Privacy policy
Version 1.1 · Effective October 28, 2026
This policy explains what personal data the Impulsa app and its website process, what we use it for, who we share it with, where it is stored, how long we keep it and how you can exercise your rights. It is written to be understood: if anything is unclear, write to support@impulsa.app.
1. Who is responsible for your data
The controller of your data is Juan Ibarra, an individual domiciled in the state of Aragua, Venezuela, who develops and operates Impulsa ("Impulsa", "we", "us").
- Email for anything about your data: support@impulsa.app (in Spanish: soporte@impulsa.app).
- Website: www.impulsa.app.
If Impulsa comes to be operated by a company incorporated for that purpose, that company will become the controller on the same terms as this policy, and we will tell you beforehand in the app or by email.
2. What data we process
What you give us
- Your account: your first name, your last name, your email address, the language you want our messages in, and your password. We never keep the password itself: we keep an irreversible hash (Argon2id) that can only be used to check it.
- Your business: its name, its type (for example, bakery or services) and its currency.
- What you record: your sales (products, quantities, prices and the dollar rate at that moment), your expenses (the description you write, the amount and the category), and your products with their cost, price and stock.
- Your conversations with the assistant: what you ask it (typed, or the text of what you dictated), what it answers, the notes about your business you confirm so it knows you better, and whether an answer helped. So the conversation can continue, we also keep summaries of it.
- Your messages to support: the subject and content of what you write to us, from the app or by email.
- Your preferences: which notifications you want to receive.
What is generated when you use Impulsa
- What we prepare for you: your weekly reports, the insights about your business you see on Home, and your notifications, all computed from your records.
- Your use of the assistant: for each call to an artificial intelligence model we keep which operation it was, which model answered, how many units of text it processed (tokens), how long it took and what it cost, to apply your plan's limits. We never keep there what you asked or what it answered.
- Your phone, for notifications: an identifier the app creates when installed, the token your phone's notification service assigns to it, and whether it is Android or iPhone. They are used only to send you the notifications you have turned on.
- Technical and security data: when you use the app, our servers record the IP address you connect from, the type of app or browser ("user agent"), the date and time, and what action you took (for example, "signed in" or "recorded a sale", never its content).
- Error reports: if the app crashes, it sends a technical report with the error, your phone's model and system, the app's version and a random identifier of the installation. Reports do not include your name, your email, your IP address or anything you type.
What stays on your phone
The app keeps on your phone your session, encrypted (in the Android Keystore or the iPhone Keychain); the entries you made offline, until they are sent; a copy of your products so you can record offline; the app's language; and whether you turned on fingerprint or face unlock. All of this is erased when you sign out, except the language.
Your voice
When you dictate, speech recognition is done by your phone's own system: Google's on most Android phones and Apple's on iPhone. Depending on your phone and its settings, that service may send the audio to Google or Apple to turn it into text, under their own privacy policies. Only the text reaches Impulsa. We do not record or keep audio.
Your fingerprint and face
If you turn on fingerprint or face unlock, your phone checks them itself. Impulsa never receives or stores them: it only learns whether they matched. Signing out turns the unlock off.
When you visit the website
- What our server records: like any website, the server that answers www.impulsa.app records each request: the page asked for (without what follows a
?in its address), the date and time, the result, your browser's type ("user agent"), the page that linked to ours when your browser says so, and a pseudonymous code computed from your IP address instead of the address itself. We use it to count visits and to keep the website working and secure. - Cloudflare Web Analytics: counts the pages visited, the sites that send visitors, the country, the type of device and browser, and how fast the pages load. It uses no cookies, keeps nothing on your device, and does not identify you or follow you across websites.
- Google Analytics, only if you accept it: if you accept it in the notice the website shows you, Google Analytics keeps a random identifier in a cookie in your browser, to learn how many people visit, which pages they read and whether they come back. It receives the pages you visit, the site that sent you, your device and browser type, and your approximate location (city or country), which it derives from your IP address without storing the address. Its advertising features and Google signals are turned off. If you do not accept it, it does not load at all.
