Privacy Notice

Effective date: 29 September 2026

This notice explains what data we process when you use the Rulon business software, why we process it and how it is protected.

In short: we do not sell your data, we do not use it for advertising and we do not pass it to third parties for marketing. Your card details never reach us.

1. What we process

Account data: name, email address or username, phone number (if you enter one), interface language preference.
Business data: the records you enter yourself — customer and supplier details, invoices, payments, stock movements, orders, documents and photographs you upload.
Technical data: session cookie, IP address, browser and device information, error logs.
Usage records: an audit log kept for security (who performed which critical action and when) and module usage summaries.
Payment records: the amount, date and status of a payment. Card numbers, expiry dates and security codes never reach us; they are handled by the payment provider.

2. Why we process it

to provide the Service and store your organisation's records,
to keep accounts secure and detect abuse,
to answer support requests,
to run subscriptions and payments,
to meet legal obligations.

3. Where data is stored

The database and files are hosted on Supabase in the Frankfurt (Germany, European Union) region. Connections are encrypted (HTTPS).

4. Who we share it with

We do not sell data. To provide the Service we work with the following processors, and only to the extent needed:

Supabase — database, file storage and authentication (Frankfurt).
Paddle.com Market Limited — card payments; as merchant of record it processes the payment and issues the invoice.
Resend — delivery of system emails (invitations, password resets, payment notices).
OneSignal — push notifications to phones, only for users who turn them on.
Netlify — serving the web pages.

We may also disclose data where the law requires it, to the extent required.

5. How long we keep it

Business data is kept while your organisation is open.
When you ask for deletion the request is held for 14 days, so you can change your mind. After that the data is permanently deleted.
Payment and invoice records may be retained by the payment provider for the periods required by law.

6. Your rights

You have the right to access, correct, delete and export your data, and to object to processing. You can export much of your business data yourself from inside the application as Excel / CSV. For anything else write to support@rulon.io.

7. Cookies

We use only cookies that are necessary for the Service to work: the cookie that keeps you signed in and your language / display preferences. We use no advertising or tracking cookies and embed no third-party trackers.

8. Security

Each organisation's data is isolated at database level; users only see the modules and pages granted to them. Passwords are stored in a form that cannot be reversed. Critical actions are written to an audit log.

9. Children

The Service is intended for businesses and is not designed for use by people under 18.

10. Changes and contact

When we update this notice, the new text is published on this page. For any privacy matter: support@rulon.io