Privacy Policy

Effective Date: January 1, 2026
Last Updated: August 18, 2026

1. Overview and Scope

I, operating the RinooSol platform as a solo project ("RinooSol", "Platform", "I", "my", or "me"), am committed to safeguarding the privacy and security of my users' personal data. This Privacy Policy sets out the principles and practices governing the collection, use, retention, disclosure, and protection of personal data when you access or use my website, managed hosting services, and customer portals (collectively, the "Services").

By accessing or using the Services, you acknowledge that you have read, understood, and agree to the data collection and processing practices described in this Policy.

1.1 Core Privacy Commitments

My data practices are governed by the following core principles:

No Sale of Personal Data: I do not sell, rent, lease, or trade personal data to advertisers, data brokers, or third parties under any circumstances.
No Marketing Exploitation: I do not share customer data with third parties for their promotional or marketing purposes.
Restricted Instance Access: Hosted instances, databases, workflows, and configuration environments are customer-isolated environments. I do not inspect, read, or process customer workflow data, database contents, or credentials, except under narrowly defined, documented operational or support requirements requested by you (§6.3).
No AI Model Training: I do not use customer data, workflows, or hosted application contents to train machine learning or artificial intelligence models.
No Behavioral Profiling: I do not track users across third-party properties or build commercial advertising profiles.
Data Portability and Deletion: Users retain full ownership of their data and may export or request complete deletion of their account and hosted assets at any time (§7).

2. Information We Collect

I collect only the categories of information necessary to deliver, maintain, secure, and bill for our hosting services.

2.1 Information Provided Directly by You

Account and Profile Information: Full name, email address, phone number (optional, used for customer service and WhatsApp support), company name or billing entity details, and country of residence.
Account Credentials: Username and password, stored exclusively using salted, one-way cryptographic hashing algorithms.
Billing and Transaction Records: Billing address, tax identification (where applicable), invoice records, payment transaction identifiers, and transaction history. Payment card processing is handled entirely by our PCI-DSS-compliant payment gateway (XPay); I do not collect or store full credit card numbers or security codes (CVV).
Communications and Support Records: Inquiries, support tickets, and correspondence submitted via email or official WhatsApp support channels.

2.2 Information Collected Automatically

When you interact with the Platform, my infrastructure automatically records technical and diagnostic data:

Usage and Operational Metrics: Pages accessed, session durations, resource consumption metrics (CPU and memory usage per container), uptime/downtime event logs, and API request frequencies.
Technical Device Identifiers: Internet Protocol (IP) address, approximate geographic location (city/country level), browser type and version, operating system, HTTP referrer headers, and user-agent strings.
System and Security Logs: Server access logs, timestamps, authentication attempt records, and container lifecycle events (deployments, restarts, and configuration updates).

2.3 Google OAuth and Authentication Data

Users may optionally authenticate and register via Google Single Sign-On (SSO). This authentication method is optional; traditional email and password registration remains available.

Scopes Requested: I request access strictly limited to basic identity profile scopes (openid, profile, email).
Data Received: Your full name, email address, and unique Google account identifier. While Google's authentication response may include a profile image URL, I do not store this image.
Restrictions: I do not request, access, read, or modify data from other Google services (including Gmail, Google Drive, Google Calendar, or Google Contacts). Google account data is used solely to authenticate your identity and populate your account record.
Revocation: You may revoke application access at any time via your Google Account Security Settings (https://myaccount.google.com/connections).

3. Purposes and Legal Basis for Processing

I process personal data strictly for the following legitimate business purposes:

3.1 Service Delivery and Infrastructure Management

Provisioning, deploying, configuring, and maintaining managed hosting instances.
Processing subscription payments, issuing tax-compliant invoices, and managing renewals.
Delivering direct technical support and customer assistance upon request.
Managing backup restoration and automated snapshot retention.
Enforcing resource limits and system stability quotas.

3.2 Security, Fraud Prevention, and Platform Integrity

Conducting system health monitoring, threat detection, and vulnerability audits.
Identifying and mitigating distributed denial-of-service (DDoS) attacks, brute-force attempts, and unauthorized access.
Troubleshooting infrastructure failures and debugging operational errors.

