1. Global Governance Framework, Controller Scope & Privacy Commitments

The RUMREN Unified Digital Ecosystem ("RUMREN", "We", "Us", "Our") is dedicated to maintaining the highest benchmarks of data privacy, operational transparency, and information security. This Privacy Policy sets forth our exact practices regarding the collection, processing, storage, and safeguarding of personal data when you access rumren.id, affiliated subdomains, APIs, bots, and mobile applications.

1.1 International Compliance Standard

This policy is constructed in alignment with internationally recognized data protection principles—including fair information practices, purpose limitation, data minimization, accuracy, and storage limitation. We apply unified enterprise-grade privacy safeguards globally to all Users without discrimination based on geographic origin.

1.2 Distinct Roles: Data Controller vs. Data Processor

In operating the Ecosystem, RUMREN fulfills two distinct operational capacities:
• Data Controller: RUMREN acts as the primary Data Controller for your master Single Sign-On (SSO) credentials, billing records, account settings, and platform telemetry logs.
• Data Processor: RUMREN acts as a Data Processor when storing and indexing user-generated inputs entered into productivity tools (such as financial records inside Monifi, custom links on RUMREN Bio, or personal favorited lyrics). The registered User remains the primary data controller for personal notes entered into these modules.

2. Exhaustive Categories of Personal Data Collected

We adhere strictly to the principle of data minimization, collecting only data points strictly necessary to deliver authenticated features, maintain server security, and prevent fraud.

2.1 User-Provided Registration & Profile Data

When creating a master RUMREN account, we collect: full legal or chosen username, verified email address, optional contact handle (such as Telegram ID), profile avatar image URL, and hashed password credentials. If accessing via third-party OAuth (e.g. Google SSO), we receive your verified email, display name, and avatar token from the identity provider.

2.2 Automated Technical & Network Telemetry

When interacting with our servers, our infrastructure automatically records technical request telemetry: Internet Protocol (IP) address, approximate geographic location (country/city level via IP lookup), browser type and version, operating system identifier, referring URL, HTTP response codes, API request payloads, and timestamps. This telemetry is strictly utilized for anti-DDoS filtering, bot mitigation, and load balancing.

2.3 Transactional & Virtual Utility Ledger Records

For Star top-ups or subscription activations, we record: payment transaction IDs, gateway settlement timestamps, amounts paid, virtual Stars balances credited, and invoice metadata. Notice: Sensitive payment credentials (such as primary card numbers, expiration dates, and CVVs) are processed exclusively by certified external payment processors and are never transmitted to, recorded, or stored on RUMREN servers.

3. Lawful Bases & Exact Processing Purposes

We process personal data solely where a legitimate, demonstrable legal basis exists. We never engage in secondary processing incompatible with these stated purposes.

3.1 Primary Operational Purposes

We utilize collected data to: (i) provision and synchronize your Single Sign-On credentials across all ecosystem modules, (ii) maintain real-time Stars balances and process utility features, (iii) enforce API rate limits and prevent automated crawling abuse, (iv) deliver essential transactional notifications (such as password reset links and security alerts), and (v) diagnose software bugs and optimize database query performance.

3.2 Absolute Prohibition on Data Commercialization & Ad Brokering

RUMREN does not sell, rent, trade, monetize, or broker personal user data. We do not transfer your personal information to third-party data brokers, behavioral advertising networks, or external profiling agencies. We generate zero revenue from the sale of user browsing profiles or telemetry.

4. Data Security Safeguards, Storage Protocols & Liability Boundaries

We implement rigorous technical and administrative security measures designed to shield personal data against unauthorized access, destruction, loss, or alteration.

4.1 Cryptographic Standards & Access Control

All data in transit is encrypted using modern Transport Layer Security (TLS 1.3/HTTPS). User passwords are cryptographically salted and hashed using industry-standard one-way algorithms (such as Argon2id or bcrypt); plaintext passwords are never stored in any database. Database access is restricted to verified system processes running behind isolated firewalls with multi-factor authentication.

