ShortPulse Privacy Policy

This Privacy Policy explains how ShortPulse collects, uses, shares, retains, and protects information when you use our websites, applications, AI Studio tools, media library, billing features, profile features, support channels, and related services (collectively, the "Service").

"ShortPulse," "we," "us," and "our" mean Arc Creative Enterprises LLC, doing business as ShortPulse, the operator of the Service.

This Privacy Policy applies to ShortPulse's processing of personal information. It does not replace our Terms of Service, Refund Policy, media-rights requirements, provider terms, Affiliate Program Terms, or any separate agreement that expressly applies to a specific feature or business relationship.

If you do not agree with this Privacy Policy, do not use the Service.

1. Information We Collect

We collect information you provide, information generated through your use of ShortPulse, information from service providers, and information collected automatically.

Account Information

We may collect account identifiers and profile information, including your email address, user ID, authentication status, profile settings, workspace settings, subscription status, account events, and related account metadata.

Authentication may be provided by Supabase or another authentication provider. ShortPulse does not need your password in plain text.

Billing Information

If you subscribe, buy credits, buy storage add-ons, change plans, cancel, or use paid features, we may collect billing-related information, including Stripe customer IDs, subscription IDs, checkout session IDs, invoice IDs, payment status, plan names, billing interval, credit grants, credit balances, refunds, disputes, tax information, and transaction metadata.

Payment-card and bank-account details are processed by Stripe or another payment processor. ShortPulse does not intend to store full payment-card numbers.

Creative Workspace And User Content

We collect and process the content you submit, upload, generate, save, organize, or otherwise use in ShortPulse, including prompts, text, images, videos, audio, voice samples, likeness materials, product references, style references, project data, workspace preferences, media-library items, generated outputs, draft assets, issue-report messages, and related metadata.

This content may include personal information about you or other people if you upload or generate content containing names, faces, voices, likenesses, locations, identifiers, or other identifiable details.

Because ShortPulse supports media and voice workflows, Your Content may include sensitive information or information that some laws treat specially, such as face images, voice recordings, likeness material, identity material, biometric-related information, or information about minors. You are responsible for deciding whether that content is appropriate to submit and for obtaining any required rights and consents.

Generation And Provider Data

When you use AI features, we may collect prompts, inputs, settings, model choices, provider names, job identifiers, task status, output URLs, error codes, reservation and credit events, generation costs, timing metadata, and other operational information needed to submit, track, deliver, troubleshoot, bill, and audit generation requests.

Support, Feedback, And Reports

If you contact us or submit an issue report, we may collect your message, authenticated user context, email address, source path, screenshots or attachments you provide, browser or device information, and related support metadata.

Device, Usage, Telemetry, And Log Information

We may collect technical and usage information, including IP address or approximate network information, browser type, device type, operating system, pages and routes viewed, referrer host, landing path, request identifiers, user-agent strings, hosting metadata, timestamps, error metadata, event names, feature usage, performance metrics, storage usage, and security or audit logs.

We may create aggregated, deidentified, or statistical information from Service usage, billing, generation, telemetry, and support data. We may use that information to operate, measure, secure, and improve ShortPulse, provided it is not used to identify you.

Attribution And Growth Telemetry

ShortPulse may collect attribution and growth telemetry, including anonymous or pseudonymous browser identifiers stored in localStorage, UTM source/medium/campaign values, landing paths, referrer hosts, page-view events, CTA events, pricing interactions, signup events, checkout events, and authenticated-user stitching when you sign in.

When Marketing insights is active, ShortPulse may also use Meta Pixel and Meta Conversions API. The information sent to Meta may include page or route viewed, pricing or signup interaction, account registration, checkout initiation, first-party and Meta browser identifiers, referrer information, IP address, user-agent, hashed email address, hashed ShortPulse account identifier, and confirmed purchase amount, currency, and purchased plan or credit package. ShortPulse does not send private workspace content, prompts, uploads, projects, generated media, or full payment-card details to Meta for this purpose.

Affiliate Referral And Attribution Information

If you visit ShortPulse through a participating affiliate's referral link and affiliate attribution is enabled for your browser, ShortPulse and Tolt may process information needed to identify the referral and calculate affiliate commissions. This information may include the referral link or parameter, landing page, referring source, timestamps, a randomly generated click or referral identifier, and first-party `tolt_referral` and `tolt_data` cookies that hold referral and attribution values used by Tolt.

