Privacy Policy

1. Controller and contact

This notice covers personal-data processing when you use rulesatsea.com or contact its operator. The controller is:

Please use this contact for questions or to exercise your data-protection rights. The General Data Protection Regulation (GDPR) applies to the processing described here.

2. Website delivery and security: Vercel

The website is hosted through Vercel Inc., United States. Delivering pages and assets necessarily involves processing your IP address and request information, such as the requested address, date and time, browser headers and response status. Vercel may also process technical logs to operate and secure its infrastructure.

The purpose is to deliver the website, diagnose failures and prevent abuse. Our legal basis is Article 6(1)(f) GDPR: our legitimate interest in providing a reliable, secure website. This technical processing is necessary to deliver the pages you request; it does not depend on optional analytics consent.

Vercel is a recipient of this technical information and uses infrastructure providers to deliver its services. Its own service and security data may also be processed under its responsibility. See Vercel’s privacy notice and subprocessor information.

3. Supabase infrastructure

Supabase supports user accounts, login email addresses and saved learning progress, as confirmed by the operator. These records allow you to sign in and resume your learning. The provider named in its current data-processing addendum is Supabase Pte. Ltd., Singapore.

Processing necessary to provide a requested account and synchronise progress is based on Article 6(1)(b) GDPR. You must provide the login information needed for an account if you choose to use one. Any additional account fields, authentication methods, security logging and deletion processes still require verification against the account implementation.

The selected project region and retention arrangements must be confirmed for this draft. An EU project region does not alone cover all logs, backups, support access and subprocessors.

See the Supabase data-processing addendum and subprocessor list. The controller remains responsible for explaining this site’s actual use of the service.

4. Learning progress and browser storage

The browser-based simulator stores exercise outcomes, best passing distances, stars, streaks, previously missed questions, recognition-review answers and scheduling, and audio preferences in local storage on your device. It uses these records to resume training, show progress and remember the settings you request. Account-based storage and progress synchronisation are covered in the Supabase section.

The site also stores your analytics choice locally so it can honour it on later visits. The application does not set advertising cookies. Fonts and learning assets are served with the website, and simulator sounds are generated on your device.

Device storage needed for the requested training functions and to remember your privacy choice is used under Section 25(2), point 2 TDDDG. To the extent these records constitute personal data, the legal basis is Article 6(1)(f) GDPR: our interest in providing the requested learning features and honouring your settings.

These browser records have no automatic expiry. They remain until you clear this site’s data, your browser removes them or a setting is overwritten. You can delete them through your browser’s site-data settings. This resets progress and preferences. Blocking storage can prevent settings from being saved; training remains available for the current visit.

5. Optional analytics: TractionScout

We use TractionScout to understand which pages are used and improve the learning experience. TractionScout is operated by Leander Melms, the same controller named above; it is a separate analytics system, rather than a learner account.

Only after you allow analytics does the site load its tracker and contact tractionscout.com. The current EU consent configuration collects page addresses without query strings or fragments, pageview and event times, engagement duration and scroll depth. Requests also expose IP addresses and HTTP metadata to the analytics infrastructure. Cookieless tracking does not mean that all processing is anonymous.

The configuration does not create persistent analytics visitor or session identifiers. Form, download, outbound-link, advertising, personalisation and Web Vitals tracking are disabled. If you allow analytics, aggregate events count guide practice clicks and exercise starts and completions on their respective page paths. Answers, scores, saved progress and learner identifiers are not sent. We do not link a guide visit to a particular learner’s later completion.

The current analytics endpoint is served from UpCloud’s Frankfurt network. The infrastructure provider is UpCloud Oy, Finland; it handles network requests and infrastructure for the analytics service. This endpoint location does not establish the location of every backup or support operation. See UpCloud’s hosted-data safeguards and privacy notice.

The legal basis is Article 6(1)(a) GDPR and, where device access requires it, Section 25(1) TDDDG. You can decline or withdraw in Analytics preferences; this stops further collection without affecting training. Withdrawal does not affect the lawfulness of processing before it. The tracker also respects Do Not Track.

See the TractionScout privacy notice for the analytics system. Its infrastructure providers and retention settings must be considered alongside this notice.

