Privacy policy

Who we are

Kapstone Communications Ltd is the data controller for ProjectPulse AI. We are registered in England, company number 11202662, with our registered office at 6 Hockley Hill, Hockley, Birmingham B18 5AA. Contact us at info@kapcomgroup.com.

What we collect and why

• Account and organisation details (name, email, memberships and roles) and the project records you enter, to provide the service. Lawful basis: contract.
• Billing details (plan, subscription status and payment references held by Stripe), to take payment. Lawful basis: contract, and legal obligation for billing records.
• Security information such as sign-in activity, and service emails such as sign-up confirmation and password reset. Lawful basis: legitimate interests in keeping the service secure and working.
• Advertising measurement, described below. Lawful basis: consent.

Service providers

• Stripe — payments
• Lovable Cloud / Supabase — hosting and database
• Lovable AI Gateway — AI report drafting
• Lovable email — account and service emails
• Google — advertising measurement (only with consent) and web fonts

International transfers

Some providers may process data outside the UK. Where they do, we rely on safeguards recognised under UK data protection law.

Retention

We keep account and project data while the organisation's account is open and delete it within 90 days of closure. We keep billing records for 6 years, as UK law requires.

Your rights

Under UK GDPR you can ask to access, correct or delete your personal data, restrict or object to its processing, and receive a portable copy. You can withdraw consent at any time. To use these rights, email info@kapcomgroup.com. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

Account and project data

ProjectPulse stores account details, organisation memberships and project records to provide reporting, access controls and billing. Organisation records are restricted to authorised members. AI report drafts process the supplied project records through Lovable AI Gateway; payments are processed by Stripe. Approved report exports are private.

Advertising measurement

Google Ads uses advertising cookies, click identifiers and page, trial-start and approved PDF export events to measure advertising and optimise campaigns. No email, name or project content is sent. You can reject or withdraw using Cookie settings.

When permitted, the Google tag receives page information without query strings, advertising click identifiers and a conversion when an authenticated user successfully creates an organisation and starts its trial. An opaque organisation identifier is used to prevent duplicate trial reporting; we do not send project data or customer matching details such as email addresses. Google may process IP address, browser and device information and use advertising cookies under its own policies.

A separate observation-only conversion records each successful approved PDF download. It sends a random export reference, not the report ID, filename or report content. This measures engagement without replacing trial sign-ups as the campaign's bidding goal. Google Ads counts only exports it can attribute under its rules; the organisation dashboard counts all successful exports independently of advertising consent.

The purpose is to measure advertising results and optimise Google Ads campaigns towards trial starts; a page visit or a trial-button click is not a trial start.

Consent and withdrawal

In the EEA, UK, Switzerland and Quebec, advertising is blocked until you accept. When location cannot be established, we also block it until acceptance. Our country-level lookup cannot distinguish Canadian provinces, so this applies throughout Canada. Elsewhere, ordinary advertising measurement is enabled unless you refuse or an applicable opt-out such as Global Privacy Control applies.

Cookie settings is available on every page. You can reject as easily as accept, or withdraw later; opening settings does not change your choice. Withdrawal stops subsequent advertising events and updates Google’s consent signals but cannot recall information already sent.

Your browser stores a random visitor reference, the choice, time, location result, notice text and version. Earlier acceptance evidence remains recorded when you withdraw. Clearing browser storage removes these records and may require a new choice. We do not replay events blocked before you accepted.