When an attributed visitor creates a ShortPulse account, ShortPulse may send the account email address to Tolt to associate the account with the referral. When an attributed customer starts Stripe Checkout, ShortPulse may include an opaque Tolt referral identifier in the Stripe Checkout metadata. Tolt may then receive payment and subscription lifecycle information from Stripe, such as transaction identifiers, amount, currency, payment or subscription status, renewals, cancellations, refunds, disputes, and chargebacks, so that commissions can be calculated, reviewed, adjusted, and paid.

Tolt may display limited referral information to the referring affiliate through its partner portal, including a redacted email address and the amount paid. ShortPulse does not send private prompts, uploads, projects, media-library content, generated outputs, or full payment-card details to Tolt for affiliate attribution.

Affiliate Applicant And Partner Information

If you enroll in or participate in the ShortPulse affiliate program, ShortPulse, Tolt, and authorized payout providers may process information connected with your partner account and participation. This may include your name, email address, business or company details, country, enrollment and account status, partner group, referral links or codes, referral activity, commission and payout records, tax classification or forms, payout-method information, identity or compliance-verification results, and program communications.

Some identity, tax, banking, or payout details may be collected directly by Tolt or another authorized provider and may not be available to ShortPulse in full.

Cookies, Local Storage, Session Storage, And Similar Technologies

ShortPulse may use browser localStorage, sessionStorage, cookies, tokens, and similar technologies to keep you signed in, remember workspace preferences, preserve project state, store attribution identifiers, support checkout handoff, report client errors, and operate the Service.

ShortPulse treats cookies and similar technologies as operational, authentication, security, billing, workspace-preference, product-telemetry, attribution, and marketing-insight tools. Marketing insights is not part of the required media agreement. For eligible U.S.-based visitors and accounts it may be enabled automatically. An eligible signed-in account with no saved choice may receive a compact informational notice explaining this use; dismissing that notice does not change the current setting. Marketing insights remains off by default for non-U.S. or unidentified production locations, where a visitor with no saved choice receives a compact optional-cookie choice outside AI Studio. It also remains off when the browser or account has opted out or ShortPulse cannot determine the regional policy. A signed-out choice is stored in that browser and is reconciled with the durable account setting after sign-in, with a decline taking priority. Signed-in users can change this setting in Account Settings, and public dashboard visitors can open privacy controls through the non-floating "Privacy choices" footer control. ShortPulse treats an enabled Global Privacy Control signal as a decline for this activity.

ShortPulse loads Tolt's referral script only when affiliate attribution is enabled for the browser. The current Tolt Program configuration uses a 30-day attribution window. For eligible United States visitors, ShortPulse may enable affiliate attribution by default after regional eligibility is resolved. Visitors outside the United States, and visitors whose region cannot be resolved, must affirmatively enable affiliate attribution before the Tolt script loads. A recognized Global Privacy Control signal disables optional affiliate attribution. Affiliate-attribution controls are separate from ShortPulse's advertising or Meta Pixel controls.

You can change the Affiliate Attribution setting in ShortPulse's privacy controls. Turning it off prevents future Tolt browser attribution and removes the browser-side referral state ShortPulse controls. It does not necessarily delete an existing referral, reverse a commission already earned, or remove records that ShortPulse, Tolt, Stripe, or an affiliate must retain for payments, fraud prevention, accounting, tax, dispute, or legal purposes.

2. How We Use Information

We use information to:

• provide, operate, maintain, and secure ShortPulse;
• authenticate users and manage accounts;
• administer affiliate enrollment and partner accounts;
• process subscriptions, payments, invoices, taxes, credits, storage add-ons, refunds, disputes, and billing support;
• submit, process, track, deliver, and troubleshoot AI generation requests;
• store, organize, display, retrieve, and delete media, projects, prompts, outputs, and workspace data;
• attribute eligible customers and transactions to participating affiliates;
• calculate, review, approve, adjust, reverse, and pay affiliate commissions;
• identify refunds, disputes, chargebacks, duplicate claims, self-referrals, and suspected affiliate fraud or abuse;
• measure the performance of the affiliate program;
• enforce media-rights confirmations, acceptable-use rules, provider policies, and legal requirements;
• detect, investigate, prevent, and respond to fraud, abuse, security incidents, billing misuse, policy violations, and technical problems;
• provide customer support and respond to issue reports, legal requests, privacy requests, and rights requests;
• measure usage, improve performance, debug errors, understand growth channels, and improve the Service;
• understand which promotions lead to site visits and confirmed purchases when Marketing insights is active;
• send transactional notices, billing notices, service updates, security alerts, and support communications;
• comply with law, enforce our Terms and Affiliate Program Terms, protect rights, and preserve records needed for legitimate business, legal, tax, accounting, security, and safety purposes.

