1. Scope of this Policy
This Privacy Policy (the “Policy”) applies to personal information processed by Foldrule (“Foldrule,” “we,” “us” or “our”) through the website located at foldrule.com and its subdomains that link to this Policy, including the free tools published on it (together, the “Site”), and through communications we exchange with you in connection with the Site, such as the early access list.
Foldrule is developing job management software for trades businesses (the “Product”). The Product has not launched. This Policy does not govern personal information processed within the Product, which will be addressed by a separate privacy notice and customer agreement made available before any account is created.
This Policy does not apply to third party websites, services or platforms that the Site links to. Their handling of personal information is governed by their own policies.
“Personal information” in this Policy means any information that identifies, relates to, describes or is reasonably capable of being associated with an identified or identifiable individual, and includes “personal data” as defined in the EU General Data Protection Regulation and “personal information” as defined in applicable United States and Canadian laws.
2. Who is responsible for your personal information
Foldrule is a brand. The Site is operated by the sole trader identified in the “Controller” box at the top of this Policy, a natural person carrying on business in the Czech Republic and registered in the Czech Trade Register, who is responsible for the personal information described in this Policy.
For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”) and the Czech Act No. 110/2019 Coll., on the Processing of Personal Data, that person is the controller. Because the controller is established in the European Union, the GDPR applies to all processing described in this Policy, wherever you are located. For the purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”), and other laws that use the term, the controller acts as a business. References in this Policy to “Foldrule,” “we,” “us” and “our” mean that controller.
Person in charge of the protection of personal information. In accordance with the Quebec Act respecting the protection of personal information in the private sector and the federal Personal Information Protection and Electronic Documents Act (the “PIPEDA”), Foldrule has designated a Privacy Officer who is accountable for our compliance with this Policy. The Privacy Officer can be reached at hello@foldrule.com, with “Privacy Officer” in the subject line.
3. Personal information we collect
We collect only the personal information described below. We do not ask for, and ask that you do not submit, sensitive personal information such as government identifiers, financial account details, health information or information about children.
3.1 Information you provide to us
Early access list. When you request early access through the form on the Site, we collect:
- your work email address (required);
- your business name (optional);
- your trade, your team size and your country, each selected from a fixed list (optional);
- the language version of the Site you were using; and
- the address of the page from which you submitted the form.
Correspondence. If you email us, we collect your email address, your name if you provide it, and the contents of your message and any attachments.
Providing this information is voluntary. If you do not provide a valid email address, we cannot add you to the early access list or reply to you.
3.2 Information collected automatically
Server and security logs. When you visit the Site, the servers and content delivery network that host it automatically record technical information, including your Internet Protocol (“IP”) address, the date and time of the request, the page or file requested, the referring page, the response status and your browser’s user agent string. The early access form endpoint also uses your IP address, briefly and in memory, to limit the number of submissions that can be made from one address.
Analytics, only with your consent. If, and only if, you choose “Allow analytics” in our consent banner, we use Google Analytics 4 to collect information about how the Site is used, including: pages viewed and the order in which they were viewed; the referring website; approximate location at the city or region level derived from your IP address; device type, operating system, browser and screen size; language setting; and the interactions described in Section 5, such as opening the early access form or printing a document from a free tool. Google Analytics assigns a randomly generated identifier to your browser, which is stored in a cookie. We do not send your name, email address, business name or any other information you type into the Site to Google Analytics.
Consent record. We store your analytics choice, and the date you made it, in your browser’s local storage so that we do not ask you again on every page.
3.3 Information you enter into the free tools
The free tools on the Site (including the quote generator, invoice generator and calculators) perform their calculations entirely within your web browser. The names, addresses, amounts, prices and other content you enter into a tool are not transmitted to Foldrule or to any third party and are not stored. That content is erased when you close or reload the page. If you have consented to analytics, we record only that a tool was used, printed or reset, and, for the document builders, the number of lines on the document, never the content of any field.
3.4 Information from third parties
We do not purchase personal information and we do not receive personal information about you from data brokers, advertising networks or social media platforms.
