1. Scope
This Policy applies to information Rulint collects through its public website, public testing-intake process, authenticated online services, and related business interactions.
When Rulint processes information on behalf of a client as part of an independent compliance testing engagement, the applicable client agreement, engagement terms, data-handling requirements, and client instructions may also govern that processing.
2. Information We Collect
Information You Provide
Depending on how you interact with Rulint, we may collect:
- name, business email address, and business contact information;
- company name and company website;
- product, business-model, and jurisdiction information;
- compliance areas, testing objectives, timing, and scoping notes;
- communications and information you provide during an engagement;
- authenticated account and portal information;
- client-provided population information, evidence, documentation, responses, findings support, approvals, and related testing records where required for an engagement.
Website and Attribution Information
Rulint uses first-party website analytics designed to understand site usage and the effectiveness of business outreach. Depending on the visit, the analytics system may record:
- the Rulint page viewed;
- article or page identifiers;
- selected calls to action;
- the referring website's host name;
- internal source pages;
- UTM source, medium, and campaign values; and
- the date and time of the event.
Rulint's first-party analytics database is not designed to store IP addresses, full external referrer URLs, or cross-site advertising identifiers.
Publicly Available Information
Rulint may use publicly available business, regulatory, governmental, or professional information for legitimate activities such as company scoping, regulatory research, testing design, and regulatory intelligence.
3. Cookies and Similar Technologies
Rulint uses a first-party session cookie to support functions such as security, authentication, CSRF protection, temporary referral and campaign attribution, and authenticated workflow state.
Rulint does not currently use third-party advertising pixels or cross-site behavioral advertising trackers on the public website.
Rulint's first-party public analytics do not record a visit when the browser sends a recognized Do Not Track signal or Global Privacy Control signal.
4. How We Use Information
Rulint may use information to:
- respond to testing inquiries and evaluate potential engagements;
- provide and administer independent compliance testing services;
- establish testing scope, methodology, populations, and evidence requirements;
- authenticate users and secure administrative and client workflows;
- operate, maintain, protect, troubleshoot, and improve Rulint services;
- measure website usage and business outreach effectiveness;
- maintain testing, audit, review, approval, and reporting records;
- perform regulatory research and develop regulatory intelligence;
- support selected AI-assisted analysis and workflow functions;
- prevent misuse, fraud, unauthorized access, and security incidents;
- comply with legal obligations and enforce applicable agreements; and
- protect Rulint, its clients, users, and third parties.
5. AI-Assisted Processing
Rulint uses artificial-intelligence services in selected internal and testing-support workflows. Depending on the function invoked, limited information may be transmitted to an AI service provider for processing.
Examples can include a company name and public website for an administrator-reviewed company-profile draft, or structured testing information such as a population definition and required field names for an administrator-reviewed analysis.
Rulint does not rely on AI output as a substitute for required human testing judgment, evidence evaluation, exception disposition, QA, or final testing conclusions.
6. How We Disclose Information
Rulint may disclose information to service providers and other parties when reasonably necessary for the purposes described in this Policy, including:
- cloud hosting and infrastructure providers;
- Amazon Web Services for configured cloud storage, encryption, backup, and related infrastructure services;
- OpenAI for selected AI-assisted workflows initiated within the Rulint environment;
- security, technical, and professional service providers;
- legal, regulatory, governmental, or law-enforcement authorities when disclosure is required or permitted by law; and
- parties involved in a corporate transaction, subject to appropriate confidentiality and legal requirements.
Rulint does not sell personal information and does not disclose personal information for cross-context behavioral advertising.
7. Client Evidence and Testing Information
Detailed client data and evidence should be provided only through an approved engagement workflow after scope, data requirements, and the permitted exchange method have been established.
Rulint uses controlled application and cloud-storage workflows for testing information. Configured S3 evidence workflows use KMS-backed server-side encryption and controlled access mechanisms. Access controls and data-handling requirements may vary by engagement.
8. Security
Rulint uses administrative, technical, and operational safeguards intended to protect information against unauthorized access, use, alteration, or disclosure. Current controls include authenticated administrative and client workflows, multi-factor authentication, controlled sessions, CSRF protections, access separation, audit logging, encrypted evidence-storage capabilities, controlled evidence downloads, and backup processes.
No information system or transmission method can be guaranteed to be completely secure. Security requirements for production client data should therefore be established as part of engagement and vendor diligence before such data is provided.
9. Retention
Rulint's first-party public analytics events are configured for automatic deletion after approximately 400 days.
Other information is retained for as long as reasonably necessary for the purposes for which it was collected, to provide or document services, maintain required testing and business records, satisfy contractual or legal obligations, resolve disputes, enforce agreements, maintain security and audit history, and support business continuity and recovery.
Information may remain for an additional period in backups, immutable or historical records, or security and audit records where deletion is not immediately practical or where continued retention is reasonably necessary.
10. Privacy Choices and Requests
Depending on your location and applicable law, you may have rights concerning personal information about you, including rights to request access, correction, deletion, or information about how the information is used or disclosed.
Rulint does not sell personal information. If you nevertheless wish to submit an applicable opt-out, access, correction, or deletion request, you may contact Rulint through the site's Discuss a Testing Need form and begin the description with "Privacy Request."
Rulint may need to verify your identity and authority before acting on a request. Certain information may be retained where required or permitted by applicable law or where necessary for security, contractual, audit, dispute-resolution, or recordkeeping purposes.
11. Third-Party Sites
Rulint pages may link to regulators, governmental sources, professional networks, publishers, or other third-party websites. Rulint does not control the privacy practices of those third parties. Their own privacy policies and terms apply to their services.
12. Children
Rulint's website and services are designed for business and professional use and are not directed to children.
13. Changes to This Policy
Rulint may update this Privacy Policy as its services, technologies, legal obligations, or data-handling practices change. Material changes will be reflected by posting an updated Policy on this page and changing the effective date above.
14. Contact
Questions or privacy requests may be submitted through rulint.com/intake. For a privacy request, begin the description with "Privacy Request." Do not include sensitive customer data, passwords, credentials, or privileged material in the request.