Privacy Policy

1. Overview

Coilinx LLC ("Coilinx," "we," "us," or "our") operates SpoolRule, an inventory management platform delivered through our website at spoolrule.com, our mobile applications for iOS and Android, connected hardware such as Bluetooth scales, APIs, support channels, and related services (collectively, the "Services").

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit our website, create an account, use our applications, purchase a subscription or hardware, use AI-assisted features, connect hardware, use integrations, or otherwise interact with us.

SpoolRule is designed for business and professional use. When we process inventory, operational, and user data submitted by a customer organization, we generally act as a service provider or processor for that organization. For account administration, billing, security, product operations, marketing, and website interactions, we may act as a business or controller under applicable privacy laws.

2. Information We Collect

We collect information in the following categories:

Account and identity information

When you register, sign in, or are invited to an organization, we collect information such as your name, work email address, role, company affiliation, authentication identifiers, account status, and related credentials or tokens. Authentication is handled through our identity provider, Auth0.

Organization and billing information

If you create or manage a company account, we collect organization details such as company name, phone number, address or operating region, warehouse or location count, subscription plan, seat count, billing contact information, invoice history, tax information, and order records. Payment card and billing details are processed by Stripe; we do not store full payment card numbers on our servers.

Inventory and operational data

To provide the Services, we process inventory and operational records that you or your organization submit, including warehouses, material types, inventory items, weights, lengths, quantities, labels, barcodes, QR codes, NFC tag payloads, check-out and return history, transfers, usage records, reports, exports, audit logs, and related metadata.

Device and hardware information

If you connect SpoolRule-compatible hardware, we may collect device identifiers, pairing status, connection events, firmware or controller information, serial numbers, diagnostic data, and operational telemetry needed to support connected scales and related equipment.

Mobile app permissions and sensor data

Depending on how you use the mobile app, we may process:

• Camera data to scan QR codes and barcodes. Images are used for scanning and are not stored as photo galleries unless required for a specific feature you choose to use.
• NFC data to read or write inventory tag payloads.
• Bluetooth data to discover and connect to supported scales and nearby devices.
• Location-related signals where required by your device operating system to enable Bluetooth scanning, especially on Android. We do not use these signals to track your precise physical movements unless a feature expressly states otherwise.

AI and support interactions

If you use in-app help, reporting assistance, or other AI-assisted features, we collect the prompts, questions, files or context you submit, generated responses, feedback, and related context from your authorized inventory data needed to generate a response. We may retain conversation history associated with your account to provide support, maintain continuity, improve product quality, investigate abuse, and comply with legal obligations.

API and integration data

If you use our public API, webhooks, or integrations, we collect API credentials, webhook configuration, request and response metadata, delivery logs, integration settings, and the data necessary to deliver integration functionality.

Communications and marketing inquiries

If you request a demo, contact sales, subscribe to updates, respond to a survey, or otherwise communicate with us, we collect the information you provide, such as your name, email address, company, phone number, message content, and communication preferences. Demo and contact forms use HubSpot for lead management and hCaptcha for abuse prevention.

Technical and usage information

We automatically collect certain technical information, including IP address, browser or app version, device type, operating system, log data, timestamps, pages or screens viewed, referring URLs, feature usage, error reports, crash data, performance data, and security events.

Cookies and similar technologies

We and our service providers may use cookies, local storage, SDKs, pixels, and similar technologies to keep you signed in, remember preferences, protect the Services, measure website and app performance, understand product usage, prevent fraud, and support marketing or attribution. You can manage cookies through your browser or device settings, but some Services may not function properly if essential cookies or storage are disabled.

Sensitive personal information

Some information we process may be considered sensitive under certain laws, such as account login credentials, payment-related information handled by Stripe, precise location signals if required by a device permission, contents of communications with us, or data revealing access to a company account. We use sensitive personal information only for purposes allowed by law, such as providing the Services, securing accounts, processing payments, supporting users, and complying with legal obligations.

3. Sources of Information

We collect personal information from the following sources:

• You, when you create an account, use the Services, place an order, or contact us
• Your organization, administrators, and other authorized users
• Connected devices, mobile apps, browsers, APIs, and integrations you configure
• Service providers such as Auth0, Stripe, HubSpot, hCaptcha, Expo, and hosting vendors
• Public or business sources where reasonably necessary for sales, support, compliance, or security

4. How We Use Information

We use personal information to:

• Provide, operate, maintain, secure, and improve the Services
• Create and manage accounts, organizations, roles, permissions, and access controls
• Process subscriptions, invoices, taxes, hardware purchases, shipping, returns, and support
• Support inventory tracking, reporting, exports, device connectivity, APIs, and integrations
• Provide AI-assisted help, reporting summaries, product guidance, and related support
• Respond to support requests, sales inquiries, demos, and other communications
• Send administrative messages, security alerts, billing notices, renewal notices, and service-related notices
• Send marketing communications where permitted and honor communication preferences
• Monitor, prevent, detect, and investigate fraud, abuse, security incidents, and policy violations
• Comply with law, enforce our terms, resolve disputes, and protect our rights and users
• Analyze usage trends to improve reliability, performance, accessibility, and product design

We do not use Customer Data, inventory data, prompts, or AI conversation history to train public or third-party foundation models unless you expressly authorize that use in a separate written agreement or product setting. AI-assisted features are provided to help authorized users within the scope of their account, and outputs should be reviewed for accuracy before being used for operational or business decisions.

