Privacy Policy

Last updated: 12 October 2026

The short version

We use PostHog to understand how people use SuperPulse and the Meta pixel to measure our own advertising.

Analytics and the Meta pixel run by default. They can load, send data and store cookies as soon as you visit. There is no cookie banner. A saved choice to disable tracking keeps them off, including a rejection saved before the banner was removed.

You can disable tracking. The Cookie settings link in our footers takes you to Tracking settings on this page. Choose Turn tracking off to save that choice and reload the page with PostHog and the Meta pixel off. Choose Turn tracking on if you want to turn them back on. Opening settings alone does not change your choice.

Checkout and purchase reporting is separate. If you buy from us or start a checkout, our servers tell Meta that a sale or checkout happened, including when optional tracking is disabled. This uses details provided during checkout to measure our advertising. The section "What our servers send to Meta" describes what is sent and how to object.

If you phone us, the call is recorded. Our phone line is answered by an automated assistant, and the call, a written transcript of it and the number you called from are kept for up to 90 days so the team can read what was said and pick up anything the assistant promised. The section "If you phone us" says exactly what is kept, who handles it and how to have it removed sooner.

Technical error reports also run independently of your tracking choice. When something breaks on the site we record what failed and on which page so we can fix it. These reports set no cookie, store nothing in your browser and are not linked to you.

PostHog tells us which pages work and where people get stuck. It runs on servers in the EU and is set to discard your IP address. While enabled, it records sessions: mouse movement, clicks, scrolling and what was on the page. Form inputs are masked before recordings leave your browser. Recordings are deleted after 30 days.

The Meta pixel tells us which of our ads brought you here and what happened afterwards. Our servers also send conversion events to Meta. Where available, those events include your email, phone and first name in hashed form.

We do not sell your data. We do share data with PostHog, Meta and the companies that run SuperPulse's payments, email, hosting and other services. The supplier list below names them.

Your choice has limits. If you disable tracking while signed in, we also send that choice to your account so background tracking can follow it. The browser control cannot identify a separate waitlist record saved against your email. The sections below explain that limit and how to contact us about it. Disabling tracking does not undo data already sent.

Who we are

SuperPulse is run by Huddle Duck Ltd, a UK company (number 11837993), registered at 22 Ventnor Road, Solihull B92 9BU. We are the data controller for everything on this page.

SuperPulse boosts a local business's Instagram posts to people nearby, using the business's own Instagram account and their own Meta ad account.

Questions, or want your data gone: asad@huddleduck.co.uk

Why we are allowed to hold your data

Under UK GDPR we need a lawful basis for each thing we do. Ours are:

• Contract. If you are a customer, we need your account details, your Instagram data and your billing details to actually run the service you paid for. No way around it.
• Legitimate interests. Keeping the service up, stopping fraud, alerting ourselves when something breaks, keeping a record of what was said and promised on a phone call so we can act on it, and measuring whether our own advertising pays: when you buy or start a checkout, our servers report that sale to Meta (details and your right to object under "What our servers send to Meta"). We keep this to the minimum that does the job.
• Legal obligation. We keep billing and tax records for as long as HMRC requires (six years).

Tracking choices are described separately below. PostHog and the Meta pixel are enabled by default. We only store an explicit acceptance when you choose to enable tracking; visiting the site, reading this policy or leaving the setting unchanged is not recorded as consent. This policy describes what the site does and does not replace a request for consent.

What we collect if you are just visiting

Unless you have a saved choice to disable tracking, we collect:

• Pages you viewed, clicks, scrolls, roughly where you came from, what device you are on. Via PostHog. PostHog is set to discard your IP address, so it never stores it.
• A session recording. A reconstruction of your visit: mouse movement, clicks, scrolling, the content of the page, your browser's console messages, and the timing of the requests the page made (their timing, not what was inside them). Every form input is masked, so what you type is excluded from the recording. Recordings are kept for 30 days and then deleted.
• Which of our ads you clicked. Via the Meta pixel and via our servers (see the next section).

