This policy explains what personal data Rulo collects, why we collect it, who we share it with, and the choices you have. It applies to the international edition of the software and to this website.
1. Who we are
The data controller is Shenzhen Aicheng Technology Co., Ltd., registered at A217, Xincheng Plaza, No. 86 Puxia Road, Liuyuebei Community, Henggang Subdistrict, Longgang District, Shenzhen, Guangdong, China. For any privacy question or request, contact qkxs9999@163.com.
2. What we collect
Account data
- your phone number, in international format, used as your login identifier;
- a display name, if you choose to set one;
- your password, stored only as a salted cryptographic hash — we never store the plain password;
- your edition and interface language preference;
- verification codes sent to your phone, retained briefly to validate sign-in.
Usage and transaction data
- the prompts and inputs you submit, and the outputs generated, retained to deliver the service to you and to investigate abuse;
- credit balance, credit ledger entries, orders, refunds and their status;
- timestamps, feature used, model selected, and credit cost per request.
Technical data
- IP address, operating system and version, application version, and device model;
- crash and error diagnostics, and security logs.
Payment data
Card payments are handled by our payment providers. We receive an order reference, the amount, the currency, the payment status, and limited card metadata (such as the card brand and last four digits) — we do not receive or store your full card number or security code. On iOS, purchases are processed by Apple and we receive a transaction identifier and receipt data for verification.
3. How and why we use it
- To provide the service — authenticate you, process your requests, deliver output, and maintain your credit balance.
- To take payment — create orders, verify payment, issue refunds, and keep accounting records.
- To keep the service safe — detect fraud, abuse, and attempts to circumvent usage limits; enforce our terms.
- To support you — respond to enquiries and troubleshoot faults.
- To improve the product — analyse aggregate usage patterns and fix defects. We do not use your content to train our own models.
- To meet legal obligations — respond to lawful requests and comply with tax and accounting law.
4. Legal bases (EEA and UK users)
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the service and processing payments); legitimate interests (securing the service, preventing abuse, improving the product); legal obligation (tax and accounting records); and consent (optional communications), which you may withdraw at any time.
5. Who we share it with
We do not sell personal data. We share it only with service providers that process it on our instructions, and only as needed:
- AI model providers — your prompt and the parameters of your request are transmitted to the model provider that generates the result (currently DeepSeek) so that output can be produced;
- Payment providers — Airwallex and PayPal for card payments, and Apple for In-App Purchases, to process your transaction and handle refunds and disputes;
- Hosting and infrastructure providers — to operate the servers, databases and file storage that run the service;
- SMS providers — to deliver sign-in verification codes;
- Professional advisers and authorities — where required by law, or to establish or defend legal claims.
Where a provider acts as our processor, it is bound by a data processing agreement and may use the data only to deliver its service to us.
6. International transfers
The service is operated from servers located in the region serving your edition. Because our providers are located in different countries, your data may be transferred to and processed in countries other than your own, including the United States and Singapore. Where we transfer data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
7. How long we keep it
- Account data — for as long as your account exists. After you delete your account, it is removed or anonymised within 30 days, except where retention is required by law.
- Orders and financial records — retained for the period required by tax and accounting law, typically 5 to 10 years.
- Security and diagnostic logs — typically 90 days, unless needed to investigate a specific incident.
- Generated files — saved on your own device and never uploaded to us, so retention is entirely under your control.
8. Security
We protect data with encryption in transit (HTTPS), hashed passwords, access controls limited to personnel who need it, credential separation between environments, and signature verification on all payment callbacks. No system is perfectly secure; if a breach affects your rights, we will notify you and the relevant authority as required by law.
9. Your rights
Depending on where you live, you may have the right to:
- access a copy of the personal data we hold about you;
- correct inaccurate data;
- delete your data, or close your account;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent where processing is based on consent;
- lodge a complaint with your local supervisory authority.
To exercise any of these, email qkxs9999@163.com. We respond within 30 days. We may need to verify your identity before acting. California residents may also request disclosure of categories of personal information collected; we do not sell personal information as defined by the CCPA.
10. Cookies and local storage
This website does not use advertising or analytics cookies. We use your browser’s local storage for a single purpose: remembering whether you chose to view the site in English or Chinese. You can clear it at any time through your browser settings. The application uses similar local storage to keep you signed in and to remember interface preferences.
11. Children
The service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Links to other sites
Our site may link to third-party pages, such as payment providers. We are not responsible for their privacy practices; please review their policies before providing personal data.
13. Changes to this policy
We may update this policy. The revised version takes effect when published here and the date above will change. If a change materially affects how we handle your data, we will notify you in the application or by email before it takes effect.
14. Contact
Privacy questions and requests: qkxs9999@163.com
Shenzhen Aicheng Technology Co., Ltd.
A217, Xincheng Plaza, No. 86 Puxia Road, Liuyuebei Community, Henggang Subdistrict, Longgang District, Shenzhen, Guangdong, China