Privacy Policy

1.Who we are and what this policy covers

RuleFix is a compliance-engineering service for software teams. It scans code (through AI coding agents using our MCP server, the GitHub App, or a public repository URL) and public websites for privacy, security and regulatory issues, stores the findings, and can suggest fixes. This policy is provided by:

• Legal name: Vinkura Innovations Network Private Limited (“RuleFix”)
• Registered office: 197, Chaudhary Mohalla, Gulab Nagar, Bareilly, Uttar Pradesh 243003, India
• CIN: U63999UP2025PTC219516
• Website: rulefix.in

It explains how we handle personal data when you visit rulefix.in, create an account, or use the RuleFix service. We play two roles:

• Data Fiduciary (controller) for your account data: who you are, how you sign in, your consents and how you use the service. This policy governs that data.
• Data Processor for customer content: the code, findings, website scan results and other material a workspace sends us to analyse. The workspace owner (usually your employer) decides why that content is processed and is responsible for it; we process it only on their instructions under our Data Processing Addendum. If your personal data appears in someone else's code or website, please contact that organisation first — we'll help them respond.

“Personal data” means any data about an individual who can be identified by or in relation to that data. We use the terms of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). If you are in the European Economic Area or the UK, the GDPR also applies; see section 13.

2.The personal data we collect

We collect only what we need to run RuleFix. Itemised:

• Account

  What exactly

  Email address; name (optional); profile picture URL and username if you sign in with GitHub or GitLab; account identifiers; sign-up date.

  Where it comes from

  You, or GitHub/GitLab when you choose to sign in with them.

• Authentication

  What exactly

  Session tokens, sign-in times, IP address and browser (user agent) recorded by our authentication provider for security.

  Where it comes from

  Your browser, automatically when you sign in.

• Workspace

  What exactly

  Workspace name, your role (owner, admin, member), members and invitations, plan.

  Where it comes from

  You and your workspace admins.

• Projects and scans

  What exactly

  Project names, repository URLs and names, default branch, website addresses (origin only), chosen frameworks, scan times, scores, commit references and which tool ran the scan.

  Where it comes from

  You, your AI agent or CI, the GitHub App.

• Findings and code excerpts

  What exactly

  For each issue: rule, severity, title, message, file path and line, a fingerprint, and a short code excerpt (up to 2,000 characters). Excerpts are encrypted before storage (see section 8). Excerpts may contain personal data if your code does.

  Where it comes from

  Scans of your code (customer content — we act as processor).

• Website scan results

  What exactly

  The site address, the number of pages visited and the issues found (for example missing security headers or cookies set without consent). We don't store page content.

  Where it comes from

  Public pages of websites you ask us to scan (customer content).

• API keys

  What exactly

  Key name, a short display prefix, a one-way keyed hash of the key, created/last-used/expiry/revocation times. The full key is shown once and never stored.

  Where it comes from

  You.

• GitHub connection

  What exactly

  Installation ID, the GitHub account or organisation name, account type and avatar URL, which repositories you selected.

  Where it comes from

  GitHub, when you install the RuleFix GitHub App.

• Consent and privacy records

  What exactly

  Which version of our Terms, Privacy Policy and Cookie Policy you accepted and when, your cookie and marketing-email choices (including withdrawals), and your export or erasure requests.

  Where it comes from

  You.

• Audit log

  What exactly

  Security-relevant actions in your workspace (for example API key created, project deleted) with the acting user and time.

  Where it comes from

  Generated by the service.

• Technical logs

  What exactly

  IP address, browser, requested URL, time, response status and error diagnostics. We never log code, code excerpts, API keys or model output.

  Where it comes from

  Your browser or client, automatically.

• Cookies

  What exactly

  See our Cookie Policy. We use only strictly necessary cookies today.

  Where it comes from

  Your browser.

• Support and correspondence

  What exactly

  What you send us by email or the contact form, and our replies.

  Where it comes from

  You.