These tools start before you make a choice. PostHog and the Meta pixel can send requests and create analytics or advertising cookies on arrival. An explicit saved rejection prevents them from starting.

If you disable tracking, these parts of the service still work:

• What you submit through our forms (name, email, phone, Instagram handle, quiz answers) is saved in our own database.
• You still get the emails you signed up for, and you can unsubscribe from any of them.
• Functional cookies still work, so the site can keep you signed in and complete your payment.
• We save your disabled preference in your browser and, if you are signed in, send it to your account. That prevents an unanswered setting from switching tracking back on.
• Our servers continue the checkout and purchase reporting described below.

Our own campaign measurements. For visits from our own advertising campaigns, we also record whether a visit reached the landing page, pricing, the checkout button and a successfully created checkout. A random visit token in session storage links these steps in the same browser tab, for up to 24 hours while that tab remains open. We save the token, campaign label, advert label, step and time in our own database. These records do not contain your name, email, IP address, full page address or ad click ID. If you continue to checkout, the token also goes into the checkout and subscription records, so those visit steps can become linked to your purchase. They follow your optional tracking setting and the analytics retention period below. Disabling tracking stops further collection; it does not delete earlier records.

When PostHog is running, its requests leave your browser via superpulse.io/ingest rather than a posthog.com address. The data still goes to PostHog on its EU servers. This proxy can allow those requests through blockers that only recognise PostHog's domain.

What our servers send to Meta

This is the part most policies do not admit to, so here it is plainly.

Alongside the pixel in your browser, our servers send conversion events straight to Meta's Conversions API. There are six: joining the waitlist, finishing the qualifying quiz, booking or asking for a call, starting a checkout, paying, and connecting your Instagram at signup.

What goes in one of those events:

• Your email, phone number and first name, hashed. They are run through SHA-256 first, so Meta receives a fingerprint rather than the plain text. Meta matches that fingerprint against accounts it already has.
• Your IP address and your browser's user agent, not hashed. Meta needs them to match the event to a person. We are telling you because "hashed" is often used to make this sound gentler than it is.
• The Meta cookie values (_fbp / _fbc), if you have them, and, on a purchase, the click id from the ad link that brought you here, your Stripe customer reference (hashed) and the town, region, postcode and country from your billing address (hashed).
• What happened and what it was worth (for example: a purchase, and the amount).

The two money events are sent independently of your tracking setting. When you start a checkout, and when Stripe tells our server you paid, our servers report that to Meta. This uses checkout details and available attribution information, including cookie values or click IDs where available. We use these reports to measure which of our ads lead to sales. We rely on legitimate interests for this server reporting. If you object to your checkout or purchase being counted this way, email asad@huddleduck.co.uk and we will exclude you.

The other four follow the saved tracking setting. Joining the waitlist, the quiz, booking or asking for a call, and connecting your Instagram at signup can be reported unless the applicable saved preference disables tracking. A missing or unanswered preference leaves these reports enabled. When Cal.com tells our server you booked a call, the server reads the preference saved against your waitlist record. An explicit rejection stops that report.

Everything else about paying and booking is unaffected either way. The payment goes through, the receipt arrives, the call lands in the calendar, your account gets set up.

A limit of the settings control. A preference saved against your email when you submit a form can differ from the choice you make later in your browser. Disabling tracking stops browser tracking and sends the disabled choice to your account if you are signed in. It cannot identify and update a separate waitlist record saved against your email. A later call booking can therefore still be reported using that older setting. Email asad@huddleduck.co.uk and we will update that record to disable tracking. Checkout and purchase reports remain separate, as described above.

Our background jobs also report one advertising milestone. The first time a customer's first ad goes live, we send Meta a milestone event carrying that customer's hashed email, unless tracking is explicitly disabled on their account. Running and managing the customer's ads is separate from this milestone reporting.

