Privacy notice
This notice explains what personal data RulesOf.EU processes, why, on what legal basis, and what rights you have. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Last updated: 11 August 2026.
1. Who is responsible
The controller is ADVAITA OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia, registry code 17568302. Contact: support@rulesof.eu. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.
2. The short version
If you only use the free generators, nothing you type reaches us. The tools run entirely in your browser. What you type is stored on your own device and is never transmitted to us. Like any website, we do receive the request metadata our host needs to serve the page — including your IP address — described under Server logs below. We hold data about you only if you buy a plan: an email address for the receipt, and the licence key that unlocks it.
3. Using the free generators
The generators are static pages containing JavaScript. When you fill in a form, your entries
are held in your browser's local storage under the keys cshell.product.v1,
cshell.seen.v1, cshell.visitor.v1 and cshell.docs.v1.
This lets a second tool offer to reuse details you already entered, and lets the free-document
counter work. That storage sits on your device, under your control, and can be cleared at any
time through your browser settings. We cannot read it.
We do not operate analytics, tracking pixels, advertising identifiers, or profiling of any kind on this site.
Server logs
Our hosting provider, Cloudflare, processes request metadata — including your IP address — in order to deliver the page and to protect the service against attack. This is necessary for the technical delivery of a website you requested and rests on our legitimate interest in operating a secure service (Article 6(1)(f) GDPR). Cloudflare does not publish a fixed retention period for this metadata; it is kept no longer than is needed to deliver and secure the service, under the criteria set out in Cloudflare's own privacy policy, and is then deleted.
No third-party requests
This site loads no fonts, scripts or other resources from third parties. Typefaces and the QR-code library are served from this domain, so visiting a page discloses your IP address to no one but us. One channel is not a page resource but is worth naming: if your browser cannot load a page, it may send a network-error report to Cloudflare's reporting endpoint (a.nel.cloudflare.com). It is configured to report failures only, so nothing is sent when a page loads normally.
4. If you create an account
Paid plans are not open yet — no accounts exist and none of the data in this section is held today; it describes what we will hold, and for how long, once plans open.
| What we hold | Why | Legal basis | How long |
|---|---|---|---|
| Your email address | To identify the licence and send you a receipt | Performance of a contract, Art. 6(1)(b) | Until you close the account; purged within 30 days |
| Your licence key, stored as an irreversible hash, with the last four characters kept in clear | To recognise the key without holding a usable copy of it, and to show you which one is enrolled | Performance of a contract, Art. 6(1)(b) | Until you detach the key or close the account; purged within 30 days |
| Your subscription status and payment provider reference | To apply the plan you paid for | Performance of a contract, Art. 6(1)(b) | Until you close the account; purged within 30 days |
We do not store your raw IP address or your raw email address in the abuse-prevention counter — both are hashed before storage, so the counter can count without identifying you. A daily clean-up deletes each counter once its counting window is more than 24 hours old.
5. Who else processes your data
- Cloudflare, Inc. — hosting this website, content delivery and database. It serves the pages you are reading; it holds no documents you generate, because we hold none. Acts as our processor under Article 28 GDPR.
- Lemon Squeezy, LLC — a separate controller, not our processor. They are the seller of record for your purchase: they take the payment, hold your card details — we never receive them — and issue your invoice. For that payment data they decide their own purposes and means, so they are a controller in their own right and their privacy notice governs it, not this one. Separately, when you sign in with a licence key we send that key to them to be checked, on every sign-in, and they return the email address held against your purchase; that address is what identifies your account here, and it tells them when you sign in.
- Sign-in email — not yet in use. No sign-in emails are sent today, so no email provider processes your data. When one is used, it will be named here before any email is sent.
Where to send a request about your data. Anything about the purchase — payment records, card data, invoices — goes to Lemon Squeezy, because we do not hold it and cannot act on it. Anything about your account here — the email address, the licence-key hash and the subscription reference described in section 4 above — comes to us at support@rulesof.eu. If you are not sure, write to us: we will answer the part that is ours and tell you plainly which part we have passed on, and to whom.
Some of these providers are established outside the EEA. Transfers are made on the basis of the European Commission's Standard Contractual Clauses together with the supplementary measures described in the respective provider's data-processing agreement.
You may request a copy of the safeguards applying to a transfer by writing to support@rulesof.eu; where a provider publishes its clauses, we will point you to them instead.
Do you have to provide this data?
Only if you want an account. There is no statutory obligation to give us anything, and the free generators require nothing at all. An email address is necessary to issue and renew a licence — without it no contract can be concluded and we cannot send you a receipt. Nothing else follows from it: we hold no documents.
6. Your rights
Under the GDPR you have the right to request access to your personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Write to support@rulesof.eu. We answer within one month.
You may lodge a complaint with a supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee. You may also complain to the authority where you live or work.
7. Cookies and similar technologies
We use no advertising, analytics or tracking cookies, and therefore ask for no cookie consent. Everything we store on your device is strictly necessary for a function you asked for, which is exempt from the consent requirement under Article 5(3) of Directive 2002/58/EC.
| Name | Type | Purpose | Duration |
|---|---|---|---|
cshell.product.v1 | Local storage | Remembers what you typed so another tool can reuse it | Until you clear it |
cshell.seen.v1 | Local storage | Records which tools you have completed, so we can offer to prefill | Until you clear it |
cshell.visitor.v1 | Local storage | Records the date of your first visit | Until you clear it |
cshell.docs.v1 | Local storage | Counts the free documents you have generated | Until you clear it |
None of the local-storage values are transmitted to us or to anyone else.
8. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you, within the meaning of Article 22 GDPR.
9. Changes
If we change this notice we will update the date above and, for material changes affecting account holders, tell you by email before the change takes effect.