6. Contact correspondence: GMX

If you email us, we process your email address, any name you provide, the message, attachments and technical mail information to answer your enquiry. Our mailbox is provided by GMX, a service of 1&1 Mail & Media GmbH, Germany. The provider receives the information needed to deliver, store and protect correspondence. See GMX’s privacy information.

For general enquiries, the basis is Article 6(1)(f) GDPR: our legitimate interest in responding to messages and resolving concerns. Where a message concerns a contract or requested pre-contractual steps, Article 6(1)(b) GDPR applies. Handling statutory privacy requests or required records is based on Article 6(1)(c) GDPR.

Providing information by email is voluntary. We need a reply address and enough information about your request to respond. Please avoid sending unnecessary sensitive information.

7. Other services and external links

Namecheap, Inc., United States, provides domain and DNS administration. DNS resolution can involve the domain name and network information from the resolver making the request. This supports reaching the website, based on our interest in providing an accessible service under Article 6(1)(f) GDPR. It does not send your training records to the domain provider. See Namecheap’s privacy policy.

Search-engine ownership verification does not load a Google or Bing tracking script in your browser. The simulator does not embed payment processing, newsletters or third-party social media.

When you follow a link to an external website, that website receives the information needed for your visit and applies its own privacy practices. Links to official rule sources do not load those sites until you follow them.

We do not sell your personal data or use it for behavioural advertising. Data may also be disclosed to authorities or professional advisers where legally required or necessary to establish, exercise or defend legal claims.

8. Processing outside the EEA

Vercel and its infrastructure operate internationally, including in the United States. Domain services and analytics infrastructure may also involve processing outside the European Economic Area (EEA). A provider’s location or an EU database region alone does not establish that all processing remains in the EEA.

Transfers require a valid GDPR Chapter V mechanism, such as an applicable adequacy decision or the European Commission’s standard contractual clauses with any necessary supplementary measures. Vercel publishes its transfer arrangements in its data-processing addendum and compliance information. Account-specific coverage and the analytics infrastructure arrangements still require confirmation for this draft.

You may request information about relevant destinations and a copy of the safeguards from the controller using the contact above.

9. Retention and deletion

Browser storage remains on your device as described in the browser storage section. Withdrawing analytics consent stops future collection. Where earlier consent-based records remain personal data, they must be erased after withdrawal unless another lawful basis or a statutory exception permits retention. Genuinely anonymous statistics fall outside the GDPR; cookieless or aggregate records are not automatically anonymous.

The precise retention and backup-deletion schedules for hosting logs, Supabase account records and analytics records have not yet been confirmed for this draft. The current TractionScout retention cleanup does not automatically delete native analytics records. A deletion schedule must be established and implemented before this policy is finalised; provider dashboard visibility alone does not establish deletion from all security logs or backups.

Correspondence is used to deal with your enquiry. Subsequent retention depends on whether it is needed for a continuing issue, a specific statutory retention duty or the applicable period for legal claims. The operator’s actual mailbox deletion schedule must also be confirmed before publication. You may request erasure, subject to applicable legal exceptions.

10. Your rights

Subject to the conditions in the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability (Articles 15–20). Portability applies where processing is automated and based on consent or a contract.

Right to object: You may object to processing based on Article 6(1)(f) GDPR for reasons relating to your particular situation (Article 21). We must stop unless we demonstrate compelling legitimate grounds or processing is needed for legal claims. You can withdraw optional analytics consent at any time through Analytics preferences.

Contact the controller to exercise a right. We may request only the information needed to verify your identity and locate relevant records. Requests are normally answered within one month; where a lawful extension is needed, we will explain it within that month. We do not require you to contact a provider first.

You may complain to a supervisory authority, especially where you live, work or believe an infringement occurred. The authority for the operator’s Hamburg location is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI). You do not need to contact us before complaining.

11. Automated decisions and updates

The simulator calculates exercise feedback locally for learning. We do not use your data for automated decisions with legal or similarly significant effects under Article 22 GDPR.

We will update this notice if processing changes. A revised notice does not itself grant consent for a new purpose. The date above identifies this version.