If you use the free public Instagram report

You can receive a report without an Instagram login. We read your public business or creator profile and recent public posts through SuperPulse's own authorised Meta connection. We save the public information used to prepare your report, your name, email, WhatsApp number, currently open location count and your report. Public profile information and metrics are processed by our report-writing providers to produce your score and recommendations. We do not treat a typed Instagram handle or contact details as proof that you own the account.

The report is shown in your browser and delivered using the email and WhatsApp notice shown on the form. Your saved report expires after 30 days. Keep report links private: a signed link allows the holder to read that public report. Seasonal presentation can end sooner without deleting the saved report.

An optional Instagram connection may be offered after the report. With your permission, the separate SuperPulse - IG app reads your professional account identity and private post insights, including reach, saves, shares and views. It requests profile and insights access only. This connection does not authorise posting, messaging or advertising, and it does not change the public score.

We encrypt the optional connection's access token and store its private insights separately. They are available only in the browser that completed the Instagram connection, through an additional secure cookie. Public report links, email copies and PDFs do not include those private stats. The private section is excluded from session recordings. We retain this connection no longer than the report's 30-day lifetime or the token's validity, whichever is shorter. Removing the report also removes the separate connection.

Choose Disconnect and delete stats in your report to remove the stored optional token and private insights. You can also remove SuperPulse - IG in Instagram's Apps and websites settings. We process signed deauthorisation and deletion requests from that separate app without changing a paid advertising connection or deleting unrelated customer records.

If you use the free local growth plan

We save the Meta Page, Instagram and ad account you choose, the locations and budget you review, your answers about the business, your estimates of customer spend and repeat purchases, and your results. We encrypt the Meta access token. Preparing the free plan reads account information and existing posts, checks post relevance using OpenAI, and asks Meta for an audience estimate. It does not create or change your ads, charge you, or send messages to your customers.

Your saved plan expires after 30 days. Expired plans and their encrypted access tokens are removed by our daily cleanup. If you pay and approve activation, the selected setup and access token move into your customer account and follow the customer retention period below. The payment and activation receipt is retained with the billing record.

If you remove SuperPulse through Meta or use Meta's data-deletion request, we remove free plans tied to that Facebook identity, remove the identity link from SuperPulse accounts, and clear any Meta access token granted by that person. A customer account may then ask another authorised owner to reconnect before managed campaigns can continue.

Unless you have disabled tracking, a completed plan sends a Lead event to Meta with a hashed plan identifier, browser advertising identifiers when available, and the browser user agent. That Lead event also carries the email address, phone number and first name you gave us, each hashed with SHA-256 before it leaves our servers, and your IP address, which is not hashed. We send them so Meta can match the completed plan to a person, which is how we measure whether SuperPulse's own ads on Meta bring in people who finish a plan. We also record the campaign and the steps completed. If a consultation is booked through Cal.com, the booking is confirmed from Cal.com's signed booking notification. The Lead event and any booking report follow the tracking preference saved with your plan. A missing or unanswered preference leaves them enabled. An explicit rejection stops them.

What we collect if you are a customer

When you create a SuperPulse account, we collect your email address and store a secure hash of your password. Your name and phone number are optional. If you give us a phone number, we may use it to call when direct account support would be useful, or to tell you about an account-specific free improvement. Giving us a phone number does not opt you into WhatsApp or general marketing messages. The free Instagram report form separately asks for your WhatsApp number and explains the report message described below.

Free Instagram report messages. The report form requires your WhatsApp number and explains that we will send your report, three useful findings where the data supports them, and a SuperPulse offer. We record the wording version, the number and when you submitted the form. There is no separate checkbox. After the report is completed, we send one WhatsApp message through Meta and our HatchFlow messaging service. Eligible prospective customers can receive the Start for £1 offer, sent as a Marketing template. Existing customers, trials and people whose offer eligibility is uncertain receive a report-only Utility template. Reports with too little measured evidence receive a short report-ready message. We keep the submission and delivery records so we can check what was requested and avoid duplicate messages. Report links are private access links, so please do not forward them. Reply STOP at any time to stop WhatsApp messages. This report flow does not enrol you in a recurring campaign.

