Privacy notice

Last updated: September 19, 2026. This notice covers the Rullst LMS showcase at lms.rullst.win. The Academy and other linked services have their own notices.

Who is responsible?

Rullst operates this showcase. For privacy questions, access, correction, export or deletion requests, contact officialrullst@gmail.com. Include the site and the account concerned, but never send your password or sensitive documents with your initial request.

A public demonstration

Use the shared demo account and fictional information only. Its learning activity is shared with other visitors. Public demo access to Nexus and Studio is restricted to a read-only catalog preview. New personal accounts are disabled in public showcase mode. This demonstration is intended for developers evaluating the framework; it is not a children's learning account service. The separate Rullst Academy offers the actual learning experience. Please do not submit children's personal information here; parents or guardians can contact us to request removal.

Information and purposes

• Session and anti-forgery cookies support sign-in and protect forms.
• Learning interactions may store enrollments, lesson progress, quiz or activity attempts, submissions and certificates under the account used. Existing individual accounts may contain a name, email and password hash.
• Requests necessarily expose technical information such as IP address, user agent, time and requested route to our hosting infrastructure. Security and operational logs may record request metadata.
• Copilot receives the message you submit. The default response is generated locally without contacting an external AI provider. Only if you select the optional cloud checkbox is that message sent to the configured Groq service; account records and learning history are not included. Avoid personal or confidential information. The chat handler does not save conversation history to the LMS database.

Essential processing supports providing the requested service and protecting its security. Where applicable under GDPR or LGPD, this uses performance of a contract or legitimate interests, subject to the required assessment. Optional cloud requests, embedded videos and offline assets use your affirmative choice. You can stop future cloud requests by unchecking the box, unload a video, or disable offline assets in privacy choices.

Sharing and international processing

Hosting uses Microsoft Azure as configured by the operator. Groq receives opted-in cloud messages; YouTube receives connection and playback data only after you choose to load a video. External community links contact their respective services when followed. Providers may process information outside your country, under their own notices and applicable transfer safeguards. See Groq privacy, Microsoft privacy and Google privacy.

Storage and retention

Session cookies expire after the framework's session lifetime (up to 30 days); sign-out clears the browser session cookie. Anti-forgery cookies are session cookies (subject to browser session restore settings). Optional static asset caches remain until disabled or cleared. Learning records persist in the configured database until removed by the operator or an applicable privacy workflow. This showcase does not promise an automatic deletion schedule. Provider logs and backups follow the operator's deployment settings; contact us for the applicable retention period or a deletion request. Necessary records may be retained for security, legal obligations or resolving disputes.

Your choices and rights

Depending on your location and applicable law, you may request confirmation and access, correction, deletion, portability, restriction or objection, withdraw consent, use an authorized agent where permitted, or complain to the relevant regulator. These include rights under Brazil's LGPD, EU/UK GDPR and applicable US state laws such as California's CCPA/CPRA. Other national rights apply where relevant; requests are not limited to these regions. We may need proportionate verification before disclosing or changing private account data, and respond within the applicable legal period. Withdrawal does not undo prior lawful processing. We do not add advertising trackers, sell personal information or share it for cross-context behavioral advertising in this showcase. No such processing is activated when Global Privacy Control is sent.

This implementation provides privacy controls and information; it is not a certification of compliance with every law worldwide. Deployment, contracts, retention, request handling and any service for children require an operational and legal assessment.