Optimator
PulseBerry

Fireberry applications

Privacy policy

How Optimator collects, uses, protects, and retains information when providing PulseBerry and other Optimator applications and integrations for Fireberry.

1. Scope and roles

This policy applies to PulseBerry, its Fireberry add-on, Make application, API, and other Optimator applications expressly linking to this policy (the “Services”). It does not replace Fireberry’s, Make’s, or a customer’s own privacy policy.

The business that installs or connects a Service (the “Customer”) generally determines why and how personal information in its CRM is processed and is responsible for that data. Optimator processes Customer-provided data to deliver the Services and may act as a service provider or processor on the Customer’s instructions. Optimator is independently responsible for account, billing, security, support, and legal-compliance information it controls.

2. Information processed

Depending on the Service and configuration, we may process:

  • Fireberry organization identifiers and internal Optimator account identifiers.
  • Fireberry user identifiers, user names, first-seen and last-seen timestamps.
  • License and subscription information, including license level, invoice name, plan, status, seat counts, quotas, and daily usage totals.
  • API credential metadata, including a one-way SHA-256 hash, token prefix, issue, rotation, and last-use timestamps. We do not intentionally retain the raw organization token in the PulseBerry API database.
  • Action and command data, including object type, record identifier, target user identifier, action type, notification text and display settings, version, status, and timestamps.
  • Session, request, security, error, and audit information, such as session identifiers, IP address and device or browser data available in server logs, administrative actions, and diagnostic details.
  • Support and business correspondence you choose to send us.

PulseBerry does not need a copy of an entire CRM record merely to deliver a refresh or notification command. However, record identifiers, user identifiers, and notification text can be personal information. Do not place passwords, API keys, medical information, payment-card data, government identifiers, or other sensitive information in notification text or support messages.

3. How information is obtained

Information is received from the Customer or its authorized users, from Fireberry’s application environment and APIs, from Make scenarios or direct API calls initiated by the Customer, and automatically from use of the Services. The Customer is responsible for providing legally required notices and obtaining any authorization, consent, or other lawful basis needed for information it submits.

4. Purposes and legal bases

  • Provide, authenticate, isolate, operate, maintain, and support the Services.
  • Route refresh and notification actions to the intended organization, record, or user.
  • Apply plans, quotas, rate limits, licensing, and billing arrangements.
  • Secure the Services, prevent fraud and abuse, troubleshoot errors, and investigate incidents.
  • Communicate about support, operational changes, security, and the Customer relationship.
  • Meet legal obligations and establish, exercise, or defend legal claims.
  • Improve reliability and features using aggregated or de-identified information where practical.

These activities are based, as applicable, on performance of our agreement, our legitimate interests in operating and protecting a business service, compliance with law, and consent where the law requires it. We do not sell personal information and do not use Customer CRM data for third-party advertising.

5. Sharing and subprocessors

We may disclose information only as reasonably necessary to hosting, infrastructure, email, security, monitoring, support, and professional-service providers; to Fireberry, Make, or another integration selected by the Customer; during a corporate transaction subject to appropriate confidentiality; or where law, a competent authority, or protection of rights and safety requires it.

Third-party platforms operate under their own terms and privacy practices. Data may be processed outside Israel where a provider or integration operates. Where applicable, we use contractual or other legally recognized measures for international transfers. Customers should contact us before using the Services if they require a specific data-location or processing agreement.

6. Retention

PulseBerry’s operational sessions are short-lived, and refresh, notification, and action commands ordinarily expire after approximately ten minutes; deployment configuration may vary. Expired operational records are periodically removed. Account, user, license, usage, support, security, and administrative audit information may be retained while an account is active and afterward for a reasonable period needed for continuity, security, legal compliance, accounting, dispute resolution, and enforcement.

Deletion from active systems may not immediately remove information from backups or mandatory security records, which are deleted or overwritten on controlled schedules or retained as required by law. Aggregated or irreversibly de-identified data may be retained longer.

7. Security

We use measures designed for the nature of the Service, including encrypted transport, organization-level isolation, access restrictions, credential hashing, token rotation, short command lifetimes, rate limits, logging, and maintenance procedures. Customers must protect their Fireberry and Make accounts and treat the PulseBerry organization token like a password. A compromised token should be rotated immediately.

No system is completely secure. We cannot guarantee that unauthorized access, loss, or misuse will never occur. If we identify a security incident, we will investigate and notify affected Customers or authorities when required by applicable law and our role in the processing.

8. Customer instructions and rights

Users may have rights to inspect, correct, delete, or restrict certain personal information under applicable law. Where information is controlled by a Customer, requests should first be directed to that Customer. We will reasonably assist the Customer with verified requests as required by law and the applicable agreement.

Requests concerning information controlled directly by Optimator may be sent below. We may verify identity and authority, ask for the relevant organization identifier, and retain information where law or legitimate legal claims require it.

Privacy requestssupport@optimator.co.il

9. Customer responsibilities

The Customer must configure and use the Services lawfully, limit access to authorized personnel, maintain accurate user permissions, avoid unnecessary or sensitive data in commands, and comply with applicable privacy, employment, direct-marketing, database, and information-security duties. Optimator does not determine whether a Customer’s automation or message is lawful.

10. Business service and minors

The Services are designed for organizations and professional users, not consumers or children. Customers must not knowingly use the Services to process children’s information unless they are legally authorized and have agreed suitable safeguards with Optimator in advance.

11. Changes and contact

We may update this policy to reflect product, provider, security, or legal changes. The updated version applies from the date shown above, subject to any notice required by law or agreement. Material changes will be communicated through the Service, website, or Customer contact details where appropriate.

Questions, processor terms, and security reports may be sent to support@optimator.co.il. Please do not include credentials or sensitive CRM records in email.