When you connect your Instagram through Facebook Login, you approve a specific set of permissions, and we ask for these:

• Your Instagram posts and their numbers. Likes, comments, saves, views, reach. This is how we work out which posts are worth putting money behind.
• Your Facebook Page and the list of Pages you manage. So you can pick the right business during setup, and so ads can run under the right identity.
• Your ad account. To create and manage the boost campaigns, and to read back how they performed (spend, reach, clicks, profile visits).
• Your email address. For account emails and performance reports.

We do not ask for Business Manager access. We used to. We removed it in April 2026 because we were not using it.

None of those permissions lets us read your DMs or post to your account, and your posts are never used to train models.

What we actually do with your Instagram and ad data

• We read your posts and their insights, and score them, so the system knows which ones to boost.
• We create and manage ads inside your ad account, not ours. The campaigns show up in your Ads Manager and you can see, pause or delete anything at any time.
• Your ad spend is billed by Meta, directly to you. It never passes through us. Your subscription and your ad budget are two different bills from two different companies.
• Your business name, account details and optional phone number show up on our internal dashboard so we can support you, including by calling when that would help.
• Everything the system does for you is written to our own database. Every scan, every ad launched, every ad stopped. That happens regardless of your tracking setting, because it is how the product works and how we support you.

Unless tracking is explicitly disabled, two more things happen:

• We identify you in PostHog by your account ID and business name once you are signed in. So we can see, for example, that a real business got stuck on the locations screen. Worth saying, because "anonymous analytics" would not be true.
• Our servers send PostHog the backend milestones for your account: payment taken, Instagram connected, setup finished, an ad went live, an ad was retired. These carry your account ID and business facts (number of locations, currency, amount, ad IDs). They never carry your email, your name or your phone number.

These analytics run by default, including for accounts with no saved choice. A saved rejection keeps them off. To change the account setting, sign in, follow Cookie settings, and choose Turn tracking off or Turn tracking on. We send that choice to your account for future background events; it does not remove events already sent.

If you phone us

Our phone number is answered by an automated assistant that speaks with you, looks up your account if the number you are calling from is on it, and passes everything to the team. When you call, this is what is kept:

• The audio of the call. So a person can hear what was actually said if the transcript is unclear.
• A written transcript, produced by the assistant as the call happens, plus a short structured note of what you asked for and anything the assistant said it would do (for example, that it would send you a link or get someone to check something).
• The number you called from, and, if that number is on a customer account, which account it belongs to. If you withhold your number, the call is still answered; there is simply nothing to match it to.
• Anything the assistant did during the call, such as pausing an advert at your request or sending a link to your phone. Those actions also appear on your account's activity feed, so you can see them afterwards.
• Whether a link we sent you was opened. When the assistant texts you a link, we keep a record of that link so we can tell whether it was opened. That record holds only a scrambled form of your number, produced in a way that cannot be turned back into the number, never the number itself.

What it is used for. Answering your call, doing what you asked, and letting a person follow up on anything the assistant could not finish. We also read transcripts to check the assistant behaved properly. The call is not used for marketing and the audio is not used to train anything.

Who handles it. The call itself runs on Twilio, which carries the phone line and passes the audio on. The conversation, the recording and the transcript are produced and held by ElevenLabs, which runs the voice assistant. The assistant's words are generated by a language model run by xAI, and a harder question during a call, or a check afterwards that the assistant behaved properly, goes to OpenAI. All four are named in the supplier list below. The transcript sent to those models carries what was said on the call and, if you are a customer whose identity was confirmed on the call, the plain facts about your account needed to answer you. It never carries your card details, and it never carries your Instagram password or access token.

