Privacy policy

Version 1 · 25 October 2026

This policy explains which personal data Rulicare processes, why, and what rights you have. It covers the website rulicare.com and the app at app.rulicare.com.

Who we are

Rulicare is run by DsUniSoft v/ Daniel Lang Sørensen, a company registered in Denmark.

Company reg. no. (CVR): 44849739

Address: Dyssevej 53, 4683 Rønnede, Denmark

Email: daniel@rulicare.com

Write to us if you have questions about this policy or want to use your rights.

Two roles: controller and processor

We have two different roles, depending on whose data it is.

We are the controller for data about visitors to rulicare.com, people who write to us, our customers' contact persons and billing details, and our own users of the owner panel (Rulicare owners and sellers).

We are a processor for the data a workplace (our customer) puts into the app about its employees and temps: names, email addresses, shifts, rotations, requests, absence and the like. The workplace is the controller and decides what the data is used for. We only process it on the workplace's instructions and under a data processing agreement. If you are an employee with questions about your data in the app, please contact your workplace first. We help the workplace answer you.

Data we are the controller for

Visiting rulicare.com

The website has no contact form, no analytics or tracking tools and no ads. When you visit it, our hosting provider Cloudflare receives your IP address and technical details about your browser, because that is needed to deliver the page and protect it against attacks. We do not use this to identify you.

Legal basis: our legitimate interest in running a secure website (GDPR Article 6(1)(f)).

When you write to us

If you email us, for example to get a demo or a quote, we process your name, email address, workplace and what you write. We only use it to answer you and follow up on your enquiry.

Legal basis: our legitimate interest in answering enquiries and, if it leads to an agreement, preparing that agreement (Article 6(1)(b) and (f)).

Retention: enquiries that do not lead to an agreement are deleted no later than 24 months after the last contact.

Customers: contact persons and billing

When a workplace becomes a customer, we process the name, email address and phone number of contact persons and the first manager, as well as the company name, address, company or VAT number, invoices and payments. Payments are handled by Stripe. We never see or store card numbers.

Legal basis: performing the agreement with the customer (Article 6(1)(b)), our legitimate interest in staying in contact with the customer's staff (Article 6(1)(f)) and our legal obligation to keep accounting records (Article 6(1)(c)).

Retention: contact details for as long as the customer relationship lasts and up to 12 months after. Invoices and other accounting records for as long as bookkeeping law requires (in Denmark, 5 years after the end of the financial year).

Users of the owner panel

For Rulicare's own owners and sellers we store name, email address, login (the password is only stored as a secure hash), two-factor login and a log of what they have done, including support access to customers.

Legal basis: our legitimate interest in controlling access to the system and documenting who did what (Article 6(1)(f)).

Security in the app

To protect logins against guessing, we count failed attempts per email address and per IP address. The counters are deleted automatically after one day. Technical errors are kept in an error log for 30 days, and operational logs at Cloudflare are kept for 7 days. We do not log names, passwords, notes or absence in operational logs.

Legal basis: our legitimate interest in keeping the service secure and running (Article 6(1)(f)). Where the data concerns a customer's employees, this is also part of what we do for the customer as a processor.

Data in the app that we process for the workplace

The app stores what the workplace and the employees themselves enter: name, email address, phone number (optional), role and language, login (the password is only stored as a secure hash), shifts and rotations, requests to swap, take time off or take open shifts with comments, absence with the manager's note, a history of changes, notifications and a private calendar link. The app must not be used for data about residents or clients or for national ID numbers.

The workplace decides how long data is kept and approves its retention periods in the app under Settings → Data and security → Retention and deletion. A manager can delete an employee's personal data under Staff → select the person → Delete personal data. Automatic deletion after the approved periods is being developed and will be in place before the service goes live for the customer.

The details of the relationship between the workplace and us are set out in the data processing agreement, which the workplace receives before starting.

Who we share data with

We never sell data and never share it with advertisers. We use these providers:

• Cloudflare (Cloudflare, Inc.) runs the website, the app and the database. The database is created with EU jurisdiction, so data is stored in the EU. Backups are kept for up to 30 days.
• Simply.com sends email from the app, such as invitations, password resets and notifications the recipient has switched on.
• Push services of the browser or phone in use (for example Google, Apple or Mozilla) deliver notifications to phones that have allowed them.
• Stripe (Stripe Payments Europe, Ltd.) creates and collects invoices to our customers. Stripe only receives the customer's billing details, not employee data from the app.

We may also be required by law to hand over data to public authorities.

Transfers outside the EU/EEA

Our data is stored in the EU. Cloudflare and Stripe belong to groups headquartered in the United States, and support or operations may in some cases take place from there. Such transfers are based on the European Commission's decision on the EU-U.S. Data Privacy Framework and/or the European Commission's standard contractual clauses. Write to us if you would like a copy.

Cookies

We only use cookies and local storage that the app needs in order to work. The website uses no cookies. Read more in our cookie notice.

Your rights

You have the right to access the data we process about you and to have incorrect data corrected. You may also have the right to have data erased, to restrict processing, to receive your data in a common format (data portability) and to object to processing based on our legitimate interest.

Write to daniel@rulicare.com. We reply within one month. If your request concerns data we process for your workplace, we forward it to the workplace and help them answer.

Complaints

You can complain to the Danish Data Protection Agency (Datatilsynet), which supervises us: Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk. You can also complain to the supervisory authority in the EU country where you live or work. We would like to hear from you first, so we can try to resolve it.

Changes

We update this policy when we change how we process data. The date at the top shows the latest version. We notify customers of significant changes by email.