• Billing (when paid plans launch)

  What exactly

  Billing name and email, address, GSTIN, plan, invoices and payment status. Card and bank details go directly to our payment processor; we never see full card numbers.

  Where it comes from

  You and our payment processor.

Code you send for scanning (through MCP, the GitHub App or a public repository URL) is processed in memory to run our rules and is not stored, except for the findings and encrypted excerpts described above. We do not need, and ask you not to send, special categories of data such as health or financial information about individuals.

3.Why we use it, and on what basis

Under the DPDP Act we process personal data either with your consent, or for a legitimate use the Act allows — for example where you voluntarily provide data for a specified purpose and haven't objected, or where processing is needed to comply with a law. We never process your personal data for a purpose you haven't been told about.

• Create and run your account and workspace; sign you in

  Data used

  Account, authentication, workspace

  Basis

  Consent given at sign-up (DPDP); contract (GDPR)

• Scan code and websites, store findings, show dashboards and reports

  Data used

  Projects, scans, findings, website results, GitHub connection

  Basis

  Your workspace's instructions; consent for your own account data

• Suggest AI-generated fixes when you ask for one

  Data used

  A redacted window of the file being fixed

  Basis

  Your request (consent); contract (GDPR)

• Keep the service and your data secure; detect and investigate abuse and incidents

  Data used

  Authentication, API keys, audit log, technical logs

  Basis

  Legitimate use / legal obligation (CERT-In, DPDP Rules); legitimate interests (GDPR)

• Prove what you agreed to and honour your choices

  Data used

  Consent and privacy records, rf_consent cookie

  Basis

  Legal obligation (DPDP Act requires us to demonstrate consent)

• Respond to support requests and rights requests

  Data used

  Support correspondence, account data

  Basis

  Your request; legal obligation

• Bill you and keep tax records (when paid plans launch)

  Data used

  Billing data

  Basis

  Contract; legal obligation (tax and company law)

• Send service emails (security notices, changes to these terms, receipts)

  Data used

  Email address

  Basis

  Necessary to provide the service you signed up for

• Send product-update emails

  Data used

  Name, email

  Basis

  Only with your separate, optional consent — off by default

We do not sell personal data, use it for advertising, or use your code, findings or excerpts to train AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4.AI-generated fixes

RuleFix can suggest a code fix for a finding using Anthropic's Claude API. This is optional and limited by design:

• It runs only when you or your AI agent explicitly request a fix for a specific finding (the rulefix_suggest_fix tool), and only when AI fixes are enabled for the service. Otherwise you receive a reference fix written by RuleFix and no code is sent to Anthropic.
• We send only a window of about 60 lines either side of the finding, plus the rule — never the whole repository. Before sending, RuleFix replaces detected secret values (API keys, tokens, private keys, passwords in connection strings and similar) with placeholders, and restores them only in the suggestion returned to you.
• We don't store the code sent or the model's output; we never log either.
• Anthropic processes the request in the United States as our sub-processor under its commercial terms, which do not allow it to train its models on this data.

Redaction is automated and can miss things. If a file contains personal data you don't want sent to an AI provider, use the reference fix instead. AI suggestions can be wrong: review every change before you merge it.

5.Who we share it with

We share personal data only as needed to run RuleFix, and never sell it. Recipients:

• Sub-processors that host and operate the service on our instructions, under written contracts with security and confidentiality obligations. The current list, what each receives and where, is on our Sub-processors page.
• Your workspace. Owners and admins of a workspace can see its members, projects, findings and audit log, including actions you took in it.
• Sign-in providers. If you sign in with GitHub or GitLab, they tell us who you are; their own privacy policies apply to what they collect.
• Authorities, when we are legally required to — for example a valid order from a court, CERT-In or the Data Protection Board of India. Where allowed, we tell the affected workspace first.
• A successor, if RuleFix is merged, acquired or restructured. They must honour this policy, and we will tell you before your data becomes subject to a different policy.