How long. Recordings and transcripts are kept for up to 90 days at ElevenLabs, whose retention setting on our line is 90 days, and are gone after that. The number you called from is kept for up to 90 days as well, and the link records described above are removed on the same 90 day clock. The structured note of what was asked for and promised stays on your account for as long as the account does, because it is how we keep our word. To have a call removed sooner, email asad@huddleduck.co.uk with the number you called from and roughly when, and we will remove the recording and transcript.

If you would rather not be recorded, message us on WhatsApp instead. That is the other way to reach a person, and nothing is recorded there beyond the messages themselves.

Cookies, in full

Essential. These are ours, they are first-party, and the site does not work without them. No consent needed and no way to turn them off while using the product.

• tenant_id: keeps you signed in. 60 days.
• sp_audit: resumes your saved free plan using a random identifier. 30 days. It contains no Meta access token or account details.
• sp_chk_sid: ties a payment to the browser that made it, so your payment cannot get stranded away from your account. 7 days.
• sp_oauth: a one-use security token for the Instagram login round trip. Stops someone else's login being pushed into your browser. 10 minutes.
• sp_gate and sp_gate_oauth: the private beta door. 30 days.
• sp_ref: remembers which mate referred you, so they get credit. 30 days.
• sp_join, sp_join_comp, sp_join_magic: invite and sign-in links, so a link we sent you lands where it should.
• sp_hq, sp_impersonate, sp_admin: staff only, for our own console. These are never set on a customer's browser.
• sp_consent: your explicit tracking preference, in one word: accepted or rejected. 12 months. The tracking settings write it when you enable or disable tracking, and our servers read it for the events that follow this preference. No cookie means no explicit choice, which leaves tracking enabled by default. Scripts on our own site can read this cookie. A rejection saved by the old banner still keeps tracking off.
• sp_fbclid and sp_utm_source / sp_utm_medium / sp_utm_campaign / sp_utm_content / sp_utm_term: which ad or link brought you here, copied off the address you arrived on. 30 days, first-party, set on arrival. They load no tracking script and talk to nobody: if you go on to buy, they tell us which of our own ads earned the sale (and ride the purchase report described above). If you never buy, they expire unread.

Your explicit choice also lives in browser local storage under sp-consent-v1. Forms can save the current preference against your email in our database for later server events such as a Cal.com booking. Changing tracking settings while signed in also sends the choice to your account for background analytics. Disabling saves a rejection; it does not clear the choice back to an unanswered state. A default-enabled visit is not saved as an explicit acceptance.

Analytics and advertising cookies. These can be set by default when you visit. Disabling tracking prevents PostHog and the Meta pixel from loading on the reloaded page and subsequent visits while the saved rejection remains available.

• _fbp and _fbc: set by Meta. They connect your visit to one of our ads.
• The PostHog cookies (their names all start with ph_): set by PostHog. They tell a returning visitor apart from a new one and stitch your pageviews into one session.

Who else touches your data

These companies receive data to provide the services described below. Their roles and use of data depend on the service and its terms. Meta receives advertising and conversion data as well as operating the campaigns we manage.