3. AI Providers, Training, And Product Improvement

ShortPulse uses third-party AI and infrastructure providers to perform actions you request. Your prompts, uploads, media, voice samples, references, settings, and related metadata may be sent to providers such as OpenAI, Fal, Kie.ai, ElevenLabs, and similar model or infrastructure providers when needed to generate, transform, analyze, store, or deliver requested outputs.

Provider processing may be governed by provider terms, privacy policies, acceptable-use policies, safety systems, retention practices, data-processing terms, and technical limits. ShortPulse does not control every provider system, model behavior, safety decision, outage, or retention practice.

ShortPulse does not currently use your private workspace content to train ShortPulse-owned foundation models. We also do not intentionally opt in to third-party AI provider model training on your private workspace content when provider settings or account terms give us that choice.

ShortPulse may still use information to improve the product without training a foundation model. For example, we may use logs, task status, cost data, error records, support reports, safety events, feature usage, aggregated metrics, and deidentified statistics to debug features, reduce failed jobs, improve billing accuracy, detect abuse, measure performance, and decide what to build next.

You should not upload or submit sensitive personal information, confidential business information, regulated information, or third-party personal information unless you have the rights and authority to do so and the use is appropriate for an AI generation workflow.

ShortPulse is not designed for protected health information, financial-account numbers, government identifiers, children's data, trade secrets you are not authorized to process, or other highly regulated information unless we expressly agree to that use in writing.

4. Providers And Data Processing

The table below summarizes the main provider categories ShortPulse currently expects to use. Providers may change as the Service evolves.

5. How We Share Information

We may share information with:

• service providers that host, store, secure, process, analyze, debug, or support the Service;
• payment processors and billing providers such as Stripe;
• affiliate-program providers such as Tolt and the participating affiliate associated with a qualifying referral;
• AI model, media generation, voice generation, image generation, video generation, and related infrastructure providers;
• authentication, database, storage, deployment, logging, analytics, telemetry, email, customer-support, tutorial, and operations providers;
• professional advisers, insurers, auditors, and legal representatives;
• authorities, courts, regulators, payment networks, or third parties when required by law, legal process, fraud prevention, safety response, dispute handling, or rights enforcement;
• parties involved in a merger, financing, acquisition, bankruptcy, reorganization, asset sale, or similar business transaction;
• other people or services when you direct us to share, publish, export, or connect content.

ShortPulse uses Tolt to operate its affiliate program and Stripe to process customer payments and provide relevant transaction and subscription events. ShortPulse may share the affiliate referral, account, and payment-lifecycle information described above with Tolt and Stripe for attribution, commission accounting, fraud prevention, refund and dispute handling, and payout administration.

Affiliate applicants and partners may provide account, tax, verification, and payout information directly to Tolt or an authorized payout provider. ShortPulse may receive or share the portions reasonably needed to administer enrollment, program compliance, commission review, and payouts.

Tolt may make limited referral information available to the affiliate associated with a qualifying referral. Affiliates are not authorized to use that information to identify, contact, profile, or target a ShortPulse customer, and ShortPulse's Affiliate Program Terms prohibit misuse of customer information.

Tolt and Stripe process information under their own terms, privacy notices, security practices, retention practices, and international data-transfer arrangements. Their current privacy notices are available through the Tolt Privacy Policy and Stripe Privacy Center.

ShortPulse does not sell personal information for money.

ShortPulse uses Meta tools for Marketing insights only under the regional and preference rules described above. Some laws may define disclosure to an advertising network for measurement or optimization as "sharing," targeted advertising, or similar activity even when no money is exchanged. Where those laws apply, continuing without optional cookies or turning off Marketing insights through Account Settings or the public dashboard footer, or using Global Privacy Control, opts out of that activity.

