# RM Compliance Playbook

The single compliance source of truth for every product Rang & Mall Private Limited builds: the RM Orbit suite, RM Portfolio, RM External, and the standalone apps. It exists so that any engineer or AI coding tool can build or fix an RM app and land on the right side of the law by default, without re-deriving the rules each time.

!!! note "How to use this with an AI tool"
    Paste [PROMPT.md](/PROMPT.md) into the tool's system prompt or CLAUDE.md, or tell it to fetch `https://compliance.freedomlabs.in/PROMPT.md` before it starts. The prompt carries the universal rules and tells the tool which playbook page to open for the app it is touching. Agents can fetch `/llms.txt` for an index and `/apps.json` for the machine-readable app register.

## What this is and is not

- It is engineering guidance written to be obeyed by code: concrete defaults, checklists, red lines, and copy rules.
- It is not legal advice. Where a point needs a lawyer, an accountant, or a regulator, it is marked **counsel**. Where a law or date may have changed since the last review, it is marked **verify**.
- Reviewed 2026-08-21 against the live portfolio and the law as known to the author at that date. Law moves; the [open questions page](/playbook/08-open-questions) lists the items that must be re-checked on a schedule.

## The operating facts everything else depends on

| Fact | Value | Why it matters |
| --- | --- | --- |
| Legal entity | Rang & Mall Private Limited, CIN U47912AP2026PTC123400, incorporated 13 January 2026, Visakhapatnam, Andhra Pradesh | Indian company law, GST (state code 37), income tax, FEMA all attach here |
| Where the servers are | India (owned hardware, Cloudflare Tunnel in front) | Every foreign user's data is a cross-border transfer INTO India. India has no EU or UK adequacy decision, so UK and EU data need contractual transfer tools |
| Who the users are | Anyone, worldwide, self-selected country at signup | Obligations are decided by the user's location, not ours. Country selection must drive behaviour |
| Where the paying customers are | Scribe and AIBookly: mostly US and UK. Digitailor: US first, India parked. Tulip, isdwell, MyJanata, Nimitra, RM Bills: India. Dwell, Rollout, CoParent: US | US federal + state law, UK GDPR + PECR + Online Safety Act, Indian DPDP + IT Act + consumer law all apply at once |
| AI posture | Local Ollama by default (data never leaves the box). Cloud LLM exceptions: Scribe, Research, Merit, AIBookly managed mode, Imprint, Nimitra (Gemini) | Cloud exceptions need provider DPAs, no-training terms, disclosure, and data minimisation |
| Outbound mail | Resend, rmmail.in only, 100/day free tier, shared by all apps | Deliverability and anti-spam law (CAN-SPAM, PECR, DPDP consent) attach to every send |

## How the playbook is organised

<div class="cards">
<a class="card" href="/prompt"><b>The Prompt</b><span>Compact rules for any coding agent. Copy and paste.</span></a>
<a class="card" href="/playbook/01-jurisdictions"><b>01 Jurisdictions</b><span>India, US, UK, EU: which law bites, when, and what the country selector must do.</span></a>
<a class="card" href="/playbook/02-universal-baseline"><b>02 Universal baseline</b><span>Non-negotiables for every app: privacy, security, AI, comms, payments, content, accessibility.</span></a>
<a class="card" href="/playbook/03-domain-modules"><b>03 Domain modules</b><span>Health, children and education, legal and immigration, money, communications, music and media, e-signature, hiring, hosting, social automation, astrology, research, government, housing.</span></a>
<a class="card" href="/playbook/04-app-register"><b>04 App register</b><span>Every RM app: data classes, regimes, red flags, must-do list. Ordered by risk.</span></a>
<a class="card" href="/playbook/05-ship-gate"><b>05 Ship gate</b><span>The checklist a change must pass before deploy, plus change-triggered checks.</span></a>
<a class="card" href="/playbook/06-incident-runbook"><b>06 Incident runbook</b><span>Breach clocks by regime (6 hours CERT-In, 72 hours UK and DPDP, 60 days FTC) and what to do in the first hour.</span></a>
<a class="card" href="/playbook/07-templates"><b>07 Templates</b><span>Copy blocks: AI disclosure, recording consent, grievance page, security.txt, retention schedule, DPA clause list.</span></a>
<a class="card" href="/playbook/08-open-questions"><b>08 Open questions</b><span>Counsel items, verify-by dates, and the things we do not know yet.</span></a>
</div>

## Severity language used throughout

- **Red line**: never do this. A PR that crosses one is rejected regardless of who asked.
- **Must**: required before an app is exposed to real users of the affected kind.
- **Should**: required before an app charges money or takes enterprise customers.
- **Counsel**: a human decision by a lawyer, CA, or regulator is needed; build the safe default meanwhile.
- **Verify**: a fact that may have changed after 2026-08-21. Check before relying on it in customer-facing copy.

## Where the source lives

`RM Orbit/Compliance/playbook/*.md` is the source. `build.py` renders the site, `serve.py` serves it on port 45037, and the systemd user unit `rm-compliance` keeps it up at `https://compliance.freedomlabs.in`. Edit markdown, restart the unit (it rebuilds on start). Keep the `REVIEWED` file current when you do a real review, not on every typo.