Privacy policy
1. Who is responsible
Rulewise (rulewise.xyz and its subdomains) is operated by Quantum EX s.r.o., registered in the Czech Republic under number IČO 21920460, with its address at Cimburkova 916/8, 130 00 Praha 3 – Žižkov, Czech Republic ("we", "us"). We are the controller of the personal data described in this policy. Contact us about privacy at support@rulewise.xyz.
2. What we collect and why
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Messages you send and the answers | To generate the answer. Your message is sent to our AI provider. We do not store messages or answers on our servers. For follow-ups, your browser sends the recent messages of the current chat again. On paid plans the assistant may send short search queries based on your message to a web search provider. | Contract, Art. 6(1)(b), or legitimate interests for free use, Art. 6(1)(f) |
| Images and PDFs you attach (paid plans) | To answer your message about them. They are sent to our AI provider and, only while a long answer is being completed, kept on our servers for at most 30 minutes, then deleted. | Contract, Art. 6(1)(b) |
| Daily question count | To apply your plan's daily limit. Without an account we count by a one-way, salted code made from your IP address that changes every day, so it can't be turned back into your IP address. | Legitimate interests in preventing abuse and running a fair free tier, Art. 6(1)(f) |
| Account data: email address, name, country, an optional company name, a salted hash of your password, login times and sessions | To create your account, keep you logged in and show your membership and daily usage. | Contract, Art. 6(1)(b) |
| Card payments: order reference, plan, amount, currency and the payment session reference from our card provider | To take and confirm your payment. The card itself is entered on the provider's secure page; we never see your card number. | Contract, Art. 6(1)(b); legal obligation for accounting records, Art. 6(1)(c) |
| Plan, the date it ends, and the time you asked us to start it | To give you the plan you paid for and handle the right of withdrawal. | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Crypto payments: order reference, coin and network, amount, transaction ID and the wallet address it came from | To confirm your payment, keep accounting records and handle refunds. Blockchain transactions are public by nature: anyone can see them on the blockchain. | Contract, Art. 6(1)(b); legal obligation for accounting records, Art. 6(1)(c) |
| Technical logs (IP address, time, page or API requested, browser type) | To keep the service secure and working and to investigate errors or abuse. | Legitimate interests, Art. 6(1)(f) |
| Messages you send us | To answer you. | Legitimate interests, Art. 6(1)(f), or contract |
Please don't include names, health details or other personal data about yourself or others in your questions. Rulewise answers general questions about the rules and doesn't need them.
3. Who receives your data
We share data only with providers that help us run Rulewise, under contracts that require them to protect it and use it only on our instructions or as independent controllers where stated.
| Provider | What they do | Location |
|---|---|---|
| AI model provider | Writes the answers. Receives your question, recent messages of the chat and the legal texts found for it. Under the provider's commercial terms, this data is not used to train its models; the provider may keep it for a limited period under its own terms, for example for safety monitoring. You can ask us for the provider's name. | United States |
| Card payment provider (Teya) | Takes card payments on its own secure page and tells us whether a payment succeeded. | European Union |
| Public blockchain services (mempool.space, public Ethereum, BNB Smart Chain and Solana nodes) | To check that your payment arrived. They receive only the transaction ID and the time of the lookup from our server. | Various |
| Netlify, Inc. | Hosting of the website, databases and logs. | United States and European Union |
| Brevo (Sendinblue SAS) | Delivery of sign-in links and service emails. | France (European Union) |
When you request a custom bot, the details you send (name, email, company, phone, project description) are used to reply and prepare a quote, kept for up to 3 years or as long as a resulting contract requires. We may also disclose data where the law requires it, or to protect our rights, users or the public.
4. Transfers outside the EU
Some providers process data in the United States. Where they do, the transfer is covered by the EU-US Data Privacy Framework if the provider is certified under it, or by the European Commission's standard contractual clauses with additional safeguards. You can ask us for a copy of the relevant safeguards.
5. How long we keep it
| Data | Kept for |
|---|---|
| Questions and answers | Not stored by us. Your browser keeps the current chat until you start a new chat or close the page. |
| Daily question counts | 35 days |
| Password-reset links | Until used, or 1 hour |
| Login sessions | 30 days, or until you log out |
| Account data | Until you delete your account |
| Orders, payment and accounting records | As long as tax and accounting law requires, usually up to 10 years |
| Technical logs | Up to 30 days, longer only when needed to investigate a specific security incident |
6. Cookies and local storage
We use one cookie, rw_sess, only when you log in. It keeps you logged in for up to 30 days. We also keep the field and currency you last chose, your language and an unfinished checkout in your browser's local storage. These are strictly necessary for the service you ask for, so we don't ask for cookie consent. We use no analytics, advertising or social media cookies.
7. Your rights
Under the GDPR you have the right to access your data, correct it, have it deleted, restrict or object to its use, receive it in a portable format, and withdraw any consent you gave. You can delete your account yourself from Account, after cancelling any subscription, or write to support@rulewise.xyz. We reply within one month.
You can also complain to a data protection authority, in particular in the EU country where you live or work. Our lead authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.gov.cz).
8. Automated answers
Answers are written by an AI system. Rulewise makes no decisions about you that have legal or similarly significant effects.
9. Children
Rulewise is not meant for children under 16, and paid plans are for people aged 18 or over. If you believe a child has given us personal data, contact us and we will delete it.
10. Security
We use encrypted connections, store passwords only as salted one-way hashes (PBKDF2) and sessions as one-way hashes, never ask for wallet keys or card numbers, and limit access to data to people who need it to run the service.
11. Changes
If we change this policy, we will update the date at the top. If a change materially affects how we use your data, we will tell account holders by email before it applies.
12. Contact
Quantum EX s.r.o., Cimburkova 916/8, 130 00 Praha 3 – Žižkov, Czech Republic. Email: support@rulewise.xyz.