4.2 Data Retention & Statutory Audit Periods

Personal data is retained only as long as your SSO account remains active. Upon voluntary account deletion, personal profile identifiers are purged or anonymized within thirty (30) days. However, financial transaction invoices, Stars top-up logs, and security audit records are retained for a minimum statutory period of five (5) years to fulfill corporate auditing, tax compliance, and anti-fraud verification obligations.

4.3 Inherent Internet Risks & Security Liability Disclaimer

While RUMREN maintains robust security controls, Users acknowledge that no method of electronic transmission over the Internet or digital storage architecture can guarantee 100% impenetrable security. RUMREN shall not be held liable for unauthorized data interception, zero-day vulnerabilities, or breaches resulting from circumstances beyond reasonable commercial control, including compromised User client devices or third-party telecommunications infrastructure failures.

5. Authorized Disclosures, Sub-Processors & Legal Process Compulsion

We do not disclose personal information to external entities except under strictly defined operational, technical, or legal imperatives.

5.1 Vetted Technical Sub-Processors

We share limited, strictly necessary data with trusted third-party technical vendors bound by strict confidentiality and data protection obligations: (i) cloud infrastructure and server hosting providers, (ii) CDN and anti-DDoS security mitigation networks (e.g. Cloudflare), and (iii) certified PCI-DSS payment gateways for transaction clearing. These sub-processors are contractually prohibited from using personal data for any purpose other than providing contracted technical infrastructure.

5.2 Compulsory Legal Process & Emergency Disclosures

RUMREN may disclose limited User information only when strictly compelled by a legally binding court order, valid subpoena, or formal warrant issued by a judicial body of competent jurisdiction, or where we reasonably determine that disclosure is urgently required to prevent imminent physical harm, suicide, or severe cyberattacks threatening core public infrastructure.

6. Global User Rights & Account Erasure Protocols

Users possess comprehensive rights regarding their personal data, subject to legitimate legal and security exceptions.

6.1 Right of Access, Rectification & Portability

Users have the right to inspect their personal profile records and modify inaccurate information at any time via the self-service RUMREN SSO Account Settings dashboard. Users may also request an export of their stored profile attributes by filing an official request with our support desk.

6.2 Right to Erasure & Deletion Constraints

Users may request the permanent deletion of their account. Upon verified request, RUMREN will decommission the account and purge active profile data. However, the right to erasure does not extend to: (i) financial transaction records required for tax and accounting audits, (ii) security logs necessary to defend against cyber threats or pending dispute claims, and (iii) aggregated, fully anonymized statistical data that cannot be linked back to an individual.

7. Cookie Policy, Local Storage & Session Authentication Tokens

RUMREN utilizes lightweight cookies and browser local storage mechanisms to deliver uninterrupted Single Sign-On and maintain responsive interface states.

7.1 Strictly Necessary Functional Cookies

Our platform requires essential authentication cookies (such as RUMREN_SIG, RUMREN_EMAIL, and session tokens) to verify your login state across subdomains and validate API requests. These cookies are strictly functional; disabling them in your browser will prevent access to authenticated portal areas and account management.

7.2 Client Preferences & UI State Storage

We employ browser LocalStorage to retain local display preferences, such as selected UI color themes, collapsed sidebar states, and audio volume levels. This data remains stored solely within your client browser and is never transmitted to external analytics trackers.

8. Security Breach Notification Protocols & Policy Amendments

We maintain rigorous protocols for incident response and ensure transparent communication regarding privacy policy revisions.

8.1 Rapid Incident Notification Commitment

In the highly unlikely event of a confirmed security incident or data breach that poses a significant risk to the rights and freedoms of Users, RUMREN commits to notifying affected Users and relevant regulatory supervisory bodies within seventy-two (72) hours of verified incident discovery, detailing the nature of the breach, affected data categories, and recommended remediation steps.

8.2 Official Privacy & Data Protection Channel

For inquiries regarding personal data processing, privacy rights execution, or security disclosures, Users may contact our designated compliance team through the official RUMREN Privacy & Compliance Desk.