Privacy policy

1. Who is the data controller?

The controller of the personal data collected through the website https://www.rushly-ai.app and the Rushly plugin is IRYS, whose registered office is located at 60 rue François Ier, 75008 Paris, France.

For any question about the processing of your data, you can write to us at hello@rushly-ai.app.

2. What data is collected?

Depending on how you interact with the website or the plugin, we collect:

• Account data: last name, first name, email, password (encrypted).
• Payment data: processed exclusively by our provider Stripe Payments Europe Ltd.. Rushly does not store any bank data (card number, CVV, etc.).
• Plugin usage data: number of credits used, features used, duration of the footage processed. No video or audio content is kept after processing.
• Technical data: IP address, device and browser type, operating system version, Adobe Premiere Pro version, error logs.
• Communication data: if you contact us by email, we keep the history of our exchanges.
• Install link request (form shown on mobile): your email address and the editing software you indicated (Premiere Pro, DaVinci Resolve or other).
• Application to the creator programme: your name or channel name, your email address, the link to your channel or main account, the platform, your number of followers, your type of content and, if you write one, your message. We also keep the date and the exact text of the consent checkbox, as well as an encrypted hash of your IP address (never the address itself).
• Origin of your account: how you first arrived on the website (domain name of the referring site, landing page, UTM campaign parameters of our own links), stored for 90 days in your browser (rushly_attr) and then saved to your account if you create one. An origin is only ever attached to a single account.
• Affiliation: if you arrive through a Rushly user's link, the code of that link (cookie rushly_parrain, 60 days) and then, if you create an account, the attachment of your account to that person. They only see counters (sign-ups, paying customers) and their earnings, never your identity or your payments. If you are an affiliate yourself: your code, your commissions (calculated on the payments of the customers you refer) and, if you connect an account to get paid, the identifier of your Stripe payout account and its status (verification completed or not, payouts enabled, number of missing items of information). No bank details or identity documents: you enter them directly with Stripe.
• Visit journey (only if you accept audience measurement): a random visitor identifier (rushly_vid) and the last 30 steps of your visit (rushly_journey: date, page, type of step), saved to your account when you sign up. The visitor identifier is attached to your payment, and your account identifier is sent to Google Analytics 4 once you are signed in. Deleted from your browser as soon as you withdraw your consent.
• Anonymous, cookie-free audience measurement (even if you refuse cookies): date, journey step (page view, demo, quiz, download, opening checkout), page, language, country (never the city), mobile or desktop and the campaign parameters of the link you arrived from, with a random visit number that disappears when the tab is closed. No IP address, no browser details, no typed data, no link to your account. Exempt from consent (audience measurement, CNIL), kept for 25 months at most. Object with one click on the cookie page.
• Website traffic analytics data via Google Analytics 4 + Microsoft Clarity + Meta Pixel (pages visited, duration, traffic source).

3. Why is this data collected?

• Providing the service: creating and managing your account, authenticating you when you sign in to the plugin, processing your footage and keeping your credit balance up to date.
• Billing and accounting: issuing invoices, meeting our accounting and tax obligations.
• Customer support: answering your requests, resolving technical incidents.
• Product improvement: anonymously analysing aggregated usage to improve the plugin's features.
• Security: detecting and preventing fraud, abuse and unauthorised access attempts, in particular the granting of free credits only once per person, using a non-reversible hash of the email address, kept even after the account is deleted.
• Sending the install link you request: a single email, containing the install link and the link to the free credits. It does not sign you up to any email series.
• Reviewing your application to the creator programme and replying to you. This information is not used for anything else: no newsletter, no resale.
• Affiliate programme: attaching the person referred through a link, calculating and paying out the affiliate's commissions, detecting self-referral and fraud.
• Product communications (if you have consented): informing you of new features and major updates.

