Privacy Policy
Every factual statement on this page was checked against the live site and against ITRUL LLC's filed company record: what we collect, where it is hosted, who handles it and how long we keep it. The legal drafting is a developer's work, not an attorney's. Two judgement calls — the transfer mechanism in section 5 and the Article 27(2) exemption in section 1 — should be confirmed by counsel.
1. Who we are
ITRUL LLC, a limited liability company organised under the laws of North Carolina, United States (Secretary of State ID 3213041), operates this website and is the business responsible for the personal information described here (the "controller" under EU and UK law).
Contact: info@itrul.com. That address reaches us directly and is the fastest route for any request under this policy. If you need a postal address for a formal notice, ask and we will give you one.
We are based in the United States. If you contact us from the European Economic Area, the United Kingdom or Switzerland, this page explains the rights you have and how we handle the transfer.
We have not appointed a representative in the European Union. Article 27(2) of the GDPR excuses that appointment where the processing is occasional, involves no special categories of data on any scale, and is unlikely to put anyone's rights at risk. The only personal data we process is the message you choose to send us: there is no analytics, no tracking, no profiling and no special-category data anywhere on this site. Write to info@itrul.com and your request reaches us directly.
2. What we collect
This site is deliberately minimal. It runs no analytics, no advertising pixels, no social embeds and no third-party fonts. Three things reach us:
| Data | When | Why |
|---|---|---|
| Name, email, company website, your message, and whether you opted in to updates | Only when you submit the contact form | To read your enquiry and reply to it |
| Technical request data kept by our host: IP address, browser user agent, requested page, timestamp | Automatically, for every visitor, as with any web server | Delivering the site, security, and diagnosing faults |
| Your privacy choice, stored in your own browser | Only once there is something to consent to, and only after you choose | So we do not ask you again on every page |
We do not ask for, and do not want, sensitive categories of personal information. Please do not put confidential material into the contact form — send it once we have an agreement in place.
3. Why we are allowed to use it (EU / UK legal bases)
- Your consent — the contact form. You tick the box yourself; it is never pre-ticked. You may withdraw consent at any time by emailing us, and that does not affect anything done before you withdrew it.
- Our legitimate interests — keeping server logs so the site stays available and secure, and answering a business enquiry you sent us.
- Separate consent — optional product updates. That checkbox is separate from the contact one and is never a condition of getting a reply.
4. Who else sees it
We do not sell personal information and we do not share it for cross-context behavioural advertising. We use a small number of service providers who process data on our instructions only:
- Cloudflare, Inc. (United States) — all traffic to this site passes through their network. They see every visitor's IP address and terminate the encrypted connection. They do not receive the contents of the contact form beyond carrying it in transit.
- Our own server, located in the United States — serves the website and keeps request logs. It is operated by us, not rented from a cloud provider.
- No third party receives the contact form. It is posted to an endpoint on our own server, which forwards it by email and stores nothing on disk.
- Our mailbox at mail.signis.top — receives the enquiry and holds our business mail. The mail server is ours and is administered by us. The machine it runs on is rented from netcup GmbH, Karlsruhe, Germany, and stands physically in the United States.
We may also disclose information where the law requires it, or to establish or defend a legal claim.
5. International transfers
Everything in this section happens in the United States. Our web server stands in the United States, our mailbox stands in the United States, and Cloudflare is a United States company. Nothing you send us is stored in the EEA, the UK or Switzerland.
When you fill in our contact form, you send your details to us directly and on your own initiative. Under the European Data Protection Board's Guidelines 05/2021, a disclosure made that way is not a "transfer" in the sense of Chapter V of the GDPR, because no controller or processor in the EEA sends the data to us — you do. The safeguards that Chapter V requires for transfers therefore do not attach to that step.
That position covers the form itself. For anything we pass on afterwards to the providers named in section 4, we rely on Standard Contractual Clauses or the EU–US Data Privacy Framework, together with the measures described in section 7. Your rights under this policy apply either way.
6. How long we keep it
- Enquiries that do not become projects: 24 months, then deleted.
- Enquiries that become projects: kept for the life of the engagement and for as long as the law requires us to keep business records afterwards.
- Server logs: rotated by size rather than by date — the container keeps three files of 10 MB each and discards the oldest. How many days that covers depends on traffic.
- Your privacy choice: stored in your browser until you clear it, or for 12 months.
7. Security
The site is served over HTTPS. Access to the mailbox and the form endpoint is limited to the people who need it and protected by multi-factor authentication. No system is perfect, and we do not claim otherwise.
8. Your rights in the EEA, the UK and Switzerland
You can ask us to: give you a copy of your personal data; correct it; delete it; restrict how we use it; port it to someone else; or object to our use of it where we rely on legitimate interests. You can withdraw consent at any time.
Write to info@itrul.com. We answer within one month. You also have the right to complain to your national data protection authority — in the UK, the Information Commissioner's Office.
9. Your rights in the United States
Depending on where you live, state privacy law may give you rights over your personal information. This includes California (CCPA as amended by the CPRA) and states such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana.
What we do and do not do
- We do not sell personal information.
- We do not share it for cross-context behavioural advertising.
- We do not profile you or make automated decisions with legal effects.
- We collect only the categories listed in section 2, for the purposes listed there.
How to exercise a right
You may ask us to tell you what we hold, to delete it, or to correct it. Email info@itrul.com with the request. We verify you by replying to the address we already hold, and we will not treat you differently for asking.
Global Privacy Control
If your browser sends a Global Privacy Control signal, this site treats it as an opt-out of any non-essential storage and records that choice without asking you again.
Authorised agents
You may use an authorised agent to make a request on your behalf; we will ask for proof of their authority.
10. Children
This is a business-to-business site. It is not directed to children under 13 and we do not knowingly collect their personal information. If you believe a child has sent us something, email us and we will delete it.
11. Changes
If we change this policy we will update the date at the top. If a change is significant — for example if we begin using analytics — we will ask for your consent again before anything non-essential runs.
12. Contact
Questions about this page or about your data: info@itrul.com.
← Back to itrul.com