3.3 Administrative and Service Communications

Transmitting essential transactional notices (invoices, renewal alerts, authentication confirmations).
Delivering critical security bulletins, service disruption notices, and maintenance advisories.
Sending optional product updates or promotional announcements, from which you may opt out at any time.

3.4 Regulatory and Legal Compliance

Complying with applicable statutory accounting and tax obligations under Egyptian tax laws.
Responding to lawful court orders, subpoenas, or official administrative directives issued by competent authorities.
Enforcing my Terms of Service and protecting against unlawful activities (such as fraud, phishing, or abusive network activity).

4. Data Sharing and Third-Party Disclosures

4.1 Strict Non-Disclosure Policy

I do not sell, monetize, or disclose customer personal data. Our business model relies entirely on transparent subscription fees for managed hosting services.

4.2 Authorized Service Providers

I share data only with trusted third-party service providers bound by strict confidentiality and data protection obligations, and solely to the extent necessary to perform specific operational functions:

Payment Processing (XPay): Necessary billing metadata and transaction amounts are securely transmitted to XPay to execute payment processing in compliance with Central Bank of Egypt regulations and PCI-DSS standards.
Network Security and Content Delivery (Cloudflare): Technical connection data (including IP addresses) is routed through Cloudflare to provide DDoS mitigation, web application firewall (WAF) protection, and traffic encryption.
Email Delivery Services: Transactional email delivery providers to transmit account notices, receipts, and system alerts.
Software Vendors (Docker / n8n): Anonymous, aggregated diagnostic telemetry if enabled by the upstream open-source container image.

4.3 Legal Disclosures

I may disclose personal data to law enforcement or governmental authorities only where strictly required by applicable law, a valid subpoena, or a binding court order from a court of competent jurisdiction.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of platform assets, customer account information may be transferred to the acquiring entity. Customers will receive prior notification of any such change in control.

5. Data Retention and Deletion Schedules

5.1 Active Subscriptions

Account and Identification Records: Retained for the active duration of the customer relationship.
Financial and Billing Invoices: Retained for a minimum of seven (7) years in compliance with Egyptian statutory accounting and tax regulations.
System and Security Access Logs: Retained for a rolling period of 30 to 90 days, after which they are purged or anonymized.
Automated Instance Backups: Retained according to your subscription plan schedule (7 to 60 days) and automatically rotated.

5.2 Account Termination and Data Purging

Container and Instance Data: Maintained in a deactivated state for seven (7) days following cancellation or deletion to permit emergency recovery upon customer request, after which all volumes, databases, and persistent storage are permanently and irrevocably destroyed.
Automated Backups: Permanently deleted upon formal account termination.
Archival Records: Transactional records required for legal and tax compliance are retained in an anonymized archive.

6. Security Architecture and Confidentiality

6.1 Technical and Organizational Safeguards

I implement rigorous technical, operational, and organizational security controls designed to protect personal data against unauthorized access, destruction, loss, or alteration:

Data Encryption: Industry-standard AES-256 encryption for data at rest (storage volumes and databases) and TLS 1.3 encryption for all data in transit across public networks.
Network Defenses: Hardened firewalls, rate limiting, and enterprise DDoS protection via Cloudflare.
Access Controls: Principle of least privilege, strict administrative access auditing, and mandatory multi-factor authentication (MFA) on infrastructure access points.
Single-Operator Confidentiality: Direct individual administration minimizes internal access surfaces and eliminates third-party employee exposure risks.

6.2 Security Disclaimers

While we deploy robust security measures meeting current industry standards, no internet-connected infrastructure or electronic transmission can be guaranteed to be entirely infallible. Users remain responsible for maintaining the confidentiality of their account credentials and implementing secure network practices.

