Privacy notice

Controller and contact

Venelouis, operating under the Rullst brand in BR, controls the application account and purchase records.

Brazilian tax registration

49.810.701/0001-85

Physical address

Fortaleza-CE

Electronic and support address

officialrullst@gmail.com

Do not email passwords, card numbers or identity documents unless a verified support process specifically requires them.

Data processed

The service stores the permanent account/certificate name, normalized email, Argon2id password hash, internal identifiers, purchase attempts, entitlement state, certificate state, refund-request state, transactional-mail delivery state and bounded security metadata. Password recovery additionally uses hashed short-lived reset codes, keyed request-limit identifiers and revocable session references; complete reset codes are not stored. Stripe hosts payment collection; Rullst does not receive or store complete card numbers or security codes.

Purposes and providers

Data is processed to create, authenticate and recover accounts, prevent abuse, complete the requested one-time purchase, reconcile signed Stripe events, deliver the purchased artifact, issue and verify a certificate, send one purchase confirmation with the requested account and community links, handle refunds and disputes, maintain security and meet legal obligations. The application runs in Microsoft Azure, application records are stored in Neon PostgreSQL, payments are processed by Stripe, and enabled password-recovery and purchase-confirmation messages are delivered by Resend using the account email without marketing or open/click tracking. These providers can process data internationally under their respective contractual safeguards.

Public certificate and aggregate-count boundary

The authenticated certificate can display the account name. Public verification uses a random identifier and discloses only certificate type, issue date, environment and current validity. It never publishes the holder's name, email, amount, payment method or provider identifiers. The offer page publishes only an aggregate count of distinct accounts with an active reconciled live entitlement and active Founding Customer certificate. Refunded, disputed, revoked and sandbox records are excluded; no buyer identifier is included in the count.

Retention and rights

Expired password-reset request and token records are removed after a 24-hour abuse-investigation window. Account and purchase evidence is retained only as necessary for delivery, fraud prevention, refunds, disputes, accounting and applicable legal obligations. An authenticated account can download its application data from the dashboard. You may request correction, restriction, objection, account closure or deletion through the contact above. Identity is verified before account data is disclosed or changed; legally required records can be restricted rather than immediately erased.

Security and minors

TLS, encrypted sessions, CSRF protection, password hashing, server-owned prices, hosted payment entry, signed webhook verification, replay controls and private artifact integrity checks protect the service. No internet service can promise absolute security. A purchase must be made by an adult or by a parent or legal guardian acting for a minor.

Legal grounds and regional rights

Where a legal basis is required, requested account and purchase services rely on performance of a contract or steps you request before a contract; proportionate fraud prevention and security rely on legitimate interests, subject to applicable balancing requirements; accounting and statutory records rely on legal obligations. Any future optional tracking or marketing that requires consent must remain off until you choose it. This site currently uses no advertising or analytics trackers.

Depending on your location and the applicable law, you may request confirmation of processing, access, correction, deletion, portability, restriction, objection, information about sharing, or review of a decision. This includes applicable rights under Brazil's LGPD, the EU GDPR, UK GDPR, and California's CCPA/CPRA. Where applicable, Canada's PIPEDA, Australia's Privacy Act, and Singapore's PDPA also provide access and correction rights, subject to their local requirements and exceptions. Other regional laws may provide additional rights. You may withdraw consent for future processing that relies on consent, without affecting processing already lawfully performed.

Rullst does not sell personal information or share it for cross-context behavioral advertising through this showcase. Exercising a privacy right does not result in discriminatory treatment. Essential account, payment, security, and legally required processing are separate from optional consent.

Exercise your rights

Rullst's privacy contact is officialrullst@gmail.com. Use the email associated with your account and describe your request. Do not send passwords, full card numbers, reset codes, or unnecessary identity documents. We verify identity proportionately, assess applicable exceptions, and respond within the deadline required by the applicable law. A name that cannot be edited in the demo interface can still be the subject of a correction request.

Deletion may require restricted retention of purchase, tax, dispute, or security evidence. We will explain any applicable exception. A privacy request is separate from a refund request. You may complain to the ANPD or your local data protection authority; where applicable, you may also request a review or appeal.

Providers and international processing

The existing notice identifies the providers used for your environment. Their roles and safeguards depend on the service and the applicable agreement. See the Stripe privacy notice, Resend privacy policy, Neon privacy policy, and Microsoft privacy statement. Contact us for information about transfers, safeguards, or retention applicable to your records. Following external community links opens services with their own privacy practices.

These notices and controls provide a privacy baseline. Applicable obligations depend on the actual operation and audience; this site does not claim universal legal certification.