• PostHog (EU cloud): analytics and session recording, enabled by default unless tracking is disabled.
• Meta: the pixel and the Conversions API, following the tracking settings and checkout/purchase exceptions described above. Meta also runs the ad platform used for customer campaigns.
• Stripe: subscriptions and payments. Stripe takes your card details directly. We never see or store a card number.
• Cal.com: if you book a call with us, your name, email and slot.
• Resend: sends our emails.
• Twilio: carries our phone line, sends the text messages the phone assistant offers to send you (a link, a confirmation of something you asked for), and passes call audio to ElevenLabs. Twilio sees the number you called from or that we texted.
• ElevenLabs: runs the voice assistant on our phone line. Holds the call recordings and transcripts for up to the 90 days described under "If you phone us".
• xAI: the language model that produces the phone assistant's replies. Sees the call transcript and, for a confirmed customer, the plain account facts needed to answer. Never card details, never an access token.
• Turso: the database your data sits in. Turso hosts it, not Vercel and not us on a laptop.
• Vercel: hosts the app itself.
• Slack and Notion: our own internal alerts. When you pay, cancel, or something breaks on your account, a message with your name, email and what happened lands in our team channel and our task list, so a human actually picks it up.
• TypeSafe AI: campaign performance numbers (budgets, impressions, clicks and spend) go to TypeSafe's Jev model to help decide whether a location's budget should move and whether an advert is clearly weak. We replace our location, advert and Meta identifiers with temporary references before sending this data. Card details, names, email addresses and Instagram access tokens are never sent.
• OpenAI: post images, captions and dates may be checked to decide whether an advert is still relevant. If the address you typed at setup is messy, the address text goes too. OpenAI also remains the backup for campaign budget decisions if TypeSafe is unavailable. Phone call transcripts go to OpenAI when the assistant needs help with a harder question during the call, and afterwards to check the assistant behaved properly. Card details and Instagram access tokens are never sent.
• OpenStreetMap (Nominatim) and postcodes.io: turning your address into a map pin so we can target the right radius. They receive the address, nothing else.

That is the list. If it changes, this page changes.

Where your data lives and how it is protected

• Your account data sits in an encrypted Turso (LibSQL) database.
• Your Meta access token is encrypted at rest. It is the keys to your ad account, and we treat it that way.
• Everything moves over HTTPS.
• Access is limited to the systems that need it and the people who run SuperPulse.

How long we keep things

• Session recordings: 30 days, then PostHog deletes them.
• Phone call recordings and transcripts: up to 90 days, then gone. The number you called from, and the record of whether a link we texted you was opened (which holds only a scrambled form of your number), go on the same clock. The short note of what was asked for and promised on the call stays with your account.
• Analytics events: up to 84 months. That is longer than the recordings, so we would rather say it than let "deleted after 30 days" cover the lot. It does not.
• Your account and campaign data: for as long as you are a customer, then 30 days after you cancel (in case you come back), then deleted.
• Billing records: six years, because tax law says so.
• Waitlist details, if you never became a customer: until you ask us to delete them. Email us and we will.

Your rights

• See what we hold. Most of it is on your dashboard. Ask us for the rest.
• Get a copy. Email us and we will export it.
• Have it deleted. Email asad@huddleduck.co.uk. We will delete it within 30 days. That covers a phone call's recording and transcript too.
• Correct anything wrong.
• Disable optional tracking, or withdraw an earlier acceptance. Follow Cookie settings in the footer to Tracking settings on this page, then choose Turn tracking off. This saves a rejection in local storage and the sp_consent cookie, stops PostHog capture and session recording, and reloads the page so the Meta pixel is no longer running. If you are signed in, we also send the rejection to your account so future background analytics can follow it. Choosing Turn tracking on records an explicit acceptance and turns optional tracking back on. Disabling does not undo data already collected. The checkout and purchase reports described above are independent of this setting; email asad@huddleduck.co.uk to object to those.
• Update a choice saved against your email. The settings control cannot identify a separate waitlist record saved against your email. An older setting on that record can still allow a later booking to be reported to Meta. Email asad@huddleduck.co.uk and we will update that record to disable tracking. Deleting a browser preference would restore the default, so we save a rejection instead.
• Cut off our access to your Instagram. Meta Business Settings, then Business Integrations, then SuperPulse, then Remove. You do not need to ask us first.
• Complain to the regulator. If you think we have handled your data badly, tell us and we will fix it. If we do not, you can complain to the Information Commissioner's Office at ico.org.uk, or call them on 0303 123 1113. You do not need our permission.

Changes to this policy

If we add a tool or change what we collect, we update this page and change the date at the top. If it is a significant change, we email customers rather than quietly editing.

Contact

• Email: asad@huddleduck.co.uk
• Post: Huddle Duck Ltd, 22 Ventnor Road, Solihull B92 9BU, United Kingdom