Impulsion
Draft for review. This document is a compliance-complete draft engineered to satisfy our payment, banking, advertising, accounting, and messaging providers, plus CCPA/CPRA and GDPR. It is being finalized with legal counsel; if anything here conflicts with a signed agreement you have with us, the signed agreement controls.

Effective June 22, 2026 · Last updated July 17, 2026 · Version 2026-07-17

Privacy Policy

This Privacy Policy explains how Impulsion Systems, Inc., operating as Impulsion ("Impulsion", "we", "us", "our"), collects, uses, stores, shares, and deletes information when you use the Impulsion platform, websites, and related services (the "Service"). Impulsion is a multi-tenant software platform for equestrian (horse-riding) businesses ("Barns"); a Barn's instructors, staff, riders, and parents are "End Users". This policy applies to all of them, in every jurisdiction in which we operate.

Quick links: You can request access to or deletion of your data at any time — see https://api.impulsion.io/data-deletion or email privacy@impulsion.io. Our Terms of Service are at https://api.impulsion.io/terms.

1. Information We Collect

We collect the following categories of information:

We collect this information directly from you, from the Barn that invited you, and from the third-party services listed above when you (or your Barn) authorize a connection.

2. How We Use Information

We use information only for these purposes:

We do not use your financial data, accounting data, or Google user data for advertising or marketing, and we do not sell it. See Sections 3, 4, 6, and 8.

3. We Do Not Sell Your Data; Limits on Sharing

We do not sell or rent your personal information, End User Data, financial data, or messaging opt-in data to marketers, data brokers, lead generators, or any other third party. We share information only as needed to provide the Service, as described below.

Mobile information / SMS opt-in (Twilio messaging):

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties. No mobile data will be shared with third parties or affiliates for marketing or promotional purposes at any time.

We do share information with subcontractors and service providers who help us operate the Service (for example, our cloud host, our messaging platform, and customer-support tooling) under written agreements that restrict their use of the data to providing services to us. We never share mobile opt-in data, consent records, or your financial/accounting/Google data with third parties, affiliates, or lead generators for their own marketing or promotional purposes.

We may disclose information when required by law, to comply with legal process, to protect rights and safety, or in connection with a merger or acquisition (in which case we will continue to honor this policy or notify you and obtain consent as required).

4. Bank & Financial Data — Plaid

To let a Barn connect its financial accounts, we use Plaid Inc. ("Plaid"). When you connect an account, you enter your bank credentials directly with Plaid through Plaid Link; Impulsion never sees or stores your bank login credentials.

Notice and consent. By connecting an account, you authorize Impulsion to use Plaid to access your financial accounts, and you agree that Plaid will collect, use, and share your information in accordance with the Plaid End User Privacy Policy. We present this notice, and capture your consent, at the point of connection; Plaid Link also displays Plaid's own data-transparency messaging during the connection flow. Plaid's End User Privacy Policy governs Plaid's handling of your data and does not cover what Impulsion does with it — this Section 4 describes that.

What we access and why. Through Plaid we access financial data such as account/routing identifiers, account balances, and transaction history. We use this data only to provide accounting, reconciliation, billing, and reporting features that you or your Barn have enabled — for example, matching payments to invoices and surfacing financial reporting. We request only the data needed for these use cases.

De-identified data. Where we use financial data in aggregated or anonymized form (for example, to produce internal benchmarks or improve the Service), we do so only after removing information that identifies you, and we disclose that use here, clearly and conspicuously.

Security. We protect financial data with administrative, technical, and physical safeguards, including modern industry-standard encryption in transit and at rest and access controls that limit access to authorized personnel with a business need. See Section 10.

