Privacy Policy

This Privacy Policy explains how RULEPULSE LTD, a private company limited by shares registered in England and Wales under company number 17470104, whose registered office is at 128 City Road, London, EC1V 2NX, United Kingdom (“RulePulse”, “we”, “us”, or “our”), collects, uses, and protects personal data when you visit our website or use the RulePulse application (together, the “Service”). RulePulse is the data controller for the personal data described in this Policy.

This Policy is effective as of September 22, 2026.

We collect the following categories of personal data:

• Account data — the email address and password you provide when you sign up, and any optional profile details you choose to add later, such as your full name, phone number, or country.
• Team data — your role within your team, and, if you invite a colleague, the email address you provide for that invitation.
• Content you and your team create — the URLs you configure for monitoring, labels, task assignments, and comments left on alerts.
• Usage data — aggregate, privacy-focused analytics about how the Service is used (see Section 3).
• Cookies and local storage — see Section 3 below.

We use a small number of cookies and browser storage items, strictly necessary ones plus optional analytics you can accept or reject:

• refresh_token — strictly necessary. An httpOnly, secure cookie that keeps you signed in; lasts up to 30 days.
• rp_session — strictly necessary. A non-sensitive cookie that lets the app quickly check whether you are probably signed in; lasts up to 30 days.
• rp_cookie_consent — strictly necessary. Stored in your browser’s local storage to remember your cookie choice (accepted or rejected).
• _ga and _gid — optional analytics. Set by Google Analytics only if you accept analytics cookies in our cookie banner; used to help us understand aggregate product usage.

For usage analytics, we use Vercel Web Analytics, which is cookieless by design and does not track you across other websites, and Google Analytics, which uses the cookies listed above. Google Analytics only runs after you accept analytics cookies in the banner shown on your first visit; you can change your choice at any time via “Cookie preferences” in the footer of any page.

Most browsers let you block or delete cookies through their settings; doing so may affect how the Service works, including staying signed in.

We use personal data to:

• provide, operate, and maintain the Service, including authenticating you;
• enable team collaboration, such as invitations, task assignment, and comments;
• send transactional emails, such as team invitations, via Gmail;
• understand aggregate usage of the Service so we can improve it;
• keep the Service secure and prevent abuse; and
• comply with our legal obligations.

Where UK GDPR applies, we rely on the following legal bases: performance of a contract (to provide the Service you signed up for), our legitimate interests (such as keeping the Service secure and understanding aggregate usage, balanced against your rights), and compliance with a legal obligation. Where required, such as for optional analytics cookies, we will ask for your consent.

We do not sell personal data, and we do not share it with advertisers or data brokers. We share personal data only with:

• Vercel Inc., which hosts our website and application and provides our (cookieless) web analytics;
• Google, whose Gmail API we use to deliver transactional email on our behalf, and whose Google Analytics we use, subject to your cookie consent, as described in Section 3; and
• other members of your own team, who can see the data and content you and they add to your team’s account; and
• our infrastructure hosting provider, which provides the virtual server our backend and database run on, but has no access to the application or its data.

Our backend and database are hosted on a server located in Frankfurt, Germany, within the European Economic Area. Vercel, our frontend hosting provider, is a US company, but the functions that power our application are pinned to run in Frankfurt, so this processing also takes place within the EEA. Google, which we use for transactional email and, subject to your cookie consent, for analytics as described in Section 6, is based in the United States and may process personal data there. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards, such as Standard Contractual Clauses or the UK International Data Transfer Addendum, to protect it.

We retain personal data for as long as your account is active, and for a limited period afterward as needed for legitimate business purposes, such as backups, dispute resolution, and compliance with legal obligations. After that period, we delete or anonymize it.

We take reasonable technical and organizational measures to protect personal data, including hashing passwords, using short-lived authentication tokens, encrypting data in transit, and limiting access to production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to applicable law, you have the right to access, correct, or delete your personal data, to restrict or object to our processing of it, and to receive a copy of it in a portable format. To exercise any of these rights, contact us at support@rulepulse.com.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

The Service is not directed at, and we do not knowingly collect personal data from, anyone under 18 years old.

The Service monitors and links to third-party websites, including those of the FCA, PRA, EBA, and any custom URLs you configure. Those websites have their own privacy practices, which are outside our control and not covered by this Policy.

We may update this Policy from time to time. If we make material changes, we will provide reasonable notice, such as by email or an in-product notice, before the changes take effect.

If you have any questions about this Policy or how we handle personal data, please contact us at support@rulepulse.com, or by post at RULEPULSE LTD, 128 City Road, London, EC1V 2NX, United Kingdom (Company No. 17470104).