Last updated: October 1, 2026
Privacy Policy
This Privacy Policy explains how Rulewize LLC (“Rulewize,” “we,” “us”) collects, uses, discloses and protects personal information when you visit rulewize.com or use the Rulewize service (the “Service”). It also serves as our notice at collection for California residents. It applies to visitors and to account holders. Rulewize is offered to businesses in the United States.
1. Who is responsible
For the personal information of visitors and account holders, Rulewize is the business or controller. For personal information that our customers put into the Service about their own employees and applicants (for example names in a handbook or document), we act as the customer’s service provider or processor and handle it under the customer’s instructions and our Data Processing Addendum. If you are an employee of a Rulewize customer, contact your employer about that information.
2. What we collect, why, and who receives it
| Category | Examples | Purpose | Recipients |
|---|---|---|---|
| Identifiers and account data | Name, email address, optional phone number and avatar, password (stored hashed), Google account identifier if you sign in with Google | Create and secure your account, sign you in, contact you about the Service | Supabase (database, authentication), Vercel (hosting), Google (sign-in with Google), Resend (email delivery) |
| Business and organization data | Company name, states, industry, employee counts, branding, team members and their roles | Draft and tailor your documents, provide team features | Supabase, Vercel, Anthropic (as part of AI prompts) |
| Content you provide | Handbook and policy text, SOP interview answers, employment documents, edits and translations. This can include personal information about your employees or applicants if you type it in | Generate, store, edit and export your documents | Supabase, Vercel, Anthropic (AI generation and translation) |
| Commercial and billing data | Plan, subscription status and dates, Stripe customer identifier, invoices. Card details are collected and held by Stripe, not by us | Provide paid plans, process payments, keep tax and accounting records | Stripe, Supabase |
| Internet and device data | IP address, browser and device type, pages viewed, referring page, timestamps, error logs, UTM campaign parameters (kept in your browser’s session storage) | Operate, secure and troubleshoot the Service, measure marketing | Vercel, Supabase; Google, Microsoft and Meta only if you allow the matching cookies (see Section 3) |
| Communications | Support and sales messages, survey answers, email delivery and open events, your email preferences | Respond to you, send service and (where allowed) marketing email, honor opt-outs | Resend, Supabase |
| Consent and legal records | The version of the Terms you accepted, the time and IP address of acceptance, your stored cookie and advertising choice | Prove consent, honor your choices | Supabase |
Sensitive personal information. The only sensitive information we intentionally collect is your account log-in credentials. We do not ask for government identifiers, health data or precise location. Please do not enter such information about employees into the Service unless it is needed for a document you are drafting, and never enter more than you must. We use any sensitive information only to provide the Service and do not use it to infer characteristics about you.
3. Cookies, analytics and advertising
Necessary cookies keep you signed in and remember your cookie choice. We load nothing else until you choose in the cookie banner, and advertising tools stay off unless you turn them on. Details are in our Cookie Policy. In summary:
- Google Analytics 4 (Google): page views and events, only with your analytics consent.
- Microsoft Clarity (Microsoft): session recordings and heatmaps, only with your analytics consent, and never on sign-in, sign-up, contact or password pages or on pages inside the signed-in product.
- Google Ads (Google): measures ad conversions, only with your advertising consent.
- Meta Pixel and Meta Conversions API (Meta): measure ad conversions, only with your advertising consent. When you sign up, if you consented, our server may send Meta a sign-up or purchase event that includes a SHA-256 hash of your email address, your IP address, browser user agent and Meta browser identifiers. We never send your raw email address.
We do not load Clarity or advertising pixels inside the signed-in product, and we do not load any tracker on email preference pages.
4. Selling and sharing; Global Privacy Control
We do not sell personal information for money. Allowing the advertising cookies above lets Google and Meta receive identifiers and browsing activity for cross-context behavioral advertising and conversion measurement, which California law treats as “sharing” (and Meta and Google may treat as a sale under some state laws). Advertising is therefore off by default.
You can opt out at any time with the footer link or by choosing “Reject non-essential” in the cookie banner. We honor the Global Privacy Control browser signal as a request to opt out of sale and sharing, for that browser and, when you are signed in, for your account. We do not knowingly sell or share the personal information of anyone under 16.
5. How we use information
To provide, secure and support the Service; generate and export documents with AI; process payments; send service messages (receipts, invitations, password resets, account notices) and legal change alerts; send marketing and onboarding email where permitted, with an unsubscribe link in every message; measure and improve the Service and our marketing (with your consent where required); prevent fraud and abuse; and comply with law.
