Privacy notice
This notice explains what personal data RulesOf.EU processes, why, on what legal basis, and what rights you have. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Last updated: REPLACE-DATE.
1. Who is responsible
The controller is REPLACE-COMPANY-NAME, REPLACE-STREET, REPLACE-POSTCODE REPLACE-CITY, Estonia, registry code REPLACE-REGISTRY-CODE. Contact: REPLACE-CONTACT-EMAIL. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.
2. The short version
If you only use the free generators, we receive no personal data from you at all. The tools run entirely in your browser. What you type is stored on your own device and is never transmitted to us. We hold data about you only if you create an account and choose to have documents hosted.
3. Using the free generators
The generators are static pages containing JavaScript. When you fill in a form, your entries
are held in your browser's local storage under the keys cshell.product.v1,
cshell.seen.v1, cshell.visitor.v1 and cshell.docs.v1.
This lets a second tool offer to reuse details you already entered, and lets the free-document
counter work. That storage sits on your device, under your control, and can be cleared at any
time through your browser settings. We cannot read it.
We do not operate analytics, tracking pixels, advertising identifiers, or profiling of any kind on this site.
Server logs
Our hosting provider, Cloudflare, processes request metadata — including your IP address — in order to deliver the page and to protect the service against attack. This is necessary for the technical delivery of a website you requested and rests on our legitimate interest in operating a secure service (Article 6(1)(f) GDPR).
Fonts and code loaded from third parties
Unless we have self-hosted them, pages load typefaces from Google Fonts (fonts.googleapis.com, fonts.gstatic.com) and, on the Digital Product Passport page, a QR-code library from Cloudflare's CDN (cdnjs.cloudflare.com). Making those requests discloses your IP address to those providers. If this concerns you, the entire site is designed to run without them — see the self-hosting note in our documentation.
4. If you create an account
| What we hold | Why | Legal basis | How long |
|---|---|---|---|
| Your email address | To identify your account and send you a sign-in link | Performance of a contract, Art. 6(1)(b) | Until you close the account |
| Sign-in tokens and session identifiers, stored as irreversible hashes | To keep you signed in without storing a password | Performance of a contract, Art. 6(1)(b) | Sign-in links 15 minutes; sessions 30 days; expired records deleted nightly |
| The documents you choose to host, and their edit history | To serve them at a permanent URL and let you revise them | Performance of a contract, Art. 6(1)(b) | Until you delete them; deleted documents are purged after 30 days |
| A counter keyed to a hashed form of your email address and IP address | To limit sign-in requests and prevent our service being used to send unwanted mail | Legitimate interest in preventing abuse, Art. 6(1)(f) | 24 hours |
| Your subscription status and payment provider reference | To apply the plan you paid for | Performance of a contract, Art. 6(1)(b) | Until you close the account |
We do not store your raw IP address or your raw email address in the abuse-prevention counter — both are hashed before storage, so the counter can count without identifying you.
Content of hosted documents
Documents you host are business records: product identifiers, manufacturer details, declarations. They may contain the name and job title of the person signing a declaration. We process that content solely to store, render and serve it back to you and to anyone you give a share link. We do not analyse it, mine it, or use it to train anything.
5. Who else processes your data
- Cloudflare, Inc. — hosting, content delivery and database. Acts as our processor under Article 28 GDPR.
- Lemon Squeezy, LLC — payment processing. Acts as merchant of record and handles card data directly; we never receive your card details.
- REPLACE-EMAIL-PROVIDER — delivery of sign-in emails. Acts as our processor.
Some of these providers are established outside the EEA. Transfers are made on the basis of the European Commission's Standard Contractual Clauses together with the supplementary measures described in the respective provider's data-processing agreement.
You may request a copy of the safeguards applying to a transfer by writing to REPLACE-CONTACT-EMAIL; where a provider publishes its clauses, we will point you to them instead.
Do you have to provide this data?
Only if you want an account. There is no statutory obligation to give us anything, and the free generators require nothing at all. An email address is necessary to create the account and to sign in — without it we cannot provide the hosted service, and no contract can be concluded. Everything else follows from what you choose to host.
6. Your rights
Under the GDPR you have the right to request access to your personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Write to REPLACE-CONTACT-EMAIL. We answer within one month. Your hosted documents can also be exported in full at any time from your account, without asking us.
You may lodge a complaint with a supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee. You may also complain to the authority where you live or work.
7. Cookies and similar technologies
We use no advertising, analytics or tracking cookies, and therefore ask for no cookie consent. Everything we store on your device is strictly necessary for a function you asked for, which is exempt from the consent requirement under Article 5(3) of Directive 2002/58/EC.
| Name | Type | Purpose | Duration |
|---|---|---|---|
ro_session | Cookie | Keeps you signed in. Set only after you sign in. HttpOnly, Secure, SameSite=Lax. | 30 days |
cshell.product.v1 | Local storage | Remembers what you typed so another tool can reuse it | Until you clear it |
cshell.seen.v1 | Local storage | Records which tools you have completed, so we can offer to prefill | Until you clear it |
cshell.visitor.v1 | Local storage | A random local identifier used only to count your own free documents | Until you clear it |
cshell.docs.v1 | Local storage | Counts the free documents you have generated | Until you clear it |
None of the local-storage values are transmitted to us or to anyone else.
8. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you, within the meaning of Article 22 GDPR.
9. Changes
If we change this notice we will update the date above and, for material changes affecting account holders, tell you by email before the change takes effect.