Retention, disconnection, and deletion. You can disconnect a financial account at any time from within the Service. When you disconnect, we stop accessing the account and remove the connection from Plaid, which triggers Plaid's deletion of your data held for that connection (subject to Plaid's lawful retention exceptions, such as legal holds, fraud prevention, anonymized data, and any other active connections you maintain). You may also submit a request directly to Plaid to access or delete the data Plaid holds about you using Plaid's Privacy Request Form, and you can view and manage your connections in the Plaid Portal. We will delete the financial data we hold on request, except where we are required or permitted by law to retain it. Because deletion at Plaid is subject to Plaid's exceptions and to any other connections you maintain, we cannot promise that every copy of your data is instantly removed everywhere.

Re-authorization. Connections to financial accounts may need to be re-authorized periodically — generally at least every 12 months — for your access to continue. We will prompt you when re-authorization is required.

Nothing in this policy is intended to contradict the Plaid End User Privacy Policy or to interfere with Plaid's own notice-and-consent processes.

5. Payments — Stripe

We use Stripe, Inc. ("Stripe") to process payments and to make payouts to Barns through Stripe Connect. Stripe — not Impulsion — is the payment processor and card acquirer.

When you provide personal data in connection with Impulsion, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.

You can read the Stripe Privacy Policy here. For Barns that onboard as Stripe Connected Accounts, we describe in our Terms of Service what Connected Account Data we access and how we use, display, and transfer it, and we link to both this Privacy Policy and the Stripe Privacy Policy in your user agreement.

6. Accounting — Intuit QuickBooks Online

When a Barn authorizes a connection to Intuit QuickBooks Online, we read and (where enabled) write accounting data within the scopes the Barn approves, which may include invoices, bills, payments, transactions, customers, vendors, chart of accounts, and attachments, and — if those scopes are enabled — payments and payroll data. We also collect related account and technical data (business name, user name, contact email, logs, IP addresses, device/browser metadata, error reports, and usage metrics).

We use QuickBooks data only to operate the features the Barn has enabled (such as syncing, reconciliation, reporting, and document access), to maintain, secure, and improve the Service, and to communicate about account status. We do not use QuickBooks financial data for advertising or marketing, and we do not sell it.

Once a customer's Intuit data is in our system, we do not allow it to be used by or shown to anyone other than that customer and that customer's Barn, except: (a) to Intuit for API connectivity; (b) to the service providers in Section 3 acting on our behalf under written agreement; (c) to comply with legal or governmental requests; or (d) with the customer's explicit consent.

Connecting QuickBooks transfers your financial and personal data to Impulsion, a third party that is not Intuit; our terms and this policy may differ materially from Intuit's, and you should review them. For Intuit's own processing, the Intuit Global Privacy Statement governs and takes priority to the extent of any conflict with this policy.

7. Advertising, Leads & Messaging — Meta (Facebook, Instagram & WhatsApp)

Where a Barn connects its Meta (Facebook/Instagram) advertising account, we receive information you authorize, including Lead-Ads form submissions (such as a prospective rider's name, email, and phone number) and ad-account and campaign metadata. We use this information only to deliver the lead-management and advertising features the Barn has enabled — for example, routing new leads into the Barn's pipeline and reporting on campaign performance. We do not use Meta data for any purpose you have not authorized, and we do not sell it.

Messenger, Instagram & WhatsApp messages. Where a Barn enables messaging, we receive — via Meta's Messenger Platform, Instagram Messaging API, and WhatsApp Business (Cloud) API — the messages people send to that Barn's Facebook Page, Instagram professional account, or WhatsApp business number, together with the sender's platform identifier (such as a page-scoped ID or WhatsApp number), display name, and message timestamps. We use this information solely so the Barn can read and answer its own conversations from within Impulsion; replies are sent as the Barn's Page or WhatsApp number, are approved by a human operator, and automated replies are restricted to Meta's permitted response windows. You can opt out inside any conversation at any time by replying STOP — we record the opt-out, confirm it, and block all further messages from Impulsion to you on that channel (reply START to opt back in). If you delete a message on the platform, we honor the deletion in our stored copy; connected-account removal and full deletion requests are honored per our Data Deletion page. We do not use message content for advertising, profiling, or model training, and we never sell it.

