Privacy Policy
Effective 21 September 2026 · Last updated 21 September 2026
This policy covers pullsy.store, a site operated by Acasa Labs (OPC) Private Limited, a company incorporated in India (“we”, “us”).
Pullsy Store is not open yet. Today this site is one page and a form, so the only personal data we hold about you is what you typed into that form and the little your browser sends with any request. There are no accounts, no payments and no connected platforms — when those arrive, this policy is replaced before they do, not after.
1.What we collect
What you send us
The early-access form asks for your name, email address, the handle you post under and which platform it is on, what you sell, a revenue range, and an optional note. All of it is optional in the sense that you can simply not apply; if you do apply, the form will not submit without the answers marked required.
What comes with it
- Your browser’s user-agent string and the page that referred you, stored on the application so we can tell a real submission from an automated one.
- A bot check. The form is protected by Cloudflare Turnstile, which sees your IP address and some signals about your browser in order to decide whether you are a person. We receive its verdict, not its evidence.
Analytics, only if you allow it
If you accept analytics in the cookie banner, Google Analytics 4 tells us which pages were read and roughly where readers came from. It runs only after you accept, and never for advertising. If you decline, no Google script is loaded and no analytics cookie is set.
Anything you email us
Mail sent to the addresses on this site, and our replies. We keep the thread so the conversation makes sense next time.
2.Why we use it, and our legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Read your application and decide who to open early access to | It is the entire point of the waitlist | Legitimate interest, and your request to be considered |
| Write back to you — a receipt now, an invitation later | You asked to be told | Your request, and consent |
| Check the form was filled in by a person | An unprotected public form fills with junk within days | Legitimate interest |
| Count page visits in aggregate | To know which parts of the page are read | Consent — and nothing runs before you give it |
We do not sell personal data, we do not use it to advertise to you, and we do not profile you. Your answers are read by us to decide who to invite, and nothing else.
4.Who it reaches
A small number of service providers process this data on our instructions, under contract, and for no purpose of their own. We publish the categories rather than an inventory of our infrastructure; the named list is sent on request to hello@pullsy.store.
| Category | What they do |
|---|---|
| Managed database | Stores early-access applications |
| Site hosting | Serves this site and runs the form's handler |
| Bot protection | Checks that a submission came from a person |
| Transactional email | Your receipt, and our copy of your application |
| DNS and email routing | Resolves this domain and delivers mail sent to it |
| Analytics | Aggregate page analytics, only where you consent |
Beyond that, we disclose personal data only where the law requires it, or to establish or defend a legal claim.
5.Where it goes
The database is hosted in the United States and the site runs in Singapore; email and DNS providers operate globally. Transfers out of the EEA or the UK rely on the European Commission’s Standard Contractual Clauses, which our providers offer as part of their terms.
6.How long we keep it
| What | How long |
|---|---|
| Your application | Until early access opens and we have invited or declined you, and at most 24 months from when you applied |
| Email threads | Up to 24 months after the last message |
| Analytics | 14 months in Google Analytics |
| Your cookie choice | 180 days, then we ask again |
| Your theme choice | 12 months, and only the word light, dark or system |
Ask us to delete your application and we delete it, rather than keeping a copy in case you come back.
7.How we protect it
Traffic runs over TLS. The applications table sits in a managed Postgres database reachable only over an authenticated connection, and the credentials live in a secret manager rather than in the code. Access is limited to the people who need it, which today is a very short list. No system is perfectly secure, and we will not pretend otherwise.
8.Your rights
Everyone
Write to hello@pullsy.store and we will do any of the following: send you a copy of what we hold, correct it, or delete it. We answer within 30 days and we do not charge for it.
If the GDPR applies to you (EEA and UK)
You also have the right to restrict or object to processing, to receive your data in a portable format, to withdraw consent at any time without affecting what came before, and to complain to your supervisory authority.
If the DPDP Act applies to you (India)
You have the right to access, correction, erasure and grievance redressal, and to nominate someone to exercise those rights on your behalf. Grievances reach us at the address above and are handled by the people who run the service.
9.Children
This site is for people running a business, and is not directed at anyone under 18. If you believe a minor has sent us personal data, write to hello@pullsy.store and we will delete it.
10.Changes
We will update this policy as the product grows — an early-access waitlist and a live storefront are not the same thing, and the version that covers payments will say so plainly. The date at the top is the version you are reading. Material changes are announced by email to anyone on the list before they take effect.
11.Contact us
Privacy questions and requests: hello@pullsy.store. Anything legal: contact@pullsy.store.
Acasa Labs (OPC) Private Limited.