- Your language: if you choose a language with the website's language link, a cookie remembers it, so the website opens in that language next time.
If you join the waitlist
On www.impulsa.app you can leave us your email address so we tell you when you can use Impulsa. If you do:
- What we keep: your email address, the language of the page you joined from, which page it was, and the date and time. We do not keep your IP address or your browser with it: as with any request to our servers, those stay only in the technical logs, which are erased after 14 days.
- What for: only to invite you to use Impulsa when your turn comes. We do not send you advertising, use it for anything else, sell it, or share it with anyone beyond the providers named here.
- On what basis: your consent, which you give by sending the form. You can withdraw it at any time; this does not affect what we did before with it.
- Who receives it: it is stored in our database (on Hetzner's servers) and, so the team sees it and gives you access, a message with your email address, the language, the page and the time is posted to a private channel of Impulsa's Slack workspace (Slack Technologies, LLC), which only the Impulsa team can access.
- How long: up to 12 months from when you joined. After that we erase it from our database automatically, and we delete the Slack message too. If you ask to leave the list before then, we erase it then.
- How to leave the list: write to support@impulsa.app from that address. We erase it from our database and from Slack within 15 business days.
If you later create an account, what we process of it is governed by the rest of this policy.
What we do not process
We do not ask for your phone number, your location, your contacts or your photos. We do not receive card or bank account details. Impulsa shows no advertising, builds no advertising profiles and does not sell or rent your data. The app has no analytics or tracking tools; the website measures its visits only as described above and in section 10. We do not ask for sensitive data (health, origin, beliefs, biometric data or the like), and we ask you not to write it in your records or to the assistant.
3. What we use it for, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Create and keep your account, store your records and show them to you | Account, business, records, preferences | Providing the service you asked for by accepting the Terms of use |
| Answer your questions in the assistant and prepare what you dictate | Your question, the conversation, your notes and the business data the question needs | Providing the service |
| Compute your reports, insights and notifications, and send the notifications you turned on | Records, preferences, phone data for notifications | Providing the service, and your permission to receive notifications, which you can withdraw on your phone or in Settings |
| Protect you: verify your email, confirm it is you when you sign in, limit failed attempts and detect unauthorized access | Account, technical and security data | Our legitimate interest in the security of the service and your account |
| Apply your plan's limits | Assistant usage | Providing the service |
| Handle your messages and your requests about your data | Account, messages to support | Providing the service and complying with the law |
| Detect and fix faults and measure performance | Technical data, error reports | Our legitimate interest in the service working |
| Measure how the website is used, to improve it | The website's visit data (section 2, "When you visit the website") | Your consent, for Google Analytics, which you can withdraw at any time; our legitimate interest, for our server's records and Cloudflare Web Analytics, which keep nothing on your device |
| Comply with legal obligations and requests from authorities | Only what is strictly necessary | Complying with the law |
| Invite you to use Impulsa, if you joined the waitlist | Your email address, the language and the page you joined from | Your consent, which you can withdraw at any time |
By creating your account you authorize us to process your data for these purposes. You can withdraw that authorization at any time by deleting your account or writing to us; this does not affect what we did before with your authorization.
We do not send you advertising. The only emails you get are those the service needs: verification codes, notices about your account and answers to your messages.
The assistant and automated decisions
The answers, insights and drafts the assistant prepares are generated by artificial intelligence models from your data. They are suggestions: nothing is recorded until you confirm it, and no decision with legal or similarly significant effects on you is made automatically. The only automatic limits are your plan's usage limits.
