Personal Data Processing and Privacy Policy

This policy explains how besimpler S.A.S. processes personal data related to RuleX, a legal assistance and legal work management platform. RuleX may be used from different countries, but its operations and contractual relationship are with the Colombian company identified in this policy.

1. Who determines the processing

besimpler S.A.S. determines the purposes and means of processing account data, providing RuleX, security, support, communications, and billing. Accordingly, it acts as the controller for those processing activities, even when the user is located outside Colombia.

When a user or organization uploads data about its clients, employees, counterparties, or other third parties to RuleX to work on a matter, that user or organization retains the responsibilities it may have toward those data subjects. To the extent RuleX processes that content under instructions to provide the service, it acts as a processor or processing service provider. This allocation does not limit besimpler S.A.S.'s own liability for processing it carries out for its own purposes.

The foregoing classification is without prejudice to mandatory provisions that may apply in the country of the data subject or user.

2. Data We May Process

• Account and identity: email address, name, avatar, credentials, and data needed to authenticate and secure the account.
• Territorial settings: country selected or confirmed for the account, language, time zone, and technical data used for approximate detection to suggest a configuration. The country is managed on the server, and the user can correct it through the available channels.
• Subscription and billing: plan, status, currency, amount, dates, payment identifiers, provider, receipts, and contact information. Payment gateways process full card details or other payment method data under their own policies; RuleX does not need to store the full card number.
• Work content: queries, conversations, case files, documents, audio, transcripts, projects, and results that the user chooses to upload, generate, or retain in RuleX. This content may include personal or sensitive data about third parties.
• Usage, security, and support: usage events, diagnostics, error logs, device information, and other technical data needed to operate the service, prevent abuse, investigate incidents, and respond to requests.

3. Purposes

We process information to:

• create, authenticate, maintain, and secure the account;
• provide the RuleX features requested by the user, including document and audio processing, queries, and generation of results;
• apply the profile country to pricing, payments, language, legal sources, and available capabilities;
• process subscriptions, payments, refunds, cancellations, and operational communications;
• provide support, fix errors, prevent fraud, and maintain security;
• comply with legal obligations, respond to requests from authorities, and retain evidence of transactions or authorizations; and
• measure how the site performs and improve the service using aggregated or technical information, without selling profiles of legal matters.

4. Legal content, AI, and confidentiality

Content the user submits to RuleX is processed to perform the requested function and, when the user retains it, to allow the user to access their own work. The AI providers used by RuleX are selected and configured under enterprise terms that do not use API inputs to train their models, in accordance with the applicable provider terms.

RuleX does not sell or rent matter content, or provide it to advertisers or data brokers. It may disclose information to, or permit its processing by, providers involved in delivering the service—for example, hosting, authentication, storage, email, payments, security, and AI processing providers—solely for the corresponding purposes and subject to confidentiality and security obligations. Any internal access is limited to what is necessary to operate, protect, or support the service.

5. Service Providers and International Transfers

To provide RuleX, we may use providers located in Colombia or other countries. This may involve international transmissions or transfers of data relating to infrastructure, authentication, storage, email, payments, fraud prevention, and AI services. The specific location may vary depending on the provider, country, plan, and technical availability.

besimpler S.A.S. will remain the contractual provider of RuleX and has no legal personality, branch, or establishment of its own in the other countries included in the multicountry registry. We will apply the contracts, security measures, and legal mechanisms appropriate to each operation and applicable law.

6. Retention, deletion, and controls

We retain each category of information for as long as necessary to provide the feature, maintain the account, comply with legal obligations, resolve disputes, prevent fraud, or evidence a transaction. Retention periods vary by data type: profile and billing records may be needed while the relationship exists and for the applicable legal periods; history, documents, projects, and transcripts are retained while the user or organization keeps them or until deletion is requested, subject to legal exceptions and backups.

Temporary technical files used during certain processes, such as the original audio for a transcript, are deleted in accordance with the operational workflow once they are no longer needed; the result the user has chosen to retain may remain in their history. The user can delete their history, documents, projects, or transcripts using the available features, or request assistance from soporte@rulex.org.

To delete the RuleX account and associated personal data, use the account deletion channel. Verification is performed by email or from an active session. Evidence of completed electronic signatures and financial records required by law are retained in accordance with this policy.

7. Rights and Procedure

Under applicable law, a data subject may request access, consultation, updating, rectification, proof of authorization, information about use, withdrawal of consent, or deletion where applicable, and may submit complaints regarding processing they consider improper. In Colombia, these rights are initially exercised with the controller or processor; after completing the corresponding procedure, the data subject may refer the matter to the data protection authority.

To submit a request, write to contact@besimpler.org and provide your name, account email address, country, specific request, and the information needed to verify your identity. Do not send confidential documents or third-party data that are not necessary to process the request through this channel.

8. Authorization upon account creation

By creating an account, the person declares that they have read this policy and the Terms and Conditions, accepts their terms, and authorizes the processing of their data for the stated purposes, to the extent permitted by applicable law. Optional fields are identified as such, and the service is not conditioned on providing unnecessary sensitive data. Where a law requires an additional statement or mechanism, it will be requested through the appropriate channel.

9. Cookies and similar technologies

RuleX does not use cookies to sell profiles or for personalized advertising. The authenticated platform uses storage and technical technologies needed to maintain the session, preferences, and security. The public site loads Google Analytics 4 to measure visits and performance; Google may process technical identifiers in accordance with its own policy. Users can limit these technologies through their browser, although some features may stop working properly.

10. Security, Minors, and Changes

We apply reasonable technical and organizational controls to protect information against loss, alteration, consultation, or unauthorized access. No service connected to the internet can eliminate risk entirely; if we identify a relevant incident, we will act in accordance with applicable law and our security procedures.

RuleX is intended for legal professionals and teams and is not designed for children or adolescents to create accounts on their own. If you believe a minor provided us with data without authorization, write to us so we can review it.

We may update this policy to reflect legal, operational, or product changes. We will publish the current version at /privacy with its update date. If the change materially affects how we handle information, we may communicate it through reasonable means.