Privacy Policy

The data controller is [Legal entity name], [Registered address], VAT [VAT number] (“RULED”, “we”). For any question about this policy or your data, write to [privacy@ruled.app].

[For the lawyer: confirm whether a Data Protection Officer is required and, if so, add their contact details here.]

Depending on how you use RULED, we may process the following categories of personal data.

• Account and contact data. Your email address, authentication data, and — if you subscribe — the billing details and subscription identifiers needed to process payment. Payments are handled by our payment provider; we do not store card numbers.
• Trading data, read-only. Through the connection you authorise with your broker we read your executed trades and positions: instrument, direction, size, entry and exit price, stop loss, open and close times, and realised profit or loss. We use this only to compare your activity against the rules you set.
• Your rulebook and its history. The limits you define, the moments a rule was respected or broken, any justification you wrote, any override you used, and the resulting Discipline Score.
• Technical and device data. Device type and identifier, operating system version, app version, push notification tokens, crash reports and basic usage events, used to deliver and maintain the service.
• Security and anti-abuse data. IP address, login and session timestamps, failed login attempts, and security or abuse-prevention logs.
• Records of your choices. Consents given or withdrawn, and the settings you selected, so we can demonstrate what you agreed to and when.
• Support correspondence. Messages you send us and our replies.

This section matters more than the previous one, and it is a design constraint rather than a promise of good behaviour.

• Your broker password. Connections use broker-issued API credentials or OAuth. We never see, request or store the password you use to log into your broker.
• Permission to trade. RULED only supports broker connections that allow access without granting RULED authority to place, modify or cancel orders. A broker that cannot offer a connection on those terms is not supported at all, on any plan.
• Permission to move money. We never request withdrawal or transfer rights.
• Which apps you block. When you choose the apps RULED may lock, your operating system gives us opaque tokens rather than app identities. We cannot tell which apps you selected, and those tokens never leave your device.

• To provide the service — monitoring your rules, calculating your Discipline Score, sending alerts, applying the locks you configured. Legal basis: performance of the contract between you and us.
• To bill you for a paid plan. Legal basis: performance of the contract and compliance with accounting obligations.
• To keep the service secure — detecting and preventing unauthorised access, fraud and abuse, and keeping security logs. Legal basis: our legitimate interest in a safe service, and in some cases a legal obligation.
• To keep the service working — diagnostics, crash analysis, capacity planning. Legal basis: our legitimate interest in a functioning product.
• To email you about the launch or product news, if you joined the waiting list or opted in. Legal basis: your consent, which you can withdraw at any time through the unsubscribe link in every email.

Where we rely on legitimate interest, you have the right to object to that processing at any time on grounds relating to your particular situation. Write to [privacy@ruled.app] and we will stop unless we can show compelling legitimate grounds that override your interests.

Account data is required to create and maintain your account. Trading data is required to provide the broker-monitoring features. Your rulebook is required for RULED to have anything to check against. Marketing consent is entirely optional.

Providing this data is a contractual necessity rather than a legal obligation: you are free not to provide it, but the corresponding RULED features cannot then be provided.

RULED works automatically. It compares the trading activity and account information available through your connected broker against the rules you set, records whether a rule was respected or broken, and calculates a Discipline Score from those records. Based on the settings you chose, that analysis can trigger a warning, a cooldown, or a temporary lock of the applications you selected.

To be explicit about what this analysis is not:

• it does not assess your creditworthiness or financial capacity
• it does not decide whether you may access any investment or financial product
• it does not decide what you should trade, or how
• it produces no effect outside the RULED app and the devices you configured

The Discipline Score measures adherence to your own rules and is deliberately independent of profit. You can review every violation that contributed to it, correct entries we got wrong, contest the result, and ask for human review by writing to [privacy@ruled.app].

Account and trading data are kept for as long as your account exists. If you delete your account we erase them within [30] days, except where we are legally required to keep certain records — invoices in particular, which tax law obliges us to retain for [10] years. Security logs are kept for [12] months.

Support correspondence is kept for [24] months from the last message. Records of the consents you gave or withdrew are kept for [5] years after the consent ends, because we may need to demonstrate them. Crash reports and diagnostic data are kept for [90] days.

Waiting-list emails are kept until launch, or until you unsubscribe.

We do not sell your data and we do not share it for advertising. We rely on a small number of service providers who act as data processors on our instructions:

• [Hosting and infrastructure provider]
• [Database provider]
• [Payment provider]
• [Transactional email provider]
• [Error monitoring provider]
• [Customer support provider, if any]

[For the lawyer: each of these needs a data processing agreement in place before launch, and the list has to be final and accurate — naming the provider, what data it sees, and where it processes it.]

Some of the providers above may process data outside the EEA. Where that happens, transfers are made under the European Commission's Standard Contractual Clauses or another lawful transfer mechanism. [Specify which providers, which countries, and which mechanism.]

Under the GDPR you have the right to access your data, to correct it, to erase it, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw that consent at any time without affecting what was done before.

Write to [privacy@ruled.app] to exercise any of these. We answer within one month. If you are not satisfied you can lodge a complaint with [Garante per la protezione dei dati personali].

Data is encrypted in transit and at rest, access to production data is limited to the people who need it to operate the service, and that access is logged.

We only support broker connections that can be established without granting RULED authority to trade or to move funds — so the access we hold is designed to read what already happened, not to act on your account.

How our website uses cookies and similar technologies is described in our Cookie & Tracking Policy.

RULED is not intended for anyone under 18. We do not knowingly collect data from minors.

If we change this policy we will update the date at the top and, for material changes, notify you by email or inside the app before the change takes effect.