4. Who we share your data with
We share your data only with the providers we need to provide the service ("processors"), only what is necessary, and under their contractual data protection terms. None of them may use it for purposes of their own other than those stated.
| Provider | Purpose | What it receives |
|---|---|---|
| Hetzner Online GmbH (servers in Ashburn, United States) | Hosting the API, the database and their backups | All the service's data |
| DeepInfra, Inc. (United States) | Open-source artificial intelligence models that answer the assistant | Your question, the recent conversation, your business notes and the data the question needs (products, stock, sales, expenses). It does not receive your name or email unless you write them. Under its terms, it keeps this data no longer than needed to answer and does not use it to train models. |
| Google LLC — Gemini API (United States) | Artificial intelligence models, as an alternative | The same as DeepInfra. We use Gemini's paid service, under which Google does not use the data to improve its products or train models; it keeps it for up to 55 days only to detect abuse. |
| Google LLC — Firebase Cloud Messaging, and Apple Inc. — Apple Push Notification service | Delivering notifications to your phone | Your phone's notification token and the text of each notification |
| Resend (United States) | Sending the emails with your codes and notices | Your email address and the email's content |
| Google LLC — Google Workspace | The mailbox where we receive and answer your emails to support | Your email address and your messages |
| Slack Technologies, LLC (United States) | The private channel where the team sees who joined the waitlist, to give them access | If you joined the waitlist: your email address, the language and the page you joined from, and the time |
| Functional Software, Inc. — Sentry (United States) | Error reports from the app and from our console | Technical data about the error and the phone, without your name, email or IP |
| Grafana Labs — Grafana Cloud (United States) | Technical logs and metrics to operate and monitor the service and the website | Your IP address, the type of app, your customer number and what happened in each request; from the website, our server's records described in section 2. Never your name, email or what you type |
| Cloudflare, Inc. — Cloudflare Web Analytics (United States) | Counting the website's visits, without cookies | The page visited, the site that sent you, your browser and device type, your country and how fast the page loaded |
| Google LLC — Google Analytics (United States) | Measuring the website's use, only if you accept it | The pages you visit, the random identifier in its cookie, the site that sent you, your device and browser type and your approximate location. Google processes it on our behalf, under its data processing terms, and does not use it for advertising |
| Google and Apple, as operating systems and app stores | Your phone's speech recognition and downloading the app | Whatever their services receive under your phone's settings, under their own policies |
We may also disclose data when a law, a court order or a competent authority requires it, and only to the extent of that obligation.
Third parties' data you record
If you write other people's data in your sales, expenses or notes (for example, a customer's name), you are responsible for it and for having their authorization, and Impulsa processes it only on your behalf, to provide you the service.
5. Where it is stored: international transfers
Our servers and most of our providers are in the United States, so your data is stored and processed outside your country. We choose providers that commit by contract to protect the data with appropriate security measures and to use it only to provide their service to us. By accepting this policy you authorize those transfers, on the terms your country's law requires.
6. How long we keep it
| Data | How long |
|---|---|
| Your account, your business and everything you record | While your account exists |
| Your conversation with the assistant | The last 200 messages and their summaries |
| Your notifications | The last 100 |
| The detail of each call to the assistant | 90 days |
| Daily and monthly usage totals | 25 months |
| Verification codes | Erased 24 hours after they expire |
| The phone registered for notifications | Until you sign out on it, delete your account, or the notification service reports it is no longer valid |
| Technical logs, the website's server records included | 14 days |
| The website's data in Google Analytics, if you accepted it | 2 months; its cookies, 13 months at most |
| Your answer about Google Analytics, in your browser | 13 months, then we ask again |
| The cookie with the language you chose on the website | 1 year |
| Error reports | Up to 90 days |
| Emails to support | Up to 12 months after your request is resolved |
| Your email address on the waitlist, in our database and in Slack | Up to 12 months from when you joined, or until you ask to leave the list |
| Backups | 14 days; what is deleted may remain in them until they are replaced |
| Your account's security record | See below |
Security record. We keep a record of the actions taken in each account (which action and when), identified by a customer number and never by your name or email. It is used to protect your account, investigate incidents and demonstrate legal compliance, and it is kept even if you delete the account. The IP address and type of app each action came from are erased after 12 months.
