Privacy & Security Policy

CampPulse 360 is used by camps and seasonal programs; sports academies, clubs, leagues, dance and performing arts studios, gymnastics and swim schools; after-school, extended care, tutoring, and enrichment programs; and other organizations that run structured programs for participants.

Customers may rename the platform’s core terms to match their own vocabulary, so that a camp may appear as an academy, club, studio, school, or program; a camper may appear as a player, athlete, dancer, swimmer, student, or participant; a cabin may appear as a team, squad, group, or class; and a session may appear as a practice, class, term, or program.

In this Policy the words camp, camper, cabin, and session are used as general labels for those records, whatever a Customer has chosen to call them. Participant means any individual enrolled in a Customer’s program, whether a child, a youth, or an adult.

The information collected through CampPulse 360 depends on how each Customer configures and uses the platform. The platform may collect or process the following categories of information.

Personal Information and Customer Data

CampPulse 360 collects and processes personal information and Customer Data needed to provide registration, payment, household management, registrant management, staff management, communications, reporting, and related services.

This may include the following types of information:

Account and Login Information

This may include name, email address, account identifiers, Clerk authentication identifier, user role, tenant/customer association, account status, and login-related information. Authentication is managed through Clerk, and CampPulse 360 does not store user passwords.

Household and Contact Information

This may include household name, parent or guardian names, email addresses, phone numbers, mailing addresses, family notes, referral information, and household status.

Camper, Registrant, and Participant Information

This may include name, preferred name, date of birth, age-related eligibility information, gender, grade, school, t-shirt size, registration history, session selections, cabin assignments, activity preferences, transportation details, authorized pickup persons, and notes.

Medical, Health, Dietary, Physician, Insurance, and Emergency Information

Depending on Customer setup, CampPulse 360 may process allergies, medications, dietary needs, medical conditions, current medications, medical equipment, treatment instructions, physician details, insurance information, medical notes, emergency contacts, and related forms or attachments.

Staff Information

This may include staff profile details, position, department, employment type, skills, certifications, background check status, availability, fit-to-work status, medical or emergency information, and related notes.

Registration, Program, and Operational Information

This may include camps, sessions, cabins, add-ons, capacities, registration status, attendance-related information, communications, invitations, notes, and administrative records.

Payment, Invoice, and Transaction Information

This may include cart details, order details, invoice details, payment status, amount paid, payment method, transaction references, tax amounts, currency, and related billing records.

Credit card and ACH payment information is handled by Stripe. CampPulse 360 does not store full credit card or bank account numbers.

Communications and Support Information

This may include messages, email delivery records, support requests, communication history, follow-up notes, and information you provide when contacting us.

Attachments and Uploaded Files

Customers and users may upload forms, waivers, medical documents, photos, or other files depending on how the platform is configured.

We do not sell personal information. We do not share personal information or Customer Data with third parties for their own marketing purposes.

Usage and Technical Information

We may collect usage, technical, diagnostic, analytics, and security-related information about how CampPulse 360 and our website are accessed and used. This may include IP address, browser type, device information, log data, timestamps, pages or features accessed, error logs, performance information, session activity, and security-related events.

We use this information to operate, secure, troubleshoot, support, monitor, and improve CampPulse 360.

We may use trusted third-party service providers to help process usage and technical information, including providers for hosting, authentication, payment processing, email delivery, file storage, analytics, monitoring, logging, support, security, and operations. These providers may process information only as needed to provide services to us and are not permitted to use Customer Data for their own marketing purposes.

We use personal information to:

• Provide, operate, and maintain CampPulse 360;
• Support online registration, cart, checkout, invoicing, and payment workflows;
• Manage household, participant, registrant, staff, session, program, group, and add-on records, including campers, cabins, and camps where a Customer uses those terms;
• Authenticate users and manage access;
• Send registration confirmations, operational emails, system messages, and support communications;
• Provide customer support and troubleshoot issues;
• Maintain security, prevent fraud, and protect the platform;
• Improve the reliability, usability, and performance of CampPulse 360;
• Create administrative reports and operational views for Customers;
• Comply with legal, accounting, tax, security, and contractual obligations; and
• Enforce our Terms of Service and other agreements.