4. On what legal basis?

• Performance of the contract (Art. 6(1)(b) GDPR): to provide the service you subscribed to, including the affiliate programme (attachment of the referred person, the affiliate's commissions).
• Pre-contractual measures and handling of your request(Art. 6(1)(b)): sending the install link you requested, and reviewing your application to the creator programme.
• Legal obligations (Art. 6(1)(c)): billing, fraud prevention, accounting record retention (10 years).
• Legitimate interest (Art. 6(1)(f)): improving the service, security, preventing abuse, and knowing the origin of each account (rushly_attr) to measure the effectiveness of our content. You can object to this last processing by writing to us.
• Consent (Art. 6(1)(a)): for marketing communications, certain cookies, and the visit journey attached to your account (see the Cookie policy).

5. How long is the data kept?

• Active account: as long as your account is active and up to 3 years after the last activity.
• Billing data: 10 years (accounting obligation, Article L123-22 of the French Commercial Code, Code de commerce).
• Technical logs: 12 months maximum.
• Origin and visit journey: 90 days in your browser for the origin; until you withdraw your consent or it expires (about 6 months) for the journey. Once attached to your account, they are kept with it.
• Support exchanges: 3 years after the last interaction.
• Content processed by the plugin (video / audio footage): no lasting retention. It is processed on the fly and deleted within 6 hours at most after processing (see section 8).
• Install link request: if you do not tick the box for tips by email, we do not save your address in our audience database: only a record of the sending, in which your address appears only as an encrypted hash, is kept with our sending logs (it cannot be used to find you without already having your address). If you tick the box, the rule for signing up to our emails (below) applies: confirmation by a click, otherwise deletion within 30 days.
• Affiliation: the attachment to an affiliate lives with the account; commissions and payouts are accounting records, kept for 10 years. The link to your Stripe payout account is deleted with your Rushly account; the data that Stripe collected to pay you is kept by Stripe under its own legal obligations.
• Applications to the creator programme: 12 months from the application, then automatic deletion. You can ask for them to be deleted before that by writing to hello@rushly-ai.app.
• Signing up to our emails: if you leave your address to receive one of our resources, we first send you a confirmation email. Until you have clicked the link it contains, your address is used for nothing else and it is automatically deleted after 30 days: without confirmation from you, we have no reason to keep it. If you confirm, we keep your address until you unsubscribe, which you can do in one click from any of our emails. We also keep the date and the exact text of the box you ticked: this is what allows us to prove that you did give your consent, as the GDPR requires.

6. Who receives the data?

Your data is never sold. It is only shared with our processors (within the meaning of Article 28 of the GDPR), strictly necessary for the operation of the service. Each of them only accesses the data essential to its task and acts on our instructions:

• Supabase (database, authentication and file storage): hosted in the Tokyo region (Japan), outside the European Union.
• Vercel Inc. (hosting of the website and the backend API): United States. Registered office: 340 S Lemon Ave #4133, Walnut, CA 91789, United States.
• Stripe Payments Europe Ltd. (payment processing and billing): Ireland (European Union). Registered office: 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe is PCI-DSS Level 1 certified.
• Stripe Payments Europe Ltd. (Stripe Connect), for affiliates who receive their commissions: Stripe directly collects and verifies your identity, your bank details and, where applicable, those of your company (know-your-customer and anti-money laundering obligations), then makes the transfers. For this data, Stripe acts as a separate data controller, under its own privacy policy. Rushly only receives the identifier of your Stripe account and its status.
• Resend (sending our emails: on the one hand, transactional emails, such as account confirmation, receipts and support; on the other hand, if you signed up, the emails of the sequence you consented to): United States.
• Google Analytics 4 (website audience measurement: pages visited, duration, traffic source): Google LLC, United States. Enabled after your consent.
• Microsoft Clarity (website usage analysis: heatmaps and session recordings): Microsoft Corp., United States. Enabled after your consent.
• Meta Pixel (advertising conversion measurement): Meta Platforms, Inc., United States. Enabled after your consent.
• Meta Platforms Ireland Ltd. (Instagram): provider of Instagram and of the official Instagram API through which we receive the comments and messages sent to our accounts and reply to them (see section 8 bis). Ireland (European Union); Meta may also process data in the United States, under its own privacy policy.
• TikTok Technology Limited (Ireland, European Union) and TikTok Pte. Ltd. (Singapore): providers of TikTok and of the official TikTok API through which we read the comments left under our