EMRules (emrules.com) is the service and the controller of the personal data described here. Contact: [email protected].
What we collect. Your name, email address and password (stored as a hash), or the profile a sign-in provider shares (Google: name, email and a link to your profile photo; Microsoft: name and email) and the sign-in tokens it issues. Your organization's name and members, and the email address of anyone invited to join it. Sign-in sessions, with IP address and browser. API keys and a log of API requests (the endpoint and the time) for limits and billing; a monthly count of them is shared with Polar to bill usage. Billing records held by Polar. Error reports that may include technical details of a failed request. Anonymous usage statistics: the pages viewed, the site that referred you, campaign tags, and your browser and device type.
Why. To provide the service and your account (contract), to bill you (contract and legal obligation), to secure the service and fix errors (legitimate interest), and to send account email such as verification and password reset (contract), and to learn how the site is used, through those anonymous statistics (legitimate interest). We also write to banks and regulators at their published office addresses about the sources we cover. We do not sell personal data, show advertising or use your data to train models.
Payments. Paid plans are sold by Polar as merchant of record. Polar processes your payments and holds your billing records under its own Privacy Policy. Your card details go directly to Polar and never reach our servers.
Who processes it for us. Supabase (database), Cloudflare (network delivery and security for every request, and R2 file storage), Contabo (servers), Polar (payments and billing records), Resend (email delivery), Sentry (error reports), PostHog (usage statistics, in the European Union), and Google or Microsoft if you choose them for sign-in. Some of these providers process data outside the European Economic Area, under the transfer safeguards in their data processing terms, such as standard contractual clauses.
Cookies and storage. Strictly necessary cookies keep you signed in and, for a few minutes, protect a sign-in through Google or Microsoft. Other cookies and your browser's local storage keep your own choices: light or dark mode, monthly or yearly pricing, display preferences, table layouts and searches, the dashboard period, the sidebar and a dismissed welcome prompt. They are not used to track you. Your light or dark mode and pricing choices are shared between emrules.com and app.emrules.com. We use no analytics or advertising cookies. Usage statistics are cookieless and anonymous: nothing is stored in your browser for them, no one is identified, and PostHog uses your IP address and browser only to count visitors per day, removing the IP before it stores anything.
How long. Account data is kept while the account is open. You can delete your account yourself under Account, Profile, Delete account: we email you a link, and the deletion takes effect once you open it and confirm. It removes the account, its data, the invitations it sent and every workspace it is the only member of, while a workspace shared with others stays with its other members. A paid plan still running must be cancelled first, and a shared workspace you alone own handed to another owner. If you cannot do it yourself, write to [email protected] and we delete the account within 30 days. Billing records are kept as tax law requires. Error reports are kept for up to 90 days. Backup copies made before a deletion can still contain the deleted data.
Your rights. You can access, correct, delete or export your data, object to or restrict its processing, and complain to your data protection authority. Write to [email protected].
Changes. We will post changes here and email account holders about material ones.