Privacy
Policy.

Depending on how you interact with NEKAI, we may collect and process information including:

• Your name and contact details.
• Your email address.
• Your business or organization name.
• Account and authentication information.
• Information you provide when contacting us or requesting support.
• Billing and subscription information, such as your billing name and address, plan, currency and payment status. Card details are collected by Stripe; we do not receive or store your full card number.
• Technical information such as IP addresses, browser information, device information, timestamps and server logs.
• Information about websites you configure or authorize Pulse to monitor.
• Monitoring results, website responses, test results and diagnostic information generated by Pulse.
• Website HTML, screenshots or snapshots captured for diagnostic purposes.
• Information generated through synthetic browser journeys, form tests or other monitoring activities.
• Your cookie choices.
• Any other information you choose to provide to us.

We collect this information from you, from your use of our website and Pulse, and from our service providers, such as Stripe when you pay.

We aim to collect only information reasonably necessary to provide, secure and improve our services.

We may process personal information in order to:

• Create and manage accounts.
• Provide NEKAI products and services.
• Operate Pulse and perform monitoring requested by customers.
• Send monitoring alerts and operational notifications.
• Process subscriptions and payments.
• Provide customer support.
• Diagnose faults and investigate monitoring failures.
• Maintain and improve the reliability and security of our services.
• Prevent fraud, abuse and unauthorized access.
• Maintain appropriate business, accounting and legal records.
• Meet applicable legal obligations.
• Communicate with prospective and existing customers where permitted by law.

We will not use personal information for purposes incompatible with the reason it was collected unless permitted or required by law.

Where UK data protection law applies, we will rely on an appropriate lawful basis for processing personal information.

Depending on the circumstances, this may include:

Contract — where processing is necessary to provide a service you have requested or perform a contract with you.

Legitimate interests — where processing is reasonably necessary to operate, secure, protect or improve NEKAI and its services and those interests are not overridden by your rights.

Legal obligation — where processing is necessary to comply with applicable law.

Consent — where we specifically ask for your consent to particular processing, such as analytics or marketing cookies.

Pulse is designed to monitor websites and test whether important website functionality is operating as expected.

Depending on the monitoring configured, Pulse may:

• Make automated HTTP requests.
• Load website pages.
• Search pages for specified content.
• Crawl websites.
• Use automated browsers to simulate user journeys.
• Interact with website interfaces.
• Capture HTML, screenshots, snapshots or diagnostic information when problems occur.
• Test forms or booking functionality where such functionality is enabled.

Users are responsible for ensuring they have appropriate authority to instruct Pulse to monitor or interact with a website or system.

During monitoring, Pulse may encounter personal information contained within customer websites or systems.

Where NEKAI processes personal information solely on the instructions of a customer, NEKAI may act as a data processor (or service provider) and the customer may act as the data controller (or business).

Customers should avoid configuring Pulse to access personal, confidential or sensitive information unless this is necessary for the monitoring being performed and they have an appropriate lawful basis for doing so.

Where required, separate data-processing terms may apply.

Pulse may retain HTML, screenshots, website snapshots, responses, logs and other diagnostic information generated during monitoring.

For example, when a page fails a check, Pulse may preserve information about the page at the time of failure so that the customer can understand what went wrong.

This information may incidentally contain information displayed by the monitored website.

Diagnostic information is used to provide monitoring results, investigate failures, troubleshoot problems and maintain the Pulse service.

Certain Pulse functionality may interact with forms, booking systems or other website functionality to determine whether they are operating correctly.

Where enabled, test information may be submitted to systems authorized by the customer.

Where supported, Pulse may subsequently attempt to cancel, remove or otherwise clean up test records.

Customers are responsible for ensuring that they have authority to permit this testing and that the systems being tested are appropriately configured.

NEKAI’s primary website hosting and Pulse application infrastructure used to store customer data are located in the United Kingdom.

Our current primary hosting infrastructure and VPS are hosted on servers located in the UK. Pulse monitoring checks run from servers in Manchester, United Kingdom.

If you use our website or Pulse from outside the UK, including from the United States, your information will be transferred to and processed in the UK.

Some supporting third-party providers may process limited information outside the UK, including in the United States. These include Stripe for payment processing, Defiant, Inc. for the Wordfence security service and, only if you allow analytics or marketing cookies, Google.

Where international transfers of personal information occur, we will take appropriate measures required under applicable UK data protection law.

We may use trusted third parties to provide services necessary to operate NEKAI.

These may include providers of:

• Hosting and infrastructure.
• Payment processing.
• Transactional email.
• Logging, monitoring and security.
• Analytics, where implemented.
• Professional accounting, legal or insurance services.

Our main providers are Hostinger (website and application hosting and email), Stripe (payments), Defiant, Inc. (the Wordfence security service, which processes visitors’ IP addresses and request details to block attacks) and, only if you allow analytics or marketing cookies, Google.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We may also disclose information where required by law, where reasonably necessary to protect our legal rights, or in connection with a future sale, restructuring or transfer of the NEKAI business.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

Retention periods may depend on the type of information and may include considerations such as:

• How long an account remains active.
• The period for which monitoring history is provided.
• Troubleshooting and security requirements.
• Dispute resolution.
• Accounting and tax obligations.
• Other legal requirements.