6.Where your data is stored and cross-border transfers

Our database, authentication and file storage are hosted by Supabase in [Mumbai, India (AWS ap-south-1) — region to be confirmed]. Requests are processed on Vercel ([Vercel function region to be confirmed]; static pages are served from Vercel's global edge network). When you use the GitHub App, AI fixes or (later) email and payments, data reaches the providers listed on the Sub-processors page, some of which are in the United States.

The DPDP Act allows transfers outside India except to countries the Central Government restricts by notification; we will stop or reroute any transfer to a restricted country. For data protected by the GDPR, transfers out of the EEA/UK rely on an adequacy decision or the European Commission's Standard Contractual Clauses (and the UK Addendum), with additional safeguards such as encryption.

7.How long we keep it

We keep personal data only as long as the purpose needs it, or the law requires, then delete or irreversibly anonymise it.

• Account, profile and workspace data

  How long

  While your account is active. After a confirmed erasure request, deleted within 30 days (backups roll off within a further 30 days).

• Projects, scans, findings and encrypted excerpts

  How long

  While the workspace keeps them. Deleted when you delete them, when the workspace is deleted, or when the workspace owner's contract ends (see the DPA).

• Code sent for scanning or AI fixes

  How long

  Not stored. Processed in memory for the duration of the request.

• Website scan content

  How long

  Not stored. Only findings and the page count are kept, as above.

• API key metadata

  How long

  Until the key is deleted or the workspace is deleted. Revoked keys stay listed for audit until then.

• Workspace audit log

  How long

  For the life of the workspace, as evidence for your own audits.

• Security, access and request logs

  How long

  at least 180 days (CERT-In Directions, 28 April 2022) and one year where the DPDP Rules, 2025 require it, then deleted.

• Consent records and privacy requests

  How long

  For as long as your account exists and three years after it closes, so we can show what you agreed to if questioned.

• Support correspondence

  How long

  Up to three years after the conversation ends.

• Billing and tax records (when paid plans launch)

  How long

  As long as Indian tax and company law require (currently up to eight years).

• Product-update email consent

  How long

  Until you withdraw it; the withdrawal record is kept as above.

We don't delete accounts just because they are inactive. If we ever introduce such a rule, we will email you at least 48 hours before anything is deleted, so you can keep your account by signing in.

8.How we protect it

Reasonable security safeguards we have in place today:

• HTTPS (TLS 1.2+) everywhere, with HSTS; database storage and backups are encrypted at rest (AES-256) by our hosting provider.
• Code excerpts are additionally encrypted in our application with AES-256-GCM using a separate key per workspace, so a copied database row can't be read without our key. If that encryption isn't available, excerpts aren't stored at all.
• API keys are stored only as keyed hashes (HMAC-SHA-256); the full key is shown once.
• Row-level security in the database limits every query to workspaces you belong to; findings can only be written by our servers.
• An audit log of security-relevant actions, written by the database itself.
• Strict security headers and Content-Security-Policy; validated input; secrets kept out of the browser.
• Access to production data is limited to people who need it to run the service.

No system is perfectly secure. We are not yet independently certified (for example SOC 2 or ISO 27001) and have not yet completed an external penetration test; we will update this page when we do. See our Security page to report a vulnerability.

9.Your rights

Under the DPDP Act you have the right to:

• Access — a summary of the personal data we process about you, what we do with it, and who we have shared it with.
• Correction, completion and updating of inaccurate or incomplete data.
• Erasure of personal data we no longer need, unless the law requires us to keep it.
• Withdraw consent at any time, as easily as you gave it (see section 11).
• Grievance redressal — a readily available way to complain to us, and then to the Data Protection Board of India.
• Nominate another individual to exercise your rights if you die or become incapable.

In the EEA/UK you also have the rights to restriction, objection and data portability, and to complain to your supervisory authority (see section 13). Your duties under the DPDP Act include giving us accurate information and not filing false or frivolous complaints.