4. How we use personal information and our legal bases
We use personal information only for the purposes set out below. Where the GDPR or the UK GDPR applies, we rely on the legal basis stated for each purpose.
| Purpose | Information used | Legal basis under the GDPR and UK GDPR |
|---|---|---|
| Adding you to the early access list and contacting you about early access, the launch of the Product and the availability of your invitation | Early access information, correspondence | Your consent (Article 6(1)(a)), given when you submit the form, and our legitimate interest in responding to people who have asked to hear from us (Article 6(1)(f)) |
| Understanding which trades, team sizes and countries are interested in the Product, to plan its development and launch | Early access information, in aggregated form where practicable | Legitimate interests (Article 6(1)(f)) |
| Responding to your enquiries and requests, including requests to exercise your privacy rights | Correspondence, identity information needed for verification | Legitimate interests (Article 6(1)(f)) and compliance with legal obligations (Article 6(1)(c)) |
| Measuring use of the Site and free tools, and improving their content and design | Analytics information | Your consent (Article 6(1)(a)) and, for storing and reading cookies, your consent under Article 5(3) of the ePrivacy Directive (2002/58/EC) and equivalent national laws |
| Operating, securing and maintaining the Site, including preventing spam, abuse and fraud, and diagnosing technical problems | Server and security logs, IP address | Legitimate interests (Article 6(1)(f)) |
| Complying with applicable law, responding to lawful requests from public authorities, and establishing, exercising or defending legal claims | Any information described in Section 3, as necessary | Legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)) |
Where we rely on legitimate interests, we have concluded that our interests are not overridden by your interests, rights and freedoms, taking into account the limited nature of the information and the safeguards described in this Policy. You may ask us for more information about this assessment.
Where we rely on consent, you may withdraw it at any time, as described in Sections 5 and 10. Withdrawal does not affect the lawfulness of processing carried out before it.
We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects concerning you, and we do not engage in profiling of that kind.
We will not use personal information for a purpose that is materially different from those described above without first notifying you and, where required by law, obtaining your consent.
5. Cookies and similar technologies
5.1 What we use
The Site does not set any cookies unless you consent to analytics. The technologies we use are:
| Name | Type | Provider | Purpose | Duration | Set when |
|---|---|---|---|---|---|
foldrule.analytics-consent.v1 |
Browser local storage | Foldrule (first party) | Remembers whether you allowed or declined analytics, and when | Until you clear your browser storage. We ask again 12 months after your choice | You make a choice in the consent banner |
_ga |
Cookie | Google Analytics (first party cookie) | Distinguishes one browser from another with a random identifier | 2 years | You allow analytics |
_ga_<container-id> |
Cookie | Google Analytics (first party cookie) | Maintains session state | 2 years | You allow analytics |
We do not use advertising cookies, social media pixels, session replay tools, fingerprinting or any cross-site tracking technology. We have disabled Google signals and advertising personalization features in Google Analytics.
5.2 Your choices
When you first visit the Site, a banner asks whether you allow analytics. Declining is as easy as accepting, and the Site works the same whichever you choose. Until you choose “Allow analytics,” no Google Analytics code is loaded and no analytics cookie is set.
You can change your choice at any time using the “Cookie settings” link at the bottom of every page. If you withdraw consent, we delete the Google Analytics cookies set on the Site’s domain and stop loading Google Analytics.
You can also block or delete cookies through your browser settings, and you can install Google’s Google Analytics Opt-out Browser Add-on.
5.3 Global Privacy Control and Do Not Track
If your browser sends a Global Privacy Control (“GPC”) signal, we treat it as a choice to decline analytics for that browser, we do not display the analytics banner, and we do not load Google Analytics unless you later affirmatively allow it through “Cookie settings.” Because there is no common industry standard for the older “Do Not Track” browser setting, the Site does not respond to it separately, but the same result can be achieved by declining analytics.
6. How we disclose personal information
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined in the CCPA and other United States state privacy laws. We have not done so in the preceding 12 months. We do not disclose personal information to third parties for their own direct marketing purposes.
We disclose personal information only to the following categories of recipients, and only to the extent necessary for the purposes described in Section 4:
- Service providers and processors that act on our behalf and under written obligations to protect the information and use it only to provide services to us. These include our content delivery provider, which serves the Site; our cloud infrastructure provider, which hosts the application and the database in which the early access list is stored; our transactional email provider, which delivers notifications about early access requests to us and our emails to you; and our business email and productivity provider, which hosts our mailbox.
- Google LLC, which provides Google Analytics as our service provider and processor under Google’s data processing terms, but only if you consent to analytics.
- Professional advisers, such as lawyers and accountants, bound by duties of confidentiality, where needed to obtain advice or to establish, exercise or defend legal claims.
- Public authorities, courts and law enforcement, where we are required to do so by applicable law, or where we believe in good faith that disclosure is necessary to protect the rights, property or safety of Foldrule, our users or others.
- A successor organization, in connection with an actual or proposed merger, acquisition, financing, reorganization or sale of all or part of our business, subject to confidentiality obligations and to this Policy or protections at least as protective.
7. International transfers of personal information
Foldrule is established in the Czech Republic. Our service providers, including Google, our cloud hosting provider and our email providers, may process personal information in the United States, Canada, the European Union and other countries where they or their subprocessors operate. Those countries may have data protection laws that differ from the laws of your country or province.