Monitoring results, snapshots and diagnostic information may be automatically removed according to the retention period applicable to the relevant service.

Following account deletion or termination, some information may temporarily remain within backups before being removed through normal backup rotation.

We use reasonable technical and organizational measures designed to protect personal information from unauthorized access, alteration, disclosure, destruction or loss.

However, no internet-connected system can guarantee absolute security.

Users are responsible for maintaining the confidentiality of their account credentials and should contact us promptly if they believe an account has been compromised.

Cookies are small files stored on your device. We treat similar technologies, such as local storage, in the same way.

We group cookies into three categories. Essential cookies are always on. Analytics and marketing cookies are only used if you choose to allow them, and you can change your choice at any time using the Cookie settings link at the bottom of every page.

Essential cookies (always on)

• nekai_consent: remembers your cookie choices. Set by us and kept for 6 months.
• __stripe_mid and __stripe_sid: set by Stripe, our payment provider, when our secure checkout loads on the pricing page. They help prevent fraud and keep payments secure. __stripe_mid lasts 1 year and __stripe_sid lasts 30 minutes.
• wordpress_*, wordpress_logged_in_*, wordpress_test_cookie and wp-settings-*: set by WordPress only when a site administrator signs in.
• wfwaf-authcookie-*: set by our Wordfence security firewall only for signed-in site administrators.
• session, csrf and mfa_pending: used by the Pulse application to keep you securely signed in to your account and to protect forms against forgery. The session cookie lasts up to 14 days; the others last minutes or until you sign out.

Analytics cookies (only with your consent)

We do not currently use analytics cookies. If we add a service such as Google Analytics, which sets _ga and _ga_* cookies for up to 2 years, it will only set them after you allow analytics.

Marketing cookies (only with your consent)

We do not currently use marketing cookies. If we advertise in future, services such as Google Ads may set cookies (for example _gcl_au, for up to 90 days) to measure how well our advertising works. They will only be set after you allow marketing.

Until you make a choice, and whenever you reject non-essential cookies, only essential cookies are used. We also send Google Consent Mode signals so that any Google service we add respects your choice.

We honor the Global Privacy Control (GPC) browser signal as a request to opt out of marketing cookies and of any sale or sharing of your personal information.

You can also block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the site, such as checkout, from working.

We may send marketing communications where permitted by applicable law.

Where appropriate, marketing communications will provide a method of opting out.

Messages necessary to operate your account or service — such as monitoring alerts, security notices, billing communications and important service information — are operational communications rather than marketing.

Wherever you live, you can ask us to access, correct or delete the personal information we hold about you, and you can opt out of marketing at any time. To make a request, contact us using the details in this Privacy Policy.

We will need to verify your identity before acting on a request, and we will not treat you differently for exercising your rights.

If you live in the United States, state privacy laws (for example in California, Colorado, Connecticut, Virginia and other states) may give you rights over your personal information. Depending on where you live, these may include the right to know what personal information we hold, to access it, to correct it, to delete it, and to opt out of its sale, its sharing for cross-context behavioral advertising, or its use for targeted advertising.

Sections 1, 2, 9 and 10 describe the categories of personal information we collect, where it comes from, why we use it, who receives it and how long we keep it.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. If we introduce advertising cookies, they will only be used with your consent, and you can opt out at any time through Cookie settings or by using Global Privacy Control, which we honor.

We do not use personal information to make decisions that produce legal or similarly significant effects about you, and we do not knowingly collect sensitive personal information from website visitors.

To make a request, contact us using the details in this Privacy Policy. We will verify your request before acting on it and will not treat you differently for exercising your rights. Where the law allows, you may use an authorized agent to make a request on your behalf.

If we decline your request, you may appeal by replying to our decision. If you are not satisfied with the outcome of your appeal, you may contact the attorney general of your state.

Under UK data protection law (the UK GDPR and the Data Protection Act 2018), you may have rights including the right to:

• Request access to personal information held about you.
• Request correction of inaccurate information.
• Request deletion of information in certain circumstances.
• Request restriction of processing in certain circumstances.
• Object to certain processing.
• Request portability of certain information.
• Withdraw consent where processing relies on consent.
• Make a complaint concerning the processing of your information.

These rights are subject to applicable legal conditions and exemptions.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

If you have concerns about how your information is handled, please contact NEKAI so that we can investigate the issue.

You may also contact the regulator where you live, such as the ICO in the UK or your state attorney general in the US.

NEKAI’s commercial products and services are intended for businesses and professional users.

We do not knowingly seek to collect children’s personal information through Pulse.

We may update this Privacy Policy as our products, infrastructure, suppliers or legal obligations change.

The latest version will be published on the NEKAI website with the date of the most recent update.

Where appropriate, users will be notified of material changes.

For questions, requests or concerns regarding privacy or data protection, contact:

NEKAI

Email: hello@nekailabs.com

Once a legal entity is established to operate NEKAI, this Privacy Policy will be updated to identify that entity and provide the applicable registered details.