10.How to exercise your rights

1. In the dashboard: go to Settings → Privacy to download a copy of your data instantly, see and change your consents, and request erasure of your account. You can edit your name in Settings → Profile.
2. By email: write to privacy@rulefix.in from the email address on your account (so we can identify you — that address, or your account ID, is the identifier we need). Say which right you want to exercise.
3. To nominate someone: email privacy@rulefix.in with the nominee's name and contact details and their relationship to you. We will confirm by email. The nominee will need to show proof of your death or incapacity when acting for you.

We respond within 30 days, and in any case within the 90 days the DPDP Rules allow. We may need to verify your identity first. Requests are free unless they are manifestly unfounded or excessive. If your request is about customer content (for example code in a workspace you don't control), we will pass it to that workspace's owner and help them respond.

11.Consent and withdrawing it

When you sign up you accept our Terms and this policy; the version and time are recorded. Optional choices are separate and off by default: product-update emails, and any non-essential cookies (we don't use any today).

• Marketing emails: switch them on or off in Settings → Privacy, or use the unsubscribe link in any such email.
• Cookies: use “Cookie settings” in the footer. We honour Global Privacy Control.
• Your account: withdrawing consent to the Terms and this policy means closing your account — request erasure in Settings → Privacy or email privacy@rulefix.in.

Every give and every withdrawal is recorded with a timestamp. Withdrawal doesn't affect processing that happened before it, and we stop the related processing within a reasonable time (and cause our processors to stop too), unless a law requires us to continue.

12.Children

RuleFix is a business tool for professionals and is not meant for anyone under 18. We do not knowingly process the personal data of children or track or target them. If you believe a child has created an account, contact privacy@rulefix.in and we will delete it.

13.If you are in the EEA or the UK

Vinkura Innovations Network Private Limited is the controller of your account data. Our legal bases under GDPR Article 6 are: contract (running your account and the service), legitimate interests (security, abuse prevention, service improvement using aggregated data — which you may object to), legal obligation (tax, records, lawful requests), and consent (optional emails and non-essential cookies, which you can withdraw at any time).

You have the rights of access, rectification, erasure, restriction, data portability and objection, and you may lodge a complaint with the supervisory authority where you live or work. Transfers are covered in section 6. We will appoint an EU representative if GDPR Article 27 requires one.

14.If there is a data breach

If a personal data breach affects you, we will:

• tell you without delay, in plain language, through your account or registered email — what happened, when, the likely consequences for you, what we are doing about it, what you can do to protect yourself, and who to contact;
• tell the Data Protection Board of India without delay and send it a detailed report within 72 hours of becoming aware, as the DPDP Rules require;
• report cyber incidents to CERT-In within 6 hours of noticing them, as its Directions of 28 April 2022 require;
• notify the relevant EU/UK supervisory authority within 72 hours where the GDPR requires it.

Where we act as a processor, we tell the affected workspace owner without undue delay so they can meet their own duties (see the DPA).

15.Grievances and the Data Protection Board

If you have a concern or complaint about how we handle your personal data, please contact our Grievance Officer — the person who can answer questions about our processing on our behalf:

• Name: Akshat Shukla
• Designation: Director and Grievance Officer
• Email: grievance@rulefix.in
• Post: 197, Chaudhary Mohalla, Gulab Nagar, Bareilly, Uttar Pradesh 243003, India

We acknowledge grievances within 2 working days and resolve them within 30 days, and in any case within 90 days. The full process is on our Grievance Redressal page. If you are not satisfied with our response, you may complain to the Data Protection Board of India through its online platform. The DPDP Act asks you to use our grievance process first.

16.Changes to this policy

We will update this policy when our processing changes. Each version has a date (shown above). For material changes, we will tell you by email or in the dashboard before they take effect, and ask for your consent again where the law requires it — the dashboard will ask you to accept the new version before you continue.

17.Contact

• Privacy questions and rights requests: privacy@rulefix.in
• Grievances: grievance@rulefix.in
• Security reports: security@rulefix.in
• Post: Vinkura Innovations Network Private Limited, 197, Chaudhary Mohalla, Gulab Nagar, Bareilly, Uttar Pradesh 243003, India