6. Your Responsibility For Other People's Information

You may upload or generate content involving other people, including faces, voices, likenesses, names, clients, creators, customers, employees, contractors, or minors.

You are responsible for having the rights, permissions, consents, releases, notices, and legal basis needed to provide that information to ShortPulse and to use it in AI workflows, generated outputs, ads, social content, product materials, or other content.

If you use ShortPulse for client work, employee work, contractor work, creator work, or business campaigns, you are responsible for giving any privacy notices and obtaining any consents required by your relationship with those people.

7. Retention

We retain information for as long as reasonably needed to provide the Service, maintain your account, operate billing and credits, preserve projects and media, support security, troubleshoot issues, comply with law, resolve disputes, enforce agreements, and operate our business.

Different categories of information may have different retention periods. For example:

• account and profile records may be retained while your account is active and for a reasonable period afterward;
• media, prompts, projects, and outputs may be retained until you delete them, close your account, or request deletion, subject to technical, legal, backup, billing, safety, and operational limits;
• billing, invoice, tax, payment, refund, dispute, and accounting records may be retained as needed for legal, tax, accounting, fraud-prevention, and payment-network obligations;
• affiliate referral, lead, transaction, commission, partner, and payout records may be retained as needed to operate the affiliate program, reconcile payments and refunds, prevent fraud, resolve disputes, satisfy tax and accounting obligations, and enforce program terms;
• security logs, telemetry, error records, and audit records may be retained as needed to protect the Service, debug issues, and maintain reliable operations;
• takedown, abuse, safety, rights, and fraud records may be retained as needed to process requests, prevent repeat abuse, comply with law, and defend legal claims;
• backups may retain deleted information for a limited period before routine deletion.

Tolt states that Stripe webhook event data used for debugging is retained for seven days. That limited statement is not the retention period for every referral, transaction, commission, affiliate, accounting, or payout record processed by Tolt. Provider-controlled records may be retained under Tolt's own privacy and legal obligations.

When we no longer need personal information, we may delete it, deidentify it, aggregate it, or retain it only where legally or operationally required.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information, including user-scoped access controls, private storage patterns, authentication controls, and operational security practices.

No online service, AI provider, payment processor, storage system, or transmission method is perfectly secure. You are responsible for using strong account security practices and protecting the content, credentials, exports, and devices you control.

9. Children

ShortPulse is intended for users who are at least 18 years old. ShortPulse is not intended for children.

We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to ShortPulse, contact us at service@shortpulse.co so we can review and respond.

10. Your Choices And Privacy Rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, portability/export of, or restriction of certain personal information. You may also have rights to object to some processing, opt out of certain sharing or targeted advertising, withdraw consent where processing is based on consent, or appeal a privacy-rights decision.

You can use product controls to update some account information, manage billing, cancel subscriptions, delete certain media or projects, change workspace settings, or change your Affiliate Attribution setting.

Turning Affiliate Attribution off prevents future Tolt browser attribution and removes the browser-side referral state ShortPulse controls. It does not automatically erase an established referral, reverse a commission already earned, or remove records needed for payments, refunds, disputes, fraud prevention, tax, accounting, or legal compliance.

You can continue without optional advertising cookies or change Marketing insights through the public "Privacy choices" footer control. After signing in, you can also manage Advertising privacy in Account Settings. Disabling advertising measurement stops new Meta Pixel collection, attempts to remove Meta browser cookies, and, for an authenticated account, removes ShortPulse-held attribution or conversion jobs that have not yet been sent. It cannot recall an event already accepted by Meta or guarantee cancellation of a provider request already in flight.

To make a privacy request, contact service@shortpulse.co. We may need to verify your identity and account before responding. We will not discriminate against you for exercising privacy rights where applicable law prohibits discrimination.

Some information may be exempt from deletion or access requests, including records we need for security, fraud prevention, legal compliance, billing, tax, accounting, dispute resolution, service integrity, backup recovery, rights enforcement, or safety response.

If applicable law requires an appeal process and we deny your privacy request, you may appeal by replying to our decision email or contacting service@shortpulse.co with "Privacy Appeal" in the subject line.

11. California Privacy Notice

This section provides California privacy disclosures.

