Compliance playbook

The rules every Rang & Mall product is built against: what is lawful, what is honest, and what must be true before a change ships.

Markdown

The single compliance source of truth for every product Rang & Mall Private Limited builds: the RM Orbit suite, RM Portfolio, RM External, and the standalone apps. It exists so that any engineer or AI coding tool can build or fix an RM app and land on the right side of the law by default, without re-deriving the rules each time.

Apps46in the register

Domain modules16M1 to M16

Red lines10never crossed

Gate checks12on every change

Reviewed2026-08-21last full review

How to use this with an AI tool

Paste PROMPT.md into the tool's system prompt or CLAUDE.md, or tell it to fetch https://compliance.freedomlabs.in/PROMPT.md before it starts. The prompt carries the universal rules and tells the tool which playbook page to open for the app it is touching. Agents can fetch /llms.txt for an index and /apps.json for the machine-readable app register.

What this is and is not#

It is engineering guidance written to be obeyed by code: concrete defaults, checklists, red lines, and copy rules.
It is not legal advice. Where a point needs a lawyer, an accountant, or a regulator, it is marked counsel. Where a law or date may have changed since the last review, it is marked verify.
Reviewed 2026-08-21 against the live portfolio and the law as known to the author at that date. Law moves; the open questions page lists the items that must be re-checked on a schedule.

The operating facts everything else depends on#

Fact	Value	Why it matters
Legal entity	Rang & Mall Private Limited, CIN U47912AP2026PTC123400, incorporated 13 January 2026, Visakhapatnam, Andhra Pradesh	Indian company law, GST (state code 37), income tax, FEMA all attach here
Where the servers are	India (owned hardware, Cloudflare Tunnel in front)	Every foreign user's data is a cross-border transfer INTO India. India has no EU or UK adequacy decision, so UK and EU data need contractual transfer tools
Who the users are	Anyone, worldwide, self-selected country at signup	Obligations are decided by the user's location, not ours. Country selection must drive behaviour
Where the paying customers are	Scribe and AIBookly: mostly US and UK. Digitailor: US first, India parked. Tulip, isdwell, MyJanata, Nimitra, RM Bills: India. Dwell, Rollout, CoParent: US	US federal + state law, UK GDPR + PECR + Online Safety Act, Indian DPDP + IT Act + consumer law all apply at once
AI posture	Local Ollama by default (data never leaves the box). Cloud LLM exceptions: Scribe, Research, Merit, AIBookly managed mode, Imprint, Nimitra (Gemini)	Cloud exceptions need provider DPAs, no-training terms, disclosure, and data minimisation
Outbound mail	Resend, rmmail.in only, 100/day free tier, shared by all apps	Deliverability and anti-spam law (CAN-SPAM, PECR, DPDP consent) attach to every send

How the playbook is organised#

The PromptCompact rules for any coding agent. Copy and paste. 01 JurisdictionsIndia, US, UK, EU: which law bites, when, and what the country selector must do. 02 Universal baselineNon-negotiables for every app: privacy, security, AI, comms, payments, content, accessibility. 03 Domain modulesHealth, children and education, legal and immigration, money, communications, music and media, e-signature, hiring, hosting, social automation, astrology, research, government, housing. 04 App registerEvery RM app: data classes, regimes, red flags, must-do list. Ordered by risk. 05 Ship gateThe checklist a change must pass before deploy, plus change-triggered checks. 06 Incident runbookBreach clocks by regime (6 hours CERT-In, 72 hours UK and DPDP, 60 days FTC) and what to do in the first hour. 07 TemplatesCopy blocks: AI disclosure, recording consent, grievance page, security.txt, retention schedule, DPA clause list. 08 Open questionsCounsel items, verify-by dates, and the things we do not know yet.

Severity language used throughout#

Red line: never do this. A PR that crosses one is rejected regardless of who asked.
Must: required before an app is exposed to real users of the affected kind.
Should: required before an app charges money or takes enterprise customers.
Counsel: a human decision by a lawyer, CA, or regulator is needed; build the safe default meanwhile.
Verify: a fact that may have changed after 2026-08-21. Check before relying on it in customer-facing copy.

Where the source lives#

RM Orbit/Compliance/playbook/*.md is the source. build.py renders the site, serve.py serves it on port 45037, and the systemd user unit rm-compliance keeps it up at https://compliance.freedomlabs.in. Edit markdown, restart the unit (it rebuilds on start). Keep the REVIEWED file current when you do a real review, not on every typo.