Privacy Policy

1. Controller and pre-launch status

ReguFile is currently a pre-launch project operating in sandbox mode. Formal seller/controller business details will be published before live sales are enabled. Privacy questions can already be sent to info@regufile.com.

2. Data we process

Depending on how you use the service, ReguFile may process your email address; company, product, model and security-contact details; CRA assessment answers; generated Product Pack content; purchase identifiers and payment status; authentication/session data; and limited technical/security logs needed to operate and protect the service.

ReguFile does not receive or store your full payment-card details. Payment details are handled by the payment provider.

3. Purposes and legal bases

We process data to provide the assessment and document-generation service, deliver and recover purchases, authenticate users, send transactional emails, maintain security, diagnose failures and meet accounting or legal obligations. Where live paid services are offered, core purchase processing is necessary to perform the contract. Security and limited operational analytics may be based on legitimate interests. Legal records may be retained to meet statutory obligations. Marketing will not be sent without an appropriate legal basis.

4. Service providers

ReguFile currently uses third-party providers for hosting/deployment, database and authentication, payment processing and transactional email. These may include Vercel, Supabase, Stripe and Resend. Providers process data under their own security and privacy terms and, where required, under data-processing arrangements.

5. International transfers

Some service providers may process data outside the European Economic Area. Where GDPR transfer rules apply, ReguFile will rely on an applicable transfer mechanism or safeguard provided by the relevant service provider.

6. Retention

Assessment and Product Pack data are retained for as long as reasonably necessary to provide purchase recovery and account functionality, unless deletion is requested and no overriding legal obligation requires retention. Financial and transaction records may need to be kept for the applicable statutory accounting period; Dutch business administration records are generally retained for seven years. Security and operational logs are retained only as long as reasonably necessary for security, troubleshooting and abuse prevention.

7. Your rights

Subject to the GDPR and applicable law, you may have rights to access, correct, erase or restrict personal data, object to certain processing, receive portable data, and complain to a supervisory authority. Some information may need to be retained where a legal obligation applies.

8. Cookies and local storage

ReguFile uses browser storage and authentication/session technology needed to run assessments, recover purchases and keep users signed in. ReguFile does not currently use advertising pixels. If optional tracking or non-essential analytics are introduced, the consent setup and this policy will be updated where required.

9. Security

ReguFile uses access controls, authenticated purchase recovery, row-level database security and third-party infrastructure security features. No internet service can guarantee absolute security, so users should avoid submitting unnecessary confidential or special-category personal data.

10. Changes

This policy may be updated when the service, providers or legal requirements change. The current revision date is shown above.

11. Contact

Privacy requests: info@regufile.com.