5. Legal Bases for Processing

Where applicable law requires a legal basis, we process personal information based on one or more of the following:

• Contract performance to provide the Services you or your organization request
• Legitimate interests such as securing the Services, improving product quality, supporting customers, preventing misuse, and running business operations, balanced against your rights
• Consent where required, such as for certain optional communications, device permissions, cookies, or processing of sensitive data
• Legal obligations such as tax, accounting, export, sanctions, and regulatory requirements

6. How We Disclose Information

We may disclose personal information with:

• Service providers and processors that help us operate the Services, including Auth0 (authentication), Stripe (payments and billing), Amazon Web Services (hosting and infrastructure), HubSpot (form processing and CRM), hCaptcha (bot protection), Expo (mobile application delivery and over-the-air updates), analytics or logging providers, customer support providers, email delivery providers, and AI infrastructure or model providers used to deliver AI-assisted features
• Your organization administrators and authorized users when you use SpoolRule under a company account, including account activity, inventory records, reports, permissions, and user profile information visible within that organization
• Integration partners when you or your organization configure API access, webhooks, exports, or third-party integrations
• Professional advisors such as lawyers, accountants, auditors, or insurers where reasonably necessary
• Authorities or other parties when required by law, subpoena, court order, legal process, or to protect rights, safety, security, and integrity
• Successors in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to appropriate protections

We do not sell personal information for money. We do not knowingly sell or share personal information of children under 16. If we use advertising or analytics technologies that are considered a "sale," "sharing," or targeted advertising under applicable law, you may opt out as described below.

7. Data Retention

We retain personal information for as long as necessary to provide the Services, fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the nature of the information, account status, subscription history, backup schedules, security needs, and legal requirements.

• Account, organization, and Customer Data are generally retained while the account is active.
• Billing, tax, invoice, and transaction records are retained as required for accounting and legal compliance.
• Security logs, device events, API logs, and diagnostic records are retained for a reasonable period to protect the Services and investigate issues.
• Support, sales, and AI conversation records are retained as needed to provide support, improve quality, and maintain business records.
• Backups may persist for a limited period after deletion before being overwritten in the ordinary course.

You may request deletion as described below, subject to limitations for active accounts, organization-controlled data, legal holds, security needs, and legitimate business records.

8. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, encryption in transit, vendor controls, monitoring, and infrastructure hosted in reputable cloud environments. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining strong credentials, limiting access to authorized users, and promptly notifying us of suspected unauthorized access.

9. Your Privacy Rights and Choices

Depending on where you live, you may have rights to access, know, correct, delete, restrict, object to, or receive a portable copy of certain personal information. You may also have the right to opt out of certain processing, withdraw consent, limit certain uses of sensitive personal information, or appeal our decision regarding a privacy request.

You can update certain account information through the Services. Organization users should contact their company administrator for role, access, or organization-controlled data changes. To make a privacy request, appeal a decision, or designate an authorized agent, email us at privacy@spoolrule.com. We may need to verify your identity and authority before fulfilling a request.

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA), as amended, including the right to know what personal information we collect, use, disclose, sell, or share; the right to access and receive a copy of personal information; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of sale or sharing; the right to limit certain uses of sensitive personal information; and the right not to be discriminated against for exercising privacy rights.

If you are a resident of a state with a comprehensive privacy law, such as Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia, or another applicable state, you may have similar rights, including the right to opt out of targeted advertising, sale of personal data, or certain profiling, depending on the law and whether it applies to us.

If a legally recognized browser-based opt-out preference signal, such as Global Privacy Control, applies to our processing, we will honor it as required by applicable law. You may also opt out of marketing emails by using the unsubscribe link in the message or contacting us.

If you are in the European Economic Area, United Kingdom, or Switzerland, you may also have the right to lodge a complaint with your local supervisory authority.

10. State Privacy Disclosures

For purposes of state privacy laws, the categories of personal information we collect may include identifiers, commercial information, internet or electronic network activity, geolocation-related information where enabled or required by device permissions, professional or employment-related information, inferences, sensitive personal information, and other information you provide or that is reasonably linked to you, your device, or your organization.

We collect these categories from the sources described above, use them for the business and commercial purposes described above, and disclose them to the categories of recipients described above. We retain them according to the criteria described in the Data Retention section.

We do not knowingly sell personal information for money. We also do not use or disclose sensitive personal information for purposes that would require a right to limit under the CCPA unless we provide the required notice and choice. If our use of analytics, advertising, or similar technologies is considered a sale, sharing, or targeted advertising under applicable law, you may opt out by contacting us or using any opt-out mechanism we make available.

Coilinx is not a data broker because we do not knowingly collect and sell to third parties the personal information of consumers with whom we do not have a direct relationship. If that changes, we will update this policy and comply with applicable registration and deletion-platform requirements.

11. International Transfers

SpoolRule is operated from the United States. If you access the Services from outside the United States, your information may be transferred to, stored in, and processed in the United States and other countries where we or our service providers operate. Where required by law, we use appropriate safeguards for cross-border transfers, such as contractual protections or other lawful transfer mechanisms.

12. Children's Privacy

The Services are intended for business and professional use and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

13. Third-Party Links and Services

The Services may link to third-party websites, app stores, integrations, hardware providers, payment processors, or other services that are not controlled by Coilinx. Their privacy practices are governed by their own policies. We encourage you to review the privacy policies of any third-party services you use.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy on this page and update the effective date. Where required by law, we will provide additional notice or request consent. Your continued use of the Services after the effective date of an updated policy constitutes acceptance of the changes, except where further consent is required by law.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

Coilinx LLC
Email: privacy@spoolrule.com
Website: spoolrule.com/contact-us