6.3 Policy on Host Access to Managed Customer Instances

Managed customer instances are private, isolated execution environments. I adhere to a strict non-interference policy:

Prohibition on Routine Inspection: I do not browse, inspect, monitor, or extract data from customer workflows, hosted database tables, stored files, or environment configurations.
Authorized Support Exceptions: Administrative access to a customer's instance occurs exclusively upon the customer's express written request (via email or official WhatsApp support) to diagnose or resolve a specific technical issue. Such access is limited strictly to the scope and duration necessary to resolve the reported problem.
Security and Abuse Mitigation: If an instance generates abusive network traffic (e.g., spam dispatch, malicious outbound attacks, or container compromise), I reserve the right to inspect technical logs and take administrative action solely to isolate and mitigate the security threat.
Audit Logging: All administrative interactions with client instances are recorded in persistent system audit trails (§11).

7. Data Subject Rights

In accordance with applicable data protection principles, customers possess the following rights regarding their personal data:

7.1 Right to Access and Portability

You may request a complete report of the personal data I hold about you, or request your account data in a structured, commonly used, and machine-readable format (CSV/JSON). Such requests should be directed to [email protected] and are processed within 30 days.

7.2 Right to Rectification and Erasure

Rectification: You may update inaccurate or incomplete profile details at any time via your account dashboard.
Erasure (Right to be Forgotten): You may submit a formal request to delete your account and associated personal data. Upon identity verification, I will deactivate the account and schedule all associated data for permanent destruction according to §5.2.

7.3 Marketing Opt-Out

You may unsubscribe from non-essential promotional communications at any time by following the unsubscribe mechanism contained in promotional emails or by notifying my support channels.

8. Children's Privacy

My Services are intended exclusively for commercial, business, and adult users aged 18 and older. I do not knowingly solicit or collect personal data from minors under the age of 18. If I obtain actual knowledge that personal data of a minor has been collected without verifiable parental consent, I will promptly purge such data from my systems.

9. Data Breach Notification Procedures

In the event of a confirmed security incident resulting in the unauthorized access, disclosure, or loss of customer personal data:

Notification Timeline: I will notify affected customers without undue delay and, where feasible, within 72 hours of confirming the breach.
Content of Notice: The notification will describe the nature of the incident, the categories of data impacted, the remedial measures implemented, and recommended actions for affected users.
Regulatory Reporting: I will notify relevant regulatory and data protection authorities in accordance with applicable legal requirements.

10. Third-Party Integrations and External Links

The Services may reference or interface with third-party platforms whose privacy practices operate independently from ours:

Google Services: https://policies.google.com/privacy
XPay Payment Gateway: https://xpay.app/privacy
Cloudflare Services: https://cloudflare.com/privacy
n8n Community Software: https://n8n.io/privacy

I encourage users to review the privacy policies of third-party platforms prior to enabling external integrations.

11. Accountability, Logging, and Auditing

To ensure institutional accountability and transparency:

I maintain a formal record of data processing activities.
Administrative access to underlying hosting infrastructure and container environments is permanently recorded in access audit logs.
Direct operational oversight ensures immediate accountability without bureaucratic intermediaries.

12. Modifications to this Privacy Policy

I reserve the right to revise this Privacy Policy periodically to reflect technological, operational, or legal developments. When material updates are made:

The "Last Updated" date at the top of this page will be revised accordingly.
Active subscribers will be notified via email or official system announcement at least fourteen (14) days prior to material changes taking effect.
Continued use of the Services following the effective date of an updated Privacy Policy constitutes acceptance of the revised terms.

13. Contact Information and Inquiries

For inquiries, privacy requests, or complaints regarding this Privacy Policy or my data handling practices, please contact:

Email Inquiries and Requests: [email protected]
WhatsApp Support Channel: +20 1559323980 (Messaging only)
Response Window: Standard privacy inquiries are addressed within 14 business days; formal data subject access requests are fulfilled within 30 calendar days.

14. Dispute Resolution

If you have concerns regarding my compliance with this Privacy Policy, I encourage you to contact me directly to seek an amicable resolution. Formal complaints submitted in writing to [email protected] will be reviewed thoroughly and addressed with a written findings report.

15. Entire Agreement

This Privacy Policy, together with my Terms of Service and Refund Policy, constitutes the complete and exclusive understanding between you and Rinoo regarding personal data privacy and security practices, superseding all prior oral or written representations.