We do not sell personal information. We do not share personal information or Customer Data with third parties for their own marketing purposes. We use personal information and Customer Data only to deliver, operate, secure, support, and improve CampPulse 360, comply with legal obligations, and fulfill our agreements.

We do not knowingly use participant or children’s personal information for unrelated advertising.

CampPulse 360 is designed for use by camps, academies, clubs, studios, schools, programs, organizations, administrators, staff, parents, guardians, and authorized household members. The Service is not intended for direct use by children without involvement from a parent, guardian, or authorized organization.

Accounts on CampPulse 360 may only be created by individuals aged sixteen (16) or older. Individuals under that age do not create accounts or submit personal information directly through the platform; their information is entered by a parent, guardian, authorized household member, or the Customer. PulseCore is not responsible or liable for information uploaded to the platform without appropriate consent or authorization.

Where the U.S. Children’s Online Privacy Protection Act (COPPA) applies to a Customer’s program, the Customer is the operator responsible for providing notice to parents and obtaining verifiable parental consent. PulseCore acts as a service provider to the Customer and processes children’s personal information only on the Customer’s instructions and only to provide the Service, never for advertising, profiling, or sale.

Because CampPulse 360 supports registration for programs that serve children and youth, the platform may process information about children and youth participants. This may include camper or registrant profile information, date of birth, grade, gender, school, session selections, cabin assignments, activity preferences, transportation details, authorized pickup persons, emergency contacts, medical information, allergies, medications, dietary needs, physician information, insurance information, forms, waivers, and related notes.

This information is generally provided by parents, guardians, authorized household members, Customer administrators, or staff. Customers are responsible for obtaining appropriate consents and permissions required for their programs, including parental or guardian consent where required.

Some Customers operate programs that include adult participants. Where an adult registers for a program, the provisions of this Policy that concern children and minors do not apply to that individual, and the Customer remains responsible for obtaining any consents its program requires.

CampPulse 360 does not knowingly use participant or children’s personal information for unrelated advertising. We do not sell children’s personal information.

Parents and guardians who have questions about their child’s information should first contact the organization with which they registered. If the question relates to CampPulse 360’s handling of the platform itself, we can be contacted using the details at the end of this Policy.

If we become aware that information about a minor has been provided without appropriate authorization, we will work with the applicable Customer to review and address the issue.

Some information processed in CampPulse 360 may be sensitive, including medical conditions, allergies, medications, dietary needs, insurance details, physician information, emergency contact details, background check status, and uploaded forms.

We process this information to provide the platform and support Customer-configured workflows. Customers should collect only the sensitive information they need for legitimate program, safety, registration, staffing, or operational purposes.

CampPulse 360 uses Stripe as its payment processor. Stripe may collect and process payment information such as card details, bank details, billing information, transaction data, fraud prevention signals, and payment authorization information.

CampPulse 360 may store payment-related records such as payment status, amount paid, payment method type, transaction reference, invoice number, tax amount, and related accounting information, but we do not store full credit card or bank account numbers.

Stripe’s processing of payment information is governed by Stripe’s own terms, privacy notices, and security practices.

We use trusted third-party service providers to operate, secure, support, and improve CampPulse 360. These providers may process personal information, Customer Data, usage information, or technical information only as needed to provide services to us.

Key service providers include:

• Render— application hosting infrastructure;
• Stripe— payment processing;
• Clerk— authentication and identity management;
• Postmark— email delivery;
• Cloudflare— file storage, attachment delivery, security, or performance services;
• OpenAI— AI-assisted features, including AI Builder, AI Placement, Pulse IQ, and AI Notes Assistant; and
• Other vendors used for monitoring, support, analytics, logging, security, or operations.

These service providers are not permitted to use Customer Data for their own marketing purposes. We do not sell personal information to service providers or analytics vendors.

