01Who this policy covers
Rule & Form operates a managed website and growth platform for trade businesses. This policy applies to information collected on ruleandform.com, related marketing pages, account and application surfaces that link to this policy, and support or sales interactions.
It also explains how we handle information about a contractor’s customers and prospective customers when that information is entered into a Rule & Form-managed website, lead form, or account. In that setting, the contractor generally decides why the information is collected and how it is used. Rule & Form processes that information to provide the requested service and under the contractor’s instructions.
02Information we collect
Depending on how you interact with us, we may collect:
- Contact and account information: name, email address, phone number, login credentials and account identifiers.
- Business information: business name, website, services, service areas, hours, credentials, contact details and other facts a business supplies or asks us to verify.
- Customer and lead information: name, phone, email, message, service interest, source context and consent records submitted through a customer’s website or lead flow.
- Website and content information: pages, URLs, metadata, public website content, approvals, site plans and publishing state used to build or maintain a website.
- Device and usage information: IP address, browser and device information, request timestamps, authentication events, security signals, referring URL and coarse product usage.
- Communications: messages and support requests you send us, including the context needed to respond.
We do not ask for sensitive personal information to use the product. Do not place payment-card numbers, government identifiers, health information, passwords for another service, or other sensitive data into a website form, lead message, business record, or support request.
03How we collect information
- Directly from you when you create an account or contact us.
- From a business customer when it provides business facts, website content, customer records, or lead-routing instructions.
- From public websites and other sources a business asks us to inspect for discovery, migration, search coverage, or website planning.
- Automatically from the browser and request when needed for security, authentication, availability, and product operation.
- From service providers that help us verify a request, host data, deliver email, analyze product events, or provide discovery and AI functions.
04How we use information
We use information to:
- provide, secure, troubleshoot, and support the service;
- authenticate users and protect forms and accounts from abuse;
- create and maintain business records, site plans, website pages, lead paths, and publishing workflows;
- receive, preserve, and route website inquiries with their available context and consent record;
- inspect websites, compare business facts with search evidence, and produce discovery, coverage, or intelligence results requested by the business customer;
- measure reliability and coarse product usage when analytics is enabled;
- communicate about an account, request, security event, or service change;
- prevent fraud, enforce agreements, and comply with law; and
- improve the service using aggregated or de-identified information where practical.
05AI and automated processing
Some Rule & Form features use automated analysis or generative AI to help organize business information, inspect website content, compare search evidence, draft website content, or explain product findings. Inputs may include business facts, public website content, search evidence, instructions, and account or site context.
We use service providers for these functions, including OpenAI for configured generation or reasoning paths and Firecrawl or other discovery providers when a site-inspection workflow calls for them. Where an enabled intelligence feature analyzes conversations, prompts and conversation history may be sent to the provider needed for that workflow. Provider retention and model-training settings can vary by service and account configuration; contact Rule & Form for the settings applicable to your service before submitting sensitive personal data to an AI-assisted feature.
Automated output can be incomplete or wrong. A business customer is responsible for reviewing facts, claims, and generated content before publishing it or relying on it.
06When we disclose information
We disclose information only as needed for the purposes described in this policy, at your direction, or as required by law. Current service categories observed in the product include:
- Infrastructure and database providers: Supabase and the hosting, storage, backup, and delivery providers used for the environment in which a feature runs.
- Security providers: Cloudflare Turnstile, which evaluates browser and request signals to detect automated abuse on authentication and public customer lead-form surfaces. Turnstile is not sent the text entered into our forms. Cloudflare may independently process Turnstile signals as a controller under its own privacy terms to operate and improve its security service.
- Analytics providers: PostHog when the relevant server-side analytics key is configured. Product events are designed to use coarse identifiers and not lead message bodies or contact details.
- AI, discovery, and search providers: the provider needed for the requested generation, website discovery, or search evidence workflow.
- Business customers and their authorized users: information submitted through their websites and accounts is made available to the relevant business so it can respond to its own customers and operate its business.
- Authorities and professional advisers: when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or support a merger, financing, or similar transaction.
We do not sell personal information for money. We do not use lead contact information for unrelated advertising lists. We do not share information with a business’s existing job-management software unless the business or its configured integration requests that connection.
07Business customer and end-customer roles
For Rule & Form account information and visitors to our own website, Rule & Form acts as the organization deciding how and why the information is processed. For information a contractor enters or collects through a Rule & Form-managed website, the contractor is generally the party deciding the purpose of the collection. The contractor’s own privacy notice, customer agreements, and instructions may also apply.
If you interacted with a contractor’s website and want to know how that contractor uses your information, contact the contractor first. You may also contact us at hello@ruleandform.com, and we will route a request to the appropriate business or explain what we can handle directly.
08Cookies, local storage, and analytics
See our Cookie Policy for the current description of browser storage and analytics behavior. The marketing site does not intentionally run third-party advertising pixels. Product analytics is optional and is disabled when its server-side configuration is absent.
California’s online privacy rules ask commercial websites to explain their response to browser Do Not Track (DNT) signals and whether other parties may collect information about activity across sites. Rule & Form does not currently change its collection practices in response to a DNT signal. We also do not currently use cross-site behavioral advertising or intentionally track visitors across unrelated sites. Cloudflare may receive security signals when Turnstile is enabled, as described in the Cookie Policy and Cloudflare’s own privacy terms.
09Security and retention
We use access controls, authenticated sessions, server-side authorization, transaction boundaries, rate limiting, anti-abuse checks, and provider security controls appropriate to the service. No internet service can promise absolute security.
We keep information for as long as needed to provide the service, maintain an account or business record, preserve an audit or consent record, resolve disputes, prevent abuse, comply with legal obligations, or protect the service. We do not currently publish or enforce a single universal deletion period for every data type. A specific account, customer agreement, legal hold, backup system, or provider may require a different operational period.
10Your choices and privacy rights
Depending on where you live and whether a law applies to the relevant processing, you may have rights to access, correct, delete, obtain a copy of, or restrict certain uses of personal information. You may also have the right to opt out of targeted advertising, sale or sharing, or certain profiling. We do not sell personal information or use it for targeted advertising based on the product behavior audited for this policy.
Send a request to hello@ruleandform.com with the request type, the account or business involved, and enough information for us to verify and respond. We may need to ask for additional information to protect an account or another person’s information. We will not discriminate against you for exercising a privacy right.
If we deny a request where an appeal is required, reply to our response with “Privacy appeal.” We will explain the next step and any applicable regulator contact available for your jurisdiction.
11Children
Rule & Form is a business service and is not directed to children under 13. We do not knowingly collect personal information from a child under 13. If you believe a child submitted information, contact us so we can investigate and remove it where appropriate.
12Changes and contact
We may update this policy when the service, providers, or legal requirements change. We will post the revised version here and change the “Last updated” date. Material changes may also be communicated through the product or by email when appropriate.
Privacy questions and requests: hello@ruleandform.com.