Privacy Policy

The short version

• Rushilo edits on your computer. Your footage, projects and AI keys never reach us.
• The desktop app has no analytics, crash reporting or session recording. It only contacts us to activate a licence and to check for updates.
• The website keeps what it needs to run your account, sell you a licence and email you, and counts visits with Google Analytics. Nothing is sold to anyone.

1. Who is responsible

PAVADO TECHNOLOGIES INC ("we") operates Rushilo and https://rushilo.com and is responsible for your personal information. Contact us about privacy at support@team.rushilo.com.

2. What we collect and why

• Account: your name, email address, password (stored only as a one-way hash) or your Google sign-in identifier and profile picture. Used to run your account and sign you in.
• Onboarding answers: your role, what you make, which AI tool and computer you use, team size, company or website, and how you heard about us. Used to set Rushilo up for you and to understand who it serves. All but one question is optional.
• How you found us: when you first visit, a cookie records the campaign tags in the link (utm), the referring site and the first page you saw, and we copy them to your account if you sign up. Used to see which channels work.
• Purchases: what you bought, the amount, currency, the email used at checkout and Stripe's payment references. Your card details are handled by Stripe and never reach us.
• Licences and computers: a random identifier the app creates for each computer you activate, and when you activated it. It does not contain your name, hardware serials or files.
• Email activity: which emails we sent you, whether they were delivered, bounced or marked as spam, and your email preferences.
• Consent records: the version of these policies and the Terms you accepted, when, and the IP address and browser used, so we can show what you agreed to.
• Website analytics: on rushilo.com we use Google Analytics to count visits and see which pages and campaigns work: pages viewed, approximate location, device and browser type, and how you arrived. Page addresses are cleaned first: no tokens, emails or other personal values from the address are sent, and sign-in, password, activation and unsubscribe pages are never reported. Google signals and advertising features are off.
• Security and technical data: IP address and browser details for sign-in sessions and rate limiting, and standard server logs kept by our hosting provider.

We do not collect your footage, projects, AI prompts, AI output or API keys.

3. Legal bases

Where laws such as the GDPR apply, we rely on: performing our contract with you (account, licence, purchase, service emails); our legitimate interests (security, fraud and dispute prevention, understanding which channels bring users, product improvement); your consent (marketing and update emails, which you can turn off any time); and legal obligations (tax and accounting records).

4. Emails

We send service emails you cannot opt out of while you have an account (verification, password reset, receipts, licence and security notices). We also send product tips, offers and release updates. Every one of those has an unsubscribe link, and you can choose categories in your email preferences.

5. Who processes your data

We use these service providers, only for the purposes above:

• Vercel (website hosting)
• Google Analytics (website visit statistics, rushilo.com only)
• Supabase (database, in the United States)
• Stripe (payments)
• Resend (sending email)
• Google (only if you choose Google sign-in)
• GitHub (hosts the app downloads and updates; GitHub sees your IP address when you download)

These providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards for these transfers. We may also disclose information if the law requires it, to protect our rights (for example in a payment dispute), or as part of a merger or sale of the business. We do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising.

6. Cookies

• A session cookie that keeps you signed in. Required.
• A first-visit cookie (rushilo_ft, 90 days) recording how you found us, as described above.
• Google Analytics cookies (_ga and _ga_*, up to 2 years) that tell repeat visits apart. In the European Economic Area, the United Kingdom and Switzerland these are not set; Google receives cookieless visit counts instead.

We do not use advertising cookies, and we do not share data for advertising. You can block analytics with your browser's cookie settings, a content blocker, or Google's opt-out add-on. The desktop app has no analytics at all.

7. How long we keep it

Account, onboarding and email preference data are kept while your account exists. Purchase, licence and consent records are kept as long as needed for tax, accounting and dispute purposes (generally up to 7 years). Expired sessions and verification codes are deleted automatically. If you delete your account we delete or anonymize the rest, except what we must keep by law.

8. Your rights

Depending on where you live (for example under Canada's PIPEDA, the GDPR or UK GDPR, or California law), you may have the right to access, correct, delete or export your personal information, to object to or restrict some uses, and to withdraw consent. Email support@team.rushilo.com and we will respond within 30 days. We will not treat you differently for exercising these rights. You can also complain to your local data protection authority, such as the Office of the Privacy Commissioner of Canada.

9. Security

We use encryption in transit, hashed passwords, restricted database access and signed licences. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

10. Children

Rushilo is not for children under 16, and we do not knowingly collect their information.

11. Changes

We will post any changes here with a new effective date, and tell you by email for material changes. See also our Terms of Service.