When you delete your account we close it at once, sign you out on all your phones, stop sending you notifications and, 30 days later, erase your account, your business, your records, your conversations, your reports, your notifications, your messages to support and the detail of your usage. If you sign in before those 30 days, your account stays as it was. The full detail is at Delete your account.
7. Your rights
You can ask us at any time, free of charge, to:
- Know what data of yours we process and get a copy in a usable format.
- Correct data that is inaccurate or incomplete.
- Delete your data, from the app or by writing to us.
- Object to or restrict a use, and withdraw your authorization.
- Know who we share your data with.
- Complain to your country's data protection authority.
How to exercise them
Write to support@impulsa.app from your account's email address, saying what you need. If you write from another address, we will ask you to confirm the account is yours. If you act on behalf of someone else, you must prove it.
- Inquiries (knowing what data we hold or getting a copy): we answer within 10 business days. If we cannot, we will tell you why and answer within the following 5 business days.
- Claims (correcting, deleting, objecting or withdrawing your authorization): we answer within 15 business days. If we cannot, we will tell you why and answer within the following 8 business days.
If your country's law gives you a shorter deadline or an additional right, we apply it.
If you live in Venezuela, your right to know, update, correct and destroy your data is protected by Article 28 of the Constitution (habeas data). If you live in Colombia, your rights are set out in Law 1581 of 2012 and its decrees, and you may go to the Superintendence of Industry and Commerce after exhausting your claim with us. If you live elsewhere, we recognize the rights your data protection law gives you.
8. How we protect your data
- All connections with the app and the website are encrypted (TLS).
- Passwords are stored as an irreversible hash, and to sign in we also ask for a code we send to your email.
- We limit failed attempts and temporarily block suspicious access.
- Your session is stored encrypted on your phone, which you can also protect with your fingerprint or face.
- Those who operate Impulsa access data only with specific permissions and a second authentication factor, and every access is recorded.
- We make daily backups.
No system is infallible. If a security incident affects your data, we will tell you without undue delay, with what we know and what you can do, and notify the authorities where the law requires it.
9. Minors
Impulsa is a tool for businesses and is not directed at anyone under 18. We do not knowingly collect data from minors. If you believe a minor has given us their data, write to us and we will delete it.
10. Cookies and the website's measurement
The app uses no cookies and has no analytics or tracking tools. The internal console the Impulsa team uses to operate the service uses only the cookies needed to keep its operators' sessions.
The www.impulsa.app website keeps on your device only what this table lists:
| What | Set by | What for | How long | When |
|---|---|---|---|---|
The lang cookie |
Impulsa | Remembering the language you chose with the language link | 1 year | Only if you choose a language |
impulsa.site.consent, in your browser's storage (not a cookie, and never sent to us) |
Impulsa | Remembering whether you accepted Google Analytics | 13 months, then we ask again | When you answer |
The _ga and _ga_<ID> cookies |
Google Analytics | Telling visits apart and recognizing returning visitors | 13 months at most | Only if you accept Google Analytics |
Google Analytics loads only after you accept it: until then, not even its script is requested from Google. You can change your answer at any time with Cookie settings, at the bottom of every page of the website; if you withdraw your consent, we delete its cookies. Rejecting it changes nothing else on the website. If your browser sends the Global Privacy Control signal, we take it as a rejection and do not ask.
Cloudflare Web Analytics and our server's records, described in section 2, keep nothing on your device.
Wherever you live, we ask before using Google Analytics, as the laws of the European Union, the United Kingdom, Brazil (LGPD) and Colombia require, and we do not sell your personal information or share it for advertising, as the privacy laws of US states such as California define those terms.
11. Changes to this policy
If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will tell you in the app or by email at least 15 days before it applies. If you do not agree, you can delete your account before that date.
12. Contact
Juan Ibarra — Impulsa · State of Aragua, Venezuela · support@impulsa.app
This policy is governed by the laws of the Bolivarian Republic of Venezuela, without prejudice to the rights your country's data protection law gives you. Impulsa's database will remain in force for as long as the service is provided.