Customers may request a current list of subprocessors using the contact details at the end of this Policy. Where required by contract, we will provide notice of material subprocessor changes.

We may update our service providers over time as the platform grows.

PulseCore Inc. is based in Ontario, Canada. Our offices and employees are located in Canada.

CampPulse 360 application data is hosted in the United States, with the primary hosting region in US East. We use Render as our hosting provider.

Because our customers and users may be located in Canada, the United States, Europe, Australia, New Zealand, or other regions, personal information may be processed outside the country, province, state, or region where the user lives.

When information is processed in another jurisdiction, it may be subject to the laws of that jurisdiction, including lawful access requests by courts, law enforcement, or government authorities.

We retain personal information for as long as reasonably necessary to provide CampPulse 360, support Customers, comply with legal or accounting obligations, resolve disputes, enforce agreements, maintain security, and support legitimate business purposes.

Where we can state a retention period today, it is:

• Customer Data:for the life of the Customer’s subscription, plus a transition period after termination (typically thirty (30) days) described in Section 18.6 of our Terms of Service, after which it may be deleted or anonymized in accordance with our retention schedules and legal obligations;
• Financial and tax records: seven (7) years, as required by Canadian and U.S. accounting and tax rules; and
• Marketing and website enquiry records: twenty-four (24) months from last contact.

Other information is retained for as long as reasonably necessary for the purposes described above.

Customers are responsible for determining their own retention requirements for registration records, participant records, staff records, medical information, invoices, payments, consents, waivers, and communications.

When a Customer account is terminated, data export, deletion, anonymization, or retention may be handled according to the applicable agreement, legal requirements, and reasonable operational limits.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These safeguards may include:

• Role-based access controls;
• Authentication and account access controls;
• Encryption of customer data at rest using AES-256, including database backups and uploaded files, and in transit using TLS;
• Secure hosting infrastructure;
• Logging and monitoring;
• Backups and recovery practices;
• Limited employee access based on job responsibilities;
• Use of reputable service providers;
• Internal confidentiality expectations; and
• Ongoing review of security and operational practices.

No online service can guarantee perfect security. Customers and users must also protect their accounts, use strong passwords or secure authentication methods, limit access to authorized users, and promptly report suspected unauthorized access.

Customers control which administrators, staff members, and authorized users are granted access to their CampPulse 360 environment. Customers are responsible for assigning appropriate permissions, removing access when users leave, and reviewing user roles regularly.

PulseCore employees access Customer data only when needed to provide support, troubleshoot issues, maintain the service, investigate security concerns, or fulfill legal or contractual obligations.

CampPulse 360 may send transactional and operational emails such as invitations, confirmations, reminders, registration updates, support messages, and system notifications.

We use Postmark for email delivery. Customers are responsible for the content and recipients of communications they configure or send through the platform.

Our marketing website and application may use cookies or similar technologies for essential functionality, authentication, security, analytics, performance, and user experience.

Users can manage cookies through their browser settings, but disabling some cookies may affect login or platform functionality.

We may disclose personal information or Customer Data:

• To service providers that help us operate, secure, support, and improve CampPulse 360;
• To Customers and authorized users according to platform permissions;
• To process payments through Stripe;
• To send emails or notifications;
• To provide hosting, authentication, file storage, analytics, monitoring, logging, support, and security services;
• To comply with legal obligations, court orders, subpoenas, or lawful requests;
• To investigate security incidents, fraud, abuse, or misuse;
• In connection with a business transaction such as merger, acquisition, financing, or sale of assets; or
• With consent or as otherwise permitted by law.

We do not sell personal information. We do not share personal information or Customer Data with third parties for their own marketing purposes.

Usage, technical, diagnostic, and analytics information may be processed by trusted third-party service providers to help us operate, secure, troubleshoot, monitor, and improve CampPulse 360. These providers may process information only as needed to provide services to us.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information about you.

If your information was submitted to CampPulse 360 by an organization, please contact that organization first. They are usually best positioned to verify your identity and manage the record.

You may also contact us using the details at the end of this Policy. We may need to verify your identity and may direct your request to the appropriate Customer where they control the relevant data.

