ChatGPT Ads and Bing Webmaster Tools; the generated reports, the note you write, and a record of who approved each report and when.
• Google credentials: the identifier and email address of the connected Google account, the scopes it granted, and the OAuth refresh token. Refresh tokens are encrypted at rest with AES-256-GCM under a key held in Google Secret Manager, are never displayed in the interface, and are never sent to your browser.
• Domain checks: once a day, each site's public DNS records, HTTPS certificate details, registration dates, homepage, robots.txt and sitemap. Where you have connected them, also the Cloudflare zone's DNS records, settings and registrar status, and the DMARC reports Cloudflare received for the domain over the last 30 days (the names of the networks that sent email claiming to be from it, how many messages and sending addresses, and whether the messages passed; never the addresses themselves); the Search Console property's permission level, submitted sitemaps and whether Google has indexed the homepage; and Bing's sitemap and crawl reports for the site. A DMARC record can name the address that receives its reports. Only the latest check per site is kept, apart from the DMARC reports: each day's message counts, and when each sending network was first and last seen, are kept for 13 months.
• SEO audits: once a week, up to 50 public pages of each site are read by our crawler (it identifies itself as TitusPulse-DomainCheck), and the links on them are checked. We store what the checks found: page addresses, titles and descriptions, whether pages and links load, each page's Search Console clicks over the last four weeks, the site's Google Analytics measurement IDs, how many links other sites make to its pages and a few of the pages making them (from Bing), and the problems found. Only the latest finished audit per site is kept, plus the one in progress.
• Page speed and accessibility checks: once a week, the address of each site's homepage, and of up to four more of its pages (those with the most Search clicks, else pages the homepage links to), is sent to Google's PageSpeed Insights, which loads the pages in Lighthouse. To find the pages it links to, our crawler reads the homepage. We store the page speed scores and load times, the accessibility score, the accessibility rules a page failed, and a few examples of the page elements that failed (a short piece of the page's HTML, its text and where it is on the page). Only the latest check per site is kept.
• Cloudflare credentials (optional): if you connect Cloudflare, the API token you paste, its last four characters and the names of the zones it can see. The token is encrypted at rest the same way as Google refresh tokens, is never displayed or sent to your browser, and is only ever used to read your zones' DNS records and settings, and the registrar status of domains registered with Cloudflare.
• Bing Webmaster Tools credentials (optional): if you connect Bing Webmaster Tools, the API key you paste, its last four characters and the list of sites in that Bing account. The key is encrypted at rest the same way as Google refresh tokens, is never displayed or sent to your browser, and is only ever used to read, never change, your sites' data in Bing: search clicks and impressions for the reports, and sitemaps, crawl issues, when Bing last crawled the homepage, and the pages other sites link to, for the health checks.
• ChatGPT Ads credentials (optional): if you connect ChatGPT Ads, each API key you paste (OpenAI issues one per ad account), its last four characters, and the ad account's ID, name, currency and time zone. Keys are encrypted at rest the same way as Google refresh tokens, are never displayed or sent to your browser, and are only ever used to read, never change, the ad account's reporting: spend, impressions, clicks and conversions for the account and its campaigns.
• Operational logs: request and error logs used to keep the service running. We do not log report note text, and we avoid logging email addresses and tokens.

We do not ask for, and have no use for, special-category data. Please do not put personal information into free-text fields such as a site name or a report note beyond what your client would expect to read.

Data from your Google account (Limited Use)

When you connect a Google account, we ask Google for permission to read reporting data on your behalf. The scopes we request are:

• https://www.googleapis.com/auth/webmasters.readonly: Google Search Console, read-only. Your verified properties, and clicks, impressions, click-through rate, average position, queries and pages for the report period. For the health checks: a property's sitemaps and your permission level on it, whether Google has indexed the site's homepage, and which pages got the most clicks over the last four weeks, so the weekly SEO audit reads the pages that matter.
• https://www.googleapis.com/auth/analytics.readonly: Google Analytics 4, read-only. Your properties, and aggregate metrics such as sessions, users, engaged sessions and key events for the report period. For the health checks: the measurement IDs of a property's web streams, to check that the site's pages carry the right Google Analytics tag.
• https://www.googleapis.com/auth/adwords: Google Ads. Google does not publish a read-only variant of this scope, so it is the one we must request; we only ever issue read (search) requests with it, for account and campaign performance figures such as cost, clicks, impressions and conversions. We do not create, edit, pause or delete anything in your Google Ads account.
• openid and email: so we can show you which Google account is connected and keep a reconnection attached to the same account.

Titus Pulse's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms, data read from a connected Google account is:

• used only to build and deliver that account's reports, to run the health checks on that account's sites and report their results to the account holder, and to show you the state of the connection;
• never sold or licensed to anyone;
• never used for advertising, ad targeting, profiling or market research;
• never used to train machine-learning or artificial intelligence models, ours or anyone else's;
• not read by humans, except where you have asked us to look at something, where it is necessary to investigate a security incident or abuse, or where the law requires it;
• not transferred to third parties except to the infrastructure providers listed below that we need in order to run the service, or where the law requires it.

You can revoke our access at any time from the connections screen in the app, or from your Google account permissions page. When you disconnect, we delete the stored tokens, revoke them at Google, and unlink every site from that account. Health-check results that used it are replaced at each site's next check, and reports already generated from it are kept for the retention period below unless you ask us to remove them.

