Privacy Policy

1. Who we are and what this covers

The data controller is Yurii, a private entrepreneur (PE), registered at Vinnytsia, 21027, Ukraine (“RuleRun”).

This policy covers personal data for which RuleRun is the controller: visitors to our website, people who contact us or subscribe to updates, and account holders of the product. It does not cover the email content our customers submit for compliance checks — for that content the customer is the controller and RuleRun acts as a processor under a separate Data Processing Agreement.

2. Information we collect

• Information you provide: via the contact form we collect your name, email, company (optional), the nature of your request, and your message; when you subscribe to updates we collect your email address.
• Account information: if you create a product account we collect your email address and authentication details, handled through our authentication provider.
• Billing information: when you purchase a paid plan, our payment provider and Merchant of Record (Paddle) collects your billing name, billing address, VAT or tax identifier where applicable, and payment-method details. We receive only limited billing metadata (such as your plan, subscription status, country, and the card type and last digits) and never your full card number.
• Support communications: when you contact us through our in-app live chat or by email, we process your messages together with your email address and limited account context (such as your plan and account identifier) so we can help you.
• Automatically collected: aggregated, non-identifying usage metrics from our cookieless analytics (see below), plus limited technical/security logs and error-monitoring events (which may include your IP address, request metadata, and account identifier) used to operate, debug, and protect the service.
• Customer content: the email HTML you submit to the product — which may itself contain personal data (for example, recipient names or addresses in the content) — is rendered and analysed to produce your compliance report. The rendered screenshots and reports may therefore also contain that personal data. This content is processed on your behalf as a processor under the DPA, not for the purposes described in this policy.

3. How we use your data and our legal bases

We process personal data on the following GDPR legal bases:

• To respond to your enquiries and provide the service you request — performance of a contract or steps prior to a contract.
• To take payment and manage your subscription — performance of our contract with you.
• To send product updates you have opted into — your consent, which you may withdraw at any time.
• To operate, secure, debug, and improve the service, and to prevent abuse — our legitimate interests.
• To comply with legal, tax, and accounting obligations — compliance with a legal obligation.

4. Analytics and cookies

• We use Vercel Web Analytics, which is cookieless and privacy-focused: no cookies, no cross-site tracking, and no personally identifiable information. It records aggregated metrics such as page views, referrers, approximate country, device/browser type, and campaign (UTM) parameters.
• We do not use advertising or cross-site tracking cookies on this site. We use only strictly necessary technology: a bot-protection challenge (Cloudflare Turnstile) on our forms, and — within the product — session cookies required to keep you signed in.
• Because our analytics are cookieless and we set no non-essential cookies, no cookie consent banner is required to browse this site.

5. How we share data (service providers)

We share personal data only with service providers that help us run the service, each bound by a data protection agreement. We do not sell your personal data and we do not use your email content to train AI models.

Paddle acts as our payment provider and Merchant of Record and, for payment and tax purposes, processes your billing data as an independent controller under its own privacy policy.

6. International data transfers

Some of our service providers process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards — primarily the European Commission’s Standard Contractual Clauses (2021) and, where applicable, the providers’ certifications — to ensure your data receives an equivalent level of protection.

7. Data retention

• Contact-form submissions, support conversations, and newsletter data are kept until you ask us to remove them or unsubscribe, and thereafter only as needed for our legal obligations.
• Account data is kept for the life of the account and a limited period afterwards.
• Billing and tax records are retained for as long as required by applicable tax and accounting law (typically several years), even after your account is closed.
• Submitted content (the email HTML you send), together with the rendered screenshots and compliance reports generated from it, is retained for up to the retention period associated with your plan (30 days to 12 months) so that reports remain reproducible and can be re-processed. You can request earlier deletion of your content at any time.

8. Your rights

Depending on your location you may have the right to access, correct, delete, or export your personal data; to restrict or object to processing; and to withdraw consent. Where our processing is subject to the GDPR you also have the right to lodge a complaint with your local supervisory authority.

If US state privacy laws such as the CCPA/CPRA apply to you, you have the right to know, delete, correct, and opt out of “sale” or “sharing” of personal information — note that we do not sell or share personal information as those terms are defined.

To exercise any of these rights, email us at support@rulerun.io.

9. Security

We protect data in transit with TLS and at rest with strong encryption, enforce tenant isolation with row-level security, and scope all API access to your account. More detail is on our Security page.

10. Children

The service is intended for business use and is not directed to children. We do not knowingly collect personal data from anyone under 16.

11. Changes to this policy

We may update this policy from time to time. Material changes will be signposted on this page, and the “last updated” date above will change. Continued use of the service after an update constitutes acceptance of the revised policy.

12. Contact us

For any privacy question or request, contact Yurii, a private entrepreneur (PE) at support@rulerun.io, or by post at Vinnytsia, 21027, Ukraine.