8. Google User Data (Gmail & Google Calendar)

Where a Barn connects Google for internal operations, we access Google user data only within the specific scopes the Barn authorizes:

Impulsion's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Consistent with those Limited Use requirements:

Our use of Google user data is limited to the practices disclosed in this published Privacy Policy. We retain Google user data only as long as needed for the enabled feature, and you can request access to and deletion of it at any time (Section 11 and https://api.impulsion.io/data-deletion). If we ever change how we use Google user data, we will notify affected users and obtain renewed consent to the updated policy before the new use begins.

9. Text Messaging (SMS) & Email

If you opt in to text messages, we (using Twilio and/or GoHighLevel) send you messages relating to the specific program you opted into — for example, lesson reminders, scheduling notices, billing notices, and (only where you separately consented) marketing about your Barn. Message frequency varies. Message and data rates may apply. You can opt out at any time by replying STOP, and get help by replying HELP or contacting privacy@impulsion.io. Your opt-in and consent are never shared with third parties, affiliates, or lead generators for marketing purposes (Section 3). Full messaging terms are in our Terms of Service.

10. Data Security

We maintain a written information-security program with administrative, technical, and physical safeguards designed to protect personal information, and we apply protections appropriate to the sensitivity of financial data under the GLBA Safeguards Rule and applicable privacy laws. These include:

No system is perfectly secure, but we work to protect your information and to meet our obligations under GLBA, CCPA/CPRA, and, where applicable, GDPR.

11. Your Privacy Rights, Including Deletion

You can request to access, correct, port, or delete your personal information, and you can withdraw consent or disconnect any connected service, at any time. To submit a request, do one of the following:

We honor deletion requests whether you delete your in-app account or remove/disconnect our app (including if you remove our app from Facebook or delete your Facebook account). We will delete the data we hold about you, except where we are required or permitted by law to retain it (for example, tax, accounting, anti-fraud, or legal-hold obligations) or where it has been de-identified. We honor these rights globally, in every jurisdiction, unless local law prevents us from doing so. We do not charge for these requests and will not discriminate against you for exercising them.

California (CCPA/CPRA). California residents have the rights to know, access, correct, delete, and opt out of the "sale" or "sharing" of personal information, and to limit use of sensitive personal information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. You may exercise these rights using the methods above; you may use an authorized agent, and we will verify your request before acting on it.

EEA/UK (GDPR/UK-GDPR). Where GDPR or UK-GDPR applies, you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. We process personal data under the lawful bases of contract performance, legitimate interests, legal obligation, and consent (which you may withdraw). For Barn-connected data, the Barn is generally the controller and Impulsion acts as a processor on its instructions; for our own account and security data we act as controller. Our privacy contact is privacy@impulsion.io.

12. Data Retention

We retain personal information only as long as needed to provide the Service, to comply with our legal, tax, and regulatory obligations, to resolve disputes, and to enforce our agreements. When data is no longer needed, we delete or de-identify it. Connected-service data (Plaid, Stripe, QuickBooks, Google, Meta) is retained according to the purpose for which it was collected and is deleted on disconnection or request, subject to the exceptions described in this policy and to the third party's own retention rules.

13. Children's Information

Impulsion is used by riding Barns that may serve minors. We collect information about minor riders only from the Barn or from a parent/guardian acting on the rider's behalf, and only to provide the Service. We do not direct the Service to children for independent sign-up, and we do not knowingly use children's information for advertising.

14. International Transfers

We operate from the United States, and information may be processed in the United States and other countries. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

15. Changes to This Policy

We may update this Privacy Policy. If we make a material change to how we use personal information — including any change to how we use Google user data — we will notify affected users and, where required, obtain renewed consent before the new use begins. The "Last updated" date and version at the top reflect the current version.

16. Contact Us

Impulsion Systems, Inc. (operating as Impulsion)
Privacy requests: privacy@impulsion.io
Support: privacy@impulsion.io
Legal: privacy@impulsion.io
15202 Carrs Mill Road, Woodbine, MD 21797, USA