Privacy Policy

PulseMeter ("we") helps teams monitor their LLM API and AI seat spend. This policy explains what we collect and how we use it. Our guiding principle is minimalism: we collect the least data needed to alert you about spend.

Information we collect

• Account data: your email and authentication identifiers.
• Provider usage and cost data: usage and cost figures (token counts and dollar amounts by day and model) retrieved from the read-only keys you connect.
• Team member usage and activity metrics: for enterprise seat providers (such as Claude Enterprise or ChatGPT Enterprise), the provider's analytics API reports usage, cost, and activity per person — so we store your team members' work email addresses alongside their token and dollar totals and activity counts (messages sent, sessions, commits, pull requests, lines of code changed). Counts only: never the content of anyone's conversations, code, or files.
• For Amazon Bedrock: per-model token counts from CloudWatch and Bedrock cost line items from Cost Explorer, read through a read-only IAM role you create in your AWS account; never your prompts or any other AWS resource.
• Configuration: budgets, alert rules, and notification channels you set up.
• Product analytics: basic, privacy-respecting usage of the app to improve it.

What we do not collect

We never receive your prompts, completions, conversation content, or your customers' data. The provider keys you connect are scoped to read usage and cost data only.

How we use data

• To calculate spend, detect anomalies, and send you alerts.
• To provide, secure, and improve the service.
• To communicate about your account and billing.

Storage and security

Provider keys are encrypted at rest with AES-256-GCM. See our security page for details. We use Vercel (hosting and analytics), Supabase (database and authentication), Stripe (payments), and Resend (email delivery) as subprocessors, and Slack receives alert payloads if you add a webhook.

Data retention and deletion

Disconnecting a provider hard-deletes its stored key. Closing your account removes your workspace data. You can request export or deletion at any time.

Accounts that never connect a provider and are not on a paid plan are treated as unused. If such an account sees no sign-in for 30 days we email the owner a warning; if it is still unused 15 days later we delete it, including the email address and the empty workspace. Signing in or connecting a provider at any point keeps the account.

Your rights

Depending on your location you may have rights to access, correct, or delete your data. Contact support@pulsemeter.ai.