Transfers subject to the GDPR. Because we are subject to the GDPR, any transfer of personal information we control to a country outside the European Economic Area that has not been recognized by the European Commission as providing an adequate level of protection is made on the basis of an appropriate safeguard under Chapter V of the GDPR. Where a recipient in the United States is certified under the EU-U.S. Data Privacy Framework, including Google LLC, we rely on the Commission’s adequacy decision for that framework. Where it is not, or as a supplementary safeguard, we rely on the European Commission’s Standard Contractual Clauses incorporated into the provider’s data processing terms. Transfers to Canada rely on the Commission’s adequacy decision for Canada as it applies to organizations subject to the PIPEDA. You may request a copy of the relevant safeguard by contacting us.
For visitors in the European Economic Area, Google has stated that Google Analytics collects data through servers located in the European Union and uses the IP address only to derive approximate location before discarding it, without logging or storing the IP address.
Transfers from Canada and Quebec. Personal information may be stored or processed outside your province, including in the United States, where it may be accessible to courts, law enforcement and national security authorities of that jurisdiction. Before communicating personal information outside Quebec, we assess whether the information will receive adequate protection, taking into account generally recognized principles of personal information protection, and we protect it with contractual measures.
8. How long we keep personal information
We keep personal information only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.
| Category | Retention period |
|---|---|
| Early access information and related correspondence | Until 12 months after we send you your early access invitation, or 24 months after you joined the list if no invitation has been sent by then, or until you ask us to remove you, whichever is earliest |
| Other correspondence | Up to 24 months after our last exchange with you, unless needed longer to resolve a dispute or comply with a legal obligation |
| Records of privacy requests and our responses | 24 months after the request is closed, to demonstrate compliance |
| Server and security logs | Up to 90 days, unless needed longer to investigate a specific security incident or abuse |
| Google Analytics event data | 14 months, after which it is deleted automatically by Google Analytics |
| Analytics cookies | 2 years from when they are set, or until you withdraw consent or delete them |
| Consent record in your browser | 12 months, after which you are asked again, or until you clear your browser storage |
When the retention period ends, we delete or anonymize the information. Aggregated information that can no longer reasonably be associated with an individual may be retained for planning and statistical purposes.
9. How we protect personal information
We maintain reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption of the Site in transit using TLS, restriction of access to personal information to personnel who need it, rate limiting and spam protection on our forms, and data minimization in the design of the Site, such as the free tools processing your entries only on your own device.
No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities where and as required by applicable law, including where an incident presents a real risk of significant harm or a risk of serious injury under Canadian law.
10. Your privacy rights
Depending on where you live, you may have some or all of the rights described below. We will honor these rights as required by applicable law, and we extend the core rights of access, correction and deletion to all individuals regardless of location, subject to the exceptions permitted by law.
To exercise any right, contact us as described in Section 16. We will not discriminate or retaliate against you for exercising your rights.
10.1 Rights available to everyone
- Access. Request confirmation of whether we process your personal information and a copy of it.
- Correction. Request that we correct inaccurate or incomplete personal information.
- Deletion. Request that we delete your personal information.
- Withdrawal of consent and unsubscribing. Withdraw consent to analytics at any time through “Cookie settings,” and ask to be removed from the early access list at any time by replying to any email from us or contacting us.
10.2 European Economic Area, United Kingdom and Switzerland
If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing of your personal information, you also have the right to:
- restrict our processing of your personal information in certain circumstances;
- object to processing based on our legitimate interests, including profiling, and to processing for direct marketing at any time;
- data portability, meaning to receive personal information you provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means; and
- lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. Our lead supervisory authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz). In the United Kingdom, the supervisory authority is the Information Commissioner’s Office. In Switzerland, it is the Federal Data Protection and Information Commissioner. We would, however, appreciate the opportunity to address your concern first.
Because we are established in the European Union, these rights apply to you wherever you live, and we have not appointed a representative under Article 27 of the GDPR, which applies only to controllers not established in the Union.
10.3 California
If you are a California resident, the CCPA provides you with the following rights, subject to verification and to the exceptions in the law:
- Right to know the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to which we disclose it.
- Right to delete personal information we collected from you.
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information. We do not sell or share personal information, as described in Section 6.
- Right to limit the use and disclosure of sensitive personal information. We do not collect sensitive personal information.
- Right to non-discrimination for exercising any of these rights.
