How we handle your data

1. Controller

The controller within the meaning of Art. 5 lit. j revDSG and Art. 4(7) GDPR is:

RoolCraft SA
c/o Sven Gartz
1170 Aubonne, Canton de Vaud, Switzerland
Email: privacy@rulaxy.com

RoolCraft SA does not currently have a designated Data Protection Officer because the processing scale does not meet the thresholds in revDSG Art. 10 or GDPR Art. 37. The controller above answers privacy enquiries directly.

2. EU representative

Where processing falls within the territorial scope of GDPR Art. 3(2) but the controller is established outside the EU/EEA, GDPR Art. 27 requires a designated representative in the Union. While the wait-list phase is limited and EU residents are a minority of expected subscribers, we will appoint and publish an Art. 27 representative before any direct marketing or B2B outreach to EU-based airlines or vendors begins. Until then, EU data subjects can contact the controller directly at the address above.

3. What we collect, and why

3.1 Wait-list form (index.html)

When you submit the early-access form, we receive:

• email address — to reach you with launch updates;
• persona — which audience bucket you belong to (airline / vendor / other), so we can tailor what we send you;
• source — fixed string rulaxy.com, used to distinguish channels;
• user-agent (first 200 characters) — to spot bot submissions and to estimate device mix; not used for fingerprinting.

Purpose: manage the early-access wait-list; send infrequent product updates and invitations.
Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 6(6) revDSG by submitting the form).

3.2 MVP application (app.html)

If you create an account on the MVP application:

• account profile — email, password (stored hashed by PocketBase using Argon2id), display name, company;
• draft RFPs and saved searches — content you author inside the platform;
• API keys you mint — token metadata (label, prefix, last-used timestamp), never the secret itself in cleartext after mint.

Purpose: provide the marketplace, RFP-builder and playground functionality you signed up for.
Legal basis: performance of contract (Art. 6(1)(b) GDPR; Art. 31(1) revDSG).

3.3 Server logs

Our web server (Caddy) writes standard access logs that contain your IP address, request path, status code, user-agent and timestamp. These logs are kept for a maximum of 30 days for security incident-response and capacity-planning purposes, then rotated and deleted.

Legal basis: legitimate interest in operating a secure service (Art. 6(1)(f) GDPR; Art. 31(2) lit. b revDSG).

4. No tracking, no analytics, no third-party cookies

rulaxy.com runs no analytics package (no Google Analytics, no Plausible, no Matomo, no Segment, no Mixpanel), embeds no marketing pixels and loads no third-party JavaScript or fonts from a CDN. The site sets only a single localStorage entry for your light/dark theme preference — this is a technical preference store, not a tracking cookie.

If you create an MVP account, an authentication token (JWT) is stored in localStorage for your session. It is sent only to our own PocketBase backend at rulaxy.gartz.ch/api.

5. Recipients & data transfers

All wait-list submissions and MVP account data are stored on infrastructure operated by the controller in Switzerland (self-hosted PocketBase, backups in Switzerland). We do not transfer your data to processors outside Switzerland or the EU/EEA.

Where our wait-list form falls back to a third-party endpoint (Formspree, US) because the primary self-hosted endpoint is unreachable, that fallback is disabled by default and would only be enabled with an updated version of this notice that names the processor explicitly and documents the transfer safeguards (e.g. EU-US Data Privacy Framework or SCC).

6. Storage duration

• Wait-list entries — until the early-access programme is closed, or until you withdraw consent, whichever is earlier.
• MVP account & user-authored content — until you delete the account; you can do so from the in-app Account page.
• Server access logs — 30 days, then deletion.

7. Your rights

Under revDSG and GDPR you have the right to:

• obtain confirmation of, and access to, the personal data we hold about you;
• have inaccurate data rectified, and incomplete data completed;
• have your data erased where the conditions of GDPR Art. 17 / revDSG Art. 32(2) are met;
• restrict processing in the cases listed in GDPR Art. 18;
• receive your data in a portable, machine-readable format and transmit it to another controller (GDPR Art. 20);
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email privacy@rulaxy.com. We will respond within one month (GDPR Art. 12(3)) and identify you via the email address registered with your wait-list or account entry.

8. Right to complain to a supervisory authority

If you believe our handling of your personal data infringes revDSG or GDPR, you may lodge a complaint with a supervisory authority:

• Switzerland — Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern, edoeb.admin.ch;
• EU/EEA — the supervisory authority of your habitual residence, place of work, or place of alleged infringement (GDPR Art. 77). A list is maintained by the European Data Protection Board (EDPB) at edpb.europa.eu/about-edpb/about-edpb/members.

9. Security

The site is served over TLS 1.3, the PocketBase backend rate-limits login attempts, and tokens are short-lived JWTs validated against the server on every boot. The full security model is documented in the project repository.

10. Changes to this notice

We will update this notice if the way we process personal data changes materially — for example if we onboard a processor, enable a fallback endpoint outside Switzerland, or add a new data category. Material changes will be flagged in the last-revised date below.