Emails we send

Two kinds of email leave the service: account email to account holders (address verification, password reset, a copy of each report you approve, and notices: reports ready, a report that failed or could not be delivered, a recipient who unsubscribed, and new problems or DNS changes found by a health check) and report email to the recipients an account holder nominates.

Both are delivered through Brevo, our email provider, acting as a processor on our instructions. Brevo receives the recipient address and the message content in order to deliver it. See Brevo's privacy policy.

Every report email carries an unsubscribe link. An unsubscribe is recorded against that recipient and that site's report, and is honoured: we will not send that report to the address again, and an account holder cannot switch it back on. The account holder is told by email which address unsubscribed. Brevo also tells us when a report email bounces permanently or is marked as spam: we then stop sending reports to that address for every site of the account, record why, and tell the account holder.

Cookies and local storage

Our public pages (the home page, the contact page, and these legal pages) use Google Analytics to count visits and see which pages are read. It sets first-party cookies (_ga and _ga_*) that tell repeat visits apart, and Google receives your IP address, browser details and the pages you view. We use it only for these aggregate statistics, not for advertising. It is not loaded in the app you sign in to, or on the email preferences page that report recipients reach from an email. You can opt out with Google's Analytics opt-out add-on or by blocking cookies for this site. We use no advertising cookies.

In the app, Firebase Authentication keeps you signed in with a session token in your browser's IndexedDB storage (clearing site data signs you out); the app keeps a flag in local storage noting that this browser is signed in, so the sign-in page can wait for your session instead of flashing a form; and the dashboard remembers whether its sidebar is open in a first-party cookie, sidebar_state, for 7 days. None of these app items is used to track you.

Where the service runs, and who else processes data

• Google Cloud / Firebase: Firebase Authentication, Cloud Firestore and Firebase App Hosting. This is where the application runs and where the data described above is stored. The application backend runs in Google's us-east4 region in the United States.
• Brevo: transactional email delivery, as described above.
• Google Analytics: visit statistics for our public pages, as described under cookies above.
• Google Ads, Google Analytics and Google Search Console: the sources we read from, on your instruction and with your permission.
• Google PageSpeed Insights: runs the page speed and accessibility checks. Only the addresses of public pages are sent to it.
• Cloudflare: if you connect it, the source of your zones' DNS records and settings, read with the token you provide. Domain checks also query public DNS through resolvers run by Cloudflare and Google, and public registration data from domain registries. Only domain names are sent to them.
• OpenAI (ChatGPT Ads): if you connect it, the source of your ad accounts' ChatGPT Ads figures, read with the keys you provide.
• Microsoft Bing Webmaster Tools: if you connect it, the source of your sites' Bing search figures, sitemaps, crawl issues and inbound links, read with the key you provide.

The health checks also read each site's public web pages, robots.txt and sitemap directly from the site, identifying themselves as TitusPulse-DomainCheck. The SEO audit also reads pages that robots.txt asks search engines to skip, so it can report an important page that search engines are blocked from.

We will update this list before adding any other processor that handles personal data.

How long we keep things

• Reports, report versions and delivery records: 25 months, so that a report can always be compared with the same period a year earlier. Automatic deletion after 25 months is not switched on yet; until it is, they are kept, and you can ask us to delete them at any time.
• Google refresh tokens: until you disconnect that Google account or the account is deleted, whichever comes first.
• The Cloudflare token: until you disconnect Cloudflare or the account is deleted, whichever comes first.
• The Bing Webmaster Tools key: until you disconnect Bing or the account is deleted, whichever comes first.
• ChatGPT Ads keys: until you remove that ad account or the account is deleted, whichever comes first.
• Domain check results: only the latest check per site; each new check replaces the one before.
• SEO audit results: only the latest finished audit per site, plus the one in progress; each finished audit replaces the one before.
• Account, site and recipient records: until you ask us to delete them or the account is deleted. You can remove recipients yourself; a site you archive keeps its records.
• Suppression records (unsubscribes): kept for as long as the account exists, because deleting them would let a suppressed address be emailed again.
• Operational logs: up to 30 days.

Your choices, and how to have data deleted

Inside the app you can edit sites, archive a site (which stops its reports and checks but keeps its data), add and remove recipients, and disconnect a connected Google account, a ChatGPT Ads account, Bing Webmaster Tools or Cloudflare. To ask for a copy of your data, a correction, or deletion of everything we hold about you, email support@tituspulse.com from the address on the account. We will confirm and complete the request within 30 days.

If you are a report recipient and want to stop receiving a report or be removed entirely, use the unsubscribe link in any report email, or email us at the address above and we will remove you and tell the account holder that sent it.

Depending on where you live you may have rights to access, correct, delete, export or object to our use of your personal data, and to complain to your data protection authority. Email us and we will help.

Security

The browser never writes to our database directly: every change goes through a server route that checks who you are and which account you belong to. Accounts are isolated from each other by server-side checks and by database rules that deny access by default. Google refresh tokens, the Cloudflare token, the Bing Webmaster Tools key and the ChatGPT Ads keys are encrypted at rest as described above. No service can promise perfect security, but if a breach affects your data we will tell you and the relevant authority without undue delay.

Children

Titus Pulse is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

We will change this page when the service changes. The date at the top always reflects the current version, and we will email account holders before a change that materially affects them.

Contact

Titus Hub Inc.
support@tituspulse.com
971 US Highway 202N, Ste R, Branchburg, NJ 08876

See also our Terms of Service.