6. AI processing
When you generate or edit a document, translate it, or ask for a recommendation, the relevant inputs (your business profile, your answers and, for edits, the text you are working on) are sent to Anthropic’s API, and the output is returned and stored in your account. Anthropic acts as our service provider. Under its current API terms Anthropic does not use API inputs and outputs to train its models, and it may retain them for a limited period (currently up to about 30 days) for safety and abuse monitoring. We cannot control or guarantee a provider’s practices, which may change. AI output may be inaccurate; see our Disclaimer. We do not use AI to make decisions about you that have legal or similarly significant effects.
7. Email
We send two kinds of email. Service email (receipts, billing problems, invitations, password resets, account notices and critical legal-change alerts about your handbook) is sent whether or not you opt out of marketing. Marketing and onboarding email (welcome series, product updates, offers) includes an unsubscribe link and a link to an email preferences page that work without signing in, and mail clients that support one-click unsubscribe can use it. We honor opt-outs promptly and no later than 10 business days. If you unsubscribe we keep your email address on a suppression list so we do not email you again.
8. Who else receives information
Our service providers: Supabase (database, authentication and storage), Vercel (hosting and infrastructure), Anthropic (AI), Stripe (payments), Resend (email delivery), Google (sign-in, analytics and advertising, if allowed), Microsoft (Clarity, if allowed) and Meta (advertising, if allowed). We may also disclose information to professional advisers, to comply with law or legal process, to protect rights, safety and security, and in a merger, financing or sale of the business, in which case this policy continues to apply to the information unless you are told otherwise. Within a customer organization, owners and administrators can see the organization’s data and members.
9. Retention
| Data | How long |
|---|---|
| Account, organization and content data | While the account is active. When an organization is deleted, access ends immediately for every member and its data is kept for 30 days in case the deletion was a mistake, then permanently deleted. An organization whose only member deletes their own account is deleted immediately and permanently. Cancelling a subscription alone does not delete data |
| Billing and tax records | As long as tax, accounting and dispute-resolution law requires |
| Email suppression and consent records | Kept so we can honor your choices and show what you agreed to |
| Security and application logs | Kept by our hosting providers for limited periods, generally weeks to months |
| Content sent to Anthropic | Retained by Anthropic for a limited period under its terms (currently up to about 30 days) |
| Backups | Overwritten in the ordinary backup cycle after deletion |
10. Your choices and rights
Export. An organization owner can download the organization’s data as a JSON file from Settings, then Account & Data (button: “Download my data”). Individual documents can also be exported as PDF or Word files where your plan includes exports. Deletion. An organization owner can delete the organization from the same page (“Delete organization”, confirmed by typing the organization’s name). The subscription is canceled immediately, every member loses access immediately, and the organization’s data is permanently deleted 30 days later; to restore it before then, contact us. Any signed-in user can delete their own login there (“Delete my account”). Members of a deleted organization keep their own login until they delete it. You can also email us at privacy@rulewize.com to request deletion of your personal information.
California residents (CCPA/CPRA) and residents of other states with privacy laws may have the right to: know what personal information we collect, use and disclose and to receive a copy; delete it; correct inaccurate information; opt out of sale and sharing (see Section 4); limit use of sensitive personal information (we use it only to provide the Service); and not be discriminated against for using these rights. In the past 12 months we have not sold personal information for money, and the only “sharing” is the consented advertising described above.
To make a request, email privacy@rulewize.com or write to Rulewize LLC, 315 San Pedro Blvd NE, Suite A, Albuquerque, NM 87108. We will verify your request by matching it to your account. We respond within 45 days and may extend once by up to 45 more days, and we will tell you if we do. An authorized agent may submit a request with your written permission. If we deny a request you may appeal by replying to our decision with the word “Appeal,” and we will answer within 60 days. You may also contact your state attorney general.
11. Security
We use reasonable safeguards: encryption in transit, encryption at rest through our hosting providers, row-level access controls that separate each organization’s data, restricted service credentials and role-based access in the product. No system is completely secure, and we cannot guarantee absolute security. Tell us promptly at privacy@rulewize.com if you suspect a problem with your account.
12. Children
The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.
13. Where data is processed
We and our providers process information in the United States. The Service is not intended for use outside the United States. If you access it from elsewhere, you understand your information will be transferred to and processed in the United States.
14. Changes
We will post changes here with a new “Last updated” date and, for material changes, notify account holders by email or in the Service.
15. Contact
Rulewize LLC, 315 San Pedro Blvd NE, Suite A, Albuquerque, NM 87108. Email privacy@rulewize.com.