Privacy Policy

1. Introduction & Scope

This Privacy Policy describes how Novexic Labs ("Company", "we", "us") collects, uses, stores, and discloses information when you use the Rulisto platform (the "Service"). It applies to all users, including visitors, registered users, and paying subscribers.

By using the Service, you consent to the data practices described in this Policy. If you do not agree, please discontinue use of the Service immediately.

2. Information We Collect

We collect only the minimum information necessary to operate the Service:

2a. Account Information

• Email address (used for authentication and service communications)
• Password (stored hashed and salted via Supabase Auth; never stored in plain text)
• Business name (if provided)
• Plan/subscription tier

2b. Assessment & System Data

• ADMT system names and descriptions you register
• Questionnaire responses submitted in the Assessment Wizard (jurisdiction, revenue, data processing volumes, system categorization, human oversight details)
• Generated classification results and PDF dossiers
• Audit log entries recording when assessments were created or modified

2c. Technical & Usage Data

• IP address and browser/device information (collected by Supabase and Vercel for security and abuse prevention)
• Page navigation and feature usage (used solely for service improvement)
• Payment transaction identifiers (we do not store full card details; payment processing is handled by Dodo Payments)

2d. Sensitive Data — Important Notice

The questionnaire inputs may include operationally sensitive business information such as revenue figures, consumer record counts, and AI system descriptions. You should only enter information you are authorized to share. We do not require you to input any personally identifiable information about your end consumers in order to use the Service.

3. How We Use Your Information

No Data Selling Commitment: We do not sell your data.

We use your information exclusively to:

• Operate, maintain, and improve the Service
• Generate compliance classification results and PDF dossiers
• Authenticate users and secure accounts
• Process payments and manage subscriptions via Dodo Payments
• Send transactional emails (account confirmations, password resets, billing receipts)
• Comply with applicable legal obligations
• Investigate abuse, fraud, or security incidents

We do NOT:

• Sell, rent, or trade your personal information to any third party
• Use your assessment data to train any machine learning or AI model (ours or any third party's)
• Share your data with advertisers
• Use your questionnaire inputs for any purpose other than generating your assessment output

4. Data Storage & Security

All data is stored on Supabase (PostgreSQL infrastructure hosted on AWS) with Row-Level Security ("RLS") enforced so that each user can only access their own data. PDF dossiers are stored in a Supabase Storage bucket accessible only to the authenticated account owner.

We implement the following security measures:

• TLS encryption in transit for all data communications
• Encrypted storage at rest (AES-256 via Supabase/AWS)
• SHA-256 integrity hashing of every generated PDF dossier
• Content Security Policy (CSP) headers on all HTTP responses
• Session-based authentication with automatic expiry

Despite these measures, no method of transmission or storage over the internet is 100% secure. We cannot guarantee absolute security and disclaim liability for any unauthorized access that occurs despite reasonable security measures.

5. Data Sharing & Third-Party Processors

We share data only with the following sub-processors, each under appropriate data processing agreements:

We may also disclose your information if required by law, court order, subpoena, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of the Company or others.

6. Data Retention

We retain your account data and assessment records for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain certain records longer (e.g., financial records for tax purposes, retained for up to 7 years).

Generated PDF dossiers stored in Supabase Storage are retained for the duration of your active subscription. You may request deletion at any time by contacting us.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to Access — Request a copy of your personal data we hold
• Right to Correction — Request correction of inaccurate data
• Right to Deletion — Request deletion of your personal data ("right to be forgotten")
• Right to Portability — Request your data in a machine-readable format
• Right to Opt-Out — Opt out of any future non-essential communications

To exercise any of these rights, email us at support@rulisto.work. We will respond within 30 days.

8. Cookies & Tracking

We use only strictly necessary cookies for session management (Supabase auth tokens). We do not use advertising cookies, third-party tracking pixels, or behavioral analytics cookies. No consent banner is displayed because we do not set non-essential cookies.

9. Children's Privacy

The Service is intended for use by businesses and is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent in-app notice. Your continued use of the Service after the effective date of any revision constitutes your acceptance of the updated Policy.

11. Contact Us

For privacy-related inquiries, data subject access requests, or to report a concern: