Privacy policy.

1. Who we are

cpuPulse is operated by KARDITORWEB, UNIPESSOAL, LDA (trading as Karditor), a company registered in Portugal, NIPC 515899062. For anything in this policy, write to rfaria@karditor.com.

2. Two roles, two kinds of data

cpuPulse is sold to an organisation that installs the agent on computers it owns. That distinction decides who is responsible for what.

Account data — we are the controller

The data of the person who signs in to the dashboard: name, e-mail address and profile picture as supplied by the sign-in provider, the account and group memberships, the credit ledger and payment records, and the technical logs of those requests.

Usage data — the customer is the controller, we are the processor

Everything the agent records on a monitored computer belongs to the organisation that installed it. That organisation decides why the computers are monitored, who may see the result and when it is deleted within the limits below; we process it on their instructions, to run the service. If cpuPulse is running on a computer you use at work, your employer is the party to ask about it first.

3. What the agent records

This is the complete list. Nothing else leaves the computer.

• The name of each running program and Windows service, and the mean percentage of the processor it used in each ten-minute block of the day.
• An inventory of installed applications: name, install path, version and size on disk.
• Machine events, with their timestamp: start-up, shutdown, sleep, resume, and the agent starting or stopping — so a gap in the record is visible rather than hidden.
• Session events — sign-in, sign-out, lock and unlock — with their timestamp and nothing more.
• The computer name, the Windows version and the version of the agent.

What it never records

• No screenshots and no screen capture of any kind.
• No keystrokes and no clipboard contents.
• No window titles, no browsing history, no page contents.
• No files, file names or documents; no e-mail, messages, camera or microphone.
• No location data.
• No Windows user name. A session event records that a session started, ended, locked or unlocked — never which account it belonged to, so a computer shared by several people yields one timeline, not one per person.
• No remote control of the computer: the agent sends data out, and takes no commands in.

How it is installed

The agent is a visible Windows service named cpuPulse, listed in Services and in Task Manager, with an entry in Apps & features and a Start-menu shortcut. The installer shows a consent notice before installing, and a computer only starts sending data after a person approves it in the dashboard. Running cpuPulse.exe status reports the local state to any user, without administrator rights.

4. Why we process it

Data	Purpose	Legal basis
Account data	Providing the service, authenticating you, billing, support.	Performance of the contract; legal obligation for accounting records.
Usage data	Showing the owner how their computers are used.	The customer's legitimate interest in managing equipment it owns, established by that customer.
Service logs	Keeping the service running, secure and abuse-free.	Our legitimate interest in operating a secure service.

We do not sell data, do not share it with advertisers, and do not use it to train machine learning models.

5. How long it is kept

• Usage and events: twelve months, rolling. Days older than that are deleted outright — not archived, not anonymised and kept.
• A computer removed from an account: its history is deleted within ninety days.
• A closed account: everything belonging to it is deleted within ninety days.
• Account records are kept while the account exists.
• Payments are processed by Stripe, which issues the receipt; what we keep is the record of the transaction and the credit ledger behind it, for as long as Portuguese accounting and tax law requires.

6. Where it is processed, and by whom

The service runs on Google Cloud in the United States (region us-central1). Our processors are:

• Google Cloud Platform / Firebase — hosting, authentication and the security control plane.
• MongoDB Atlas — the usage and events store.
• Stripe — payments. Card details go to Stripe directly; we never see or store them.

Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses, agreed with each of these providers.

7. Security

Everything the agent sends travels over HTTPS. Each computer authenticates with its own credential, which the account owner can revoke at any time, and every query is confined to its own account. The agent runs as a Windows service under the local system account, which it needs in order to measure processor use across the machine; it opens no inbound port and accepts no remote commands.

8. Your rights

Under the GDPR you may request access to your personal data, its correction or erasure, a copy in a portable format, restriction of processing, or object to processing based on legitimate interest. Write to rfaria@karditor.com and we will answer within one month.

If the request concerns data recorded on a computer owned by your employer, we will forward it to that customer, who is the controller of that data and decides the outcome.

You also have the right to complain to a supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD).

9. Cookies and the website

This website sets no advertising cookies and carries no third-party trackers. The dashboard at app.cpupulse.app stores a sign-in session in your browser, which is required for it to work at all.

10. Children

cpuPulse is a business tool. It is not directed at children and we do not knowingly process their data.

11. Changes

If this policy changes we update this page and its date. Material changes are announced to account owners by e-mail before they take effect.