Categories of personal information ShortPulse may collect include:

• identifiers, such as email address, account ID, customer ID, anonymous or pseudonymous browser or referral ID, IP address, and online identifiers;
• commercial information, such as subscription, credit-pack, invoice, refund, storage add-on, payment-status, affiliate-referral, commission, and payout records;
• internet or electronic network activity, such as routes, events, browser information, referrers, telemetry, logs, referral-link interactions, and interactions with the Service;
• audio, visual, and similar information, such as media, voice samples, images, videos, generated outputs, and uploaded references you choose to provide;
• professional or commercial information if you provide it in prompts, profile details, business content, client materials, product information, support requests, or affiliate-program materials;
• inferences or preferences derived from product usage, settings, attribution, workspace state, and generation activity;
• sensitive personal information if you choose to include it in content, prompts, uploads, media, voice samples, support requests, or similar materials.

We collect and disclose these categories for the business and commercial purposes described in this Privacy Policy, including to provide the Service, process payments, operate affiliate attribution and commission administration, support AI generation workflows, secure the Service, provide support, comply with law, and improve product operations.

We may disclose these categories to the provider categories described in Section 4 and to the affiliate associated with a qualifying referral for the purposes described in this Privacy Policy. An affiliate may receive limited referral information, including a redacted email address and paid amount.

ShortPulse does not sell personal information for money. When enabled, Marketing insights using Meta may be treated as "sharing" or targeted advertising under California law. California users can disable it in Account Settings or through the public dashboard footer's Privacy choices control, and ShortPulse treats Global Privacy Control as an opt-out for this activity.

The legal classification of affiliate-attribution disclosures may vary by jurisdiction. ShortPulse treats a recognized Global Privacy Control signal as a direction to disable optional browser affiliate attribution and will provide any additional legally required opt-out method if our practices or applicable obligations change.

California residents may have rights to know/access, delete, correct, opt out of sale/share, limit certain sensitive personal information uses, and non-discrimination, subject to legal exceptions. If ShortPulse is an online-only business and applicable law allows email-only intake, service@shortpulse.co is the designated request method. If additional intake methods become required, ShortPulse will update this policy and the public privacy controls.

12. Other U.S. State Privacy Rights

Residents of other U.S. states may have privacy rights depending on where they live and how applicable law treats ShortPulse. These rights may include access, correction, deletion, portability, opt-out, and appeal rights.

ShortPulse does not sell personal data for money. Where applicable state law treats Meta-backed Marketing insights as targeted advertising, sale, sharing, or similar activity, users can disable it in Account Settings or through the public dashboard footer's Privacy choices control, and ShortPulse honors Global Privacy Control for that activity.

ShortPulse also treats a recognized Global Privacy Control signal as a direction to disable optional browser affiliate attribution. That operational choice does not determine whether every affiliate disclosure is legally classified as a sale, sharing, or targeted advertising. Where applicable law requires additional recognition of universal opt-out mechanisms or opt-out methods, ShortPulse will honor those requirements for covered activity.

13. International Users

ShortPulse is operated from the United States and is currently designed for a U.S.-first launch posture. We do not currently represent that ShortPulse is localized for every country, language, consumer-law regime, AI-law regime, tax regime, privacy regime, or platform-disclosure requirement.

If you access ShortPulse from outside the United States, you understand that information may be transferred to, stored in, and processed in the United States and other countries where our providers operate. These countries may have privacy laws different from those where you live.

If EEA, UK, Swiss, or other international privacy laws apply to your use, ShortPulse will process requests as required by applicable law, but the Service should not be treated as an enterprise GDPR, UK GDPR, Swiss FADP, or other international compliance solution unless ShortPulse enters into a separate written agreement that addresses the required controller, processor, legal-basis, transfer, DPA, and subprocessor terms.

If ShortPulse actively markets to, sells into, or builds localized flows for additional jurisdictions, ShortPulse should update this policy, provider contracts, data-transfer terms, cookie controls, and consumer disclosures before expansion.

14. Third-Party Sites And Services

ShortPulse may link to or integrate with third-party sites and services, such as payment portals, tutorial embeds, affiliate portals, provider services, or external websites. This Privacy Policy does not control third-party privacy practices. Review the applicable third-party privacy policy before using those services.

15. Changes To This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice in a reasonable way, such as posting the updated policy, updating the date, sending an email, or showing an in-product notice.

16. Contact

Questions or privacy requests should be sent to service@shortpulse.co.