Notice at collection and categories of personal information. In the preceding 12 months we have collected the following categories of personal information, as listed in the CCPA:
| CCPA category | Examples | Source | Business purpose | Disclosed for a business purpose to |
|---|---|---|---|---|
| Identifiers | Email address, IP address, online identifier in an analytics cookie | You; your device | Early access communications; security; analytics (with consent) | Hosting, email and productivity service providers; Google (analytics with consent, fonts) |
| Commercial and professional information | Business name, trade, team size | You | Early access communications; product planning | Email and productivity service providers |
| Internet or other electronic network activity | Pages viewed, interactions with the Site and free tools, referring page, browser and device information | Your device | Analytics (with consent); security and operation of the Site | Google (with consent); hosting service providers |
| Geolocation data (approximate, not precise) | Country, region or city derived from IP address | Your device | Analytics (with consent); security | Google (with consent); hosting service providers |
We retain each category for the periods described in Section 8. We do not collect “sensitive personal information” as defined in the CCPA.
Authorized agents. You may designate an authorized agent to make a request on your behalf. We may require the agent to provide proof of written permission, and may require you to verify your identity directly with us.
Verification. To protect your information, we will verify requests by asking you to confirm control of the email address associated with your personal information. We will not ask for more information than is reasonably necessary.
Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.
10.4 Other United States states
Residents of states with comprehensive consumer privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, may have rights to confirm whether we process their personal information, to access, correct and delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal information and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in targeted advertising, sale or such profiling. We honor these rights wherever those laws apply, and we extend them to all United States residents.
Appeals. If we decline to take action on your request, you may appeal our decision by replying to our response or emailing hello@foldrule.com with “Privacy Appeal” in the subject line within a reasonable period after receiving our decision. We will respond to your appeal in writing within the period required by applicable law, and explain the reasons for our decision. If your appeal is denied, you may contact the attorney general of your state.
Nevada. We do not sell covered information as defined under Nevada law.
10.5 Canada
Under the PIPEDA and applicable provincial private sector privacy laws, including those of Alberta, British Columbia and Quebec, you may request access to and correction of the personal information we hold about you, withdraw your consent to our processing subject to legal or contractual restrictions and reasonable notice, and ask questions about our privacy practices.
If you are a resident of Quebec, you also have the right to:
- be informed of the personal information collected about you, the purposes for which it is used, the persons within Foldrule who have access to it, how long it is kept and the contact details of our Privacy Officer;
- request that personal information we collected from you be communicated to you, or to a person or body you designate, in a structured, commonly used technological format (data portability);
- request that we cease disseminating your personal information or de-index any hyperlink attached to your name that provides access to it, where the conditions set out in the law are met; and
- file a complaint with the Commission d’accès à l’information du Québec.
You may also file a complaint with the Office of the Privacy Commissioner of Canada or, where applicable, with the Information and Privacy Commissioner of your province.
10.6 How we respond
We will acknowledge your request and respond within the time required by applicable law, which is generally within 30 days under Canadian law, one month under the GDPR, and 45 days under the CCPA. Where the law permits, we may extend that period, and we will tell you if we do and why. We respond to requests free of charge, except where a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline the request as permitted by law, and we will explain our reasons.
We may need to retain certain information despite a deletion request where the law requires or permits it, for example to comply with a legal obligation or to keep a record that you asked us not to contact you.
11. Email communications
We will email you about early access to the Product, its launch and your invitation, which is the purpose for which you gave us your email address. We send commercial electronic messages in compliance with Canada’s Anti-Spam Legislation and the United States CAN-SPAM Act. Each marketing email identifies Foldrule, includes our contact information and provides a working means of unsubscribing, which we honor promptly and in any event within the period required by law. We do not send newsletters to early access sign-ups unless you separately ask to receive them.
12. Children’s privacy
The Site is intended for business owners and professionals and is not directed to children. We do not knowingly collect personal information from children under the age of 16. If you believe that a child has provided personal information to us, please contact us and we will delete it.
13. Third party links
The Site contains links to third party websites, including government tax authority websites cited in our articles. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies.
14. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices, the Site, the launch of the Product or applicable law. When we do, we will revise the “Last updated” date at the top of this Policy. If we make material changes, we will provide notice through the Site and, where we have your email address and the change affects you, by email, before the change takes effect. Where required by law, we will obtain your consent to material changes.
15. Language
This Policy is available in English and Spanish. If there is any inconsistency between the versions, the English version prevails to the extent permitted by applicable law.
16. Contact us
For any question about this Policy, to exercise your rights, or to reach our Privacy Officer, contact:
Foldrule, Attn: Privacy Officer The controller named in the “Controller” box at the top of this Policy, at the place of business stated there Email: hello@foldrule.com, with “Privacy Officer” in the subject line
We will respond as described in Section 10.6.