We will respond to privacy requests in accordance with applicable law.

PulseCore Inc. is a Canadian company. We aim to handle personal information in a manner consistent with Canadian privacy principles, including accountability, identifying purposes, consent, limiting collection, limiting use and retention, safeguards, openness, access, and correction.

For users in the European Economic Area, United Kingdom, or similar jurisdictions, CampPulse 360 usually acts as a processor for Customer-controlled registration and program data. The Customer is typically the controller. PulseCore may act as a controller for limited business information such as website inquiries, billing administration, and direct support communications.

Where personal information of individuals in the European Economic Area, United Kingdom, or Switzerland is transferred to Canada or the United States, we rely on appropriate safeguards recognized under applicable law, such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism, to protect that information. A copy of the relevant safeguards is available on request using the contact details at the end of this Policy.

Residents of California and other U.S. states with comprehensive privacy laws may have the right to: know what personal information we collect and how it is used; request access to or a copy of their personal information; request correction of inaccurate personal information; request deletion of their personal information, subject to legal exceptions; opt out of the sale or sharing of personal information (we do not sell or share personal information as defined under these laws); and not receive discriminatory treatment for exercising these rights. To exercise these rights, contact the Customer that manages your registration or contact us using the details at the end of this Policy. We may need to verify your identity before completing a request.

For Customers that are educational agencies or institutions subject to the U.S. Family Educational Rights and Privacy Act (FERPA), including schools and districts that run after-school, extended care, tutoring, or enrichment programs, PulseCore processes education records as a “school official” with a legitimate educational interest, under the direct control of the Customer with respect to the use and maintenance of those records, as permitted by 34 C.F.R. § 99.31(a)(1)(i)(B). We use education records only for the purposes authorized by the Customer, do not disclose them to third parties except as directed by the Customer or permitted by FERPA, and support the Customer’s obligations to allow parents and eligible students to inspect and correct records. The Customer remains responsible for its own FERPA notices and for determining that its use of CampPulse 360 meets its FERPA requirements.

For users in Australia and New Zealand, we aim to be transparent about the personal information we process, the purposes for processing, cross-border processing, access and correction rights, and retention practices.

We maintain internal procedures for assessing, documenting, and responding to security incidents. Where a breach of security safeguards creates a real risk of significant harm, we will, without undue delay, notify affected Customers, individuals, regulators, and/or other organizations as required by applicable law or contract. We also maintain breach records where required by law.

Customers are responsible for notifying their own users, families, staff, regulators, or other parties where required by law and where the Customer controls the affected information.

Some CampPulse 360 features may use artificial intelligence or other automated tools to help generate program setup, communications, reports, summaries, support responses, or improved notes. AI-generated outputs should be reviewed by authorized users before they are used, sent, or relied upon for operational, medical, safety, financial, or compliance decisions.

We do not use children’s personal information, medical information, or Customer registration data to train third-party AI models unless expressly agreed in writing. Where AI service providers process Customer Data on our behalf, they do so as service providers or subprocessors under appropriate contractual safeguards, and they are not permitted to use that data for their own purposes.

Customers and authorized users are responsible for the content they submit to AI-assisted features, including brochures, documents, prompts, attachments, and other inputs. PulseCore is not responsible or liable for personal information uploaded to AI-assisted features by Customers, organizations, or users who have access to that information without appropriate consent or authorization.

Customers and users are responsible for keeping information accurate and up to date, including contact information, participant and registrant details, medical information, emergency contacts, authorized pickup persons, registration selections, tax settings, and payment records.

If you believe information in CampPulse 360 is inaccurate, please contact the organization that manages your registration or account.

CampPulse 360 or our website may contain links to third-party websites or services. We are not responsible for the privacy or security practices of third-party websites or services that we do not control.

We may update this Privacy & Security Policy from time to time. When we make material changes, we will update the “Last updated” date and may provide additional notice where appropriate.

Continued use of CampPulse 360 after an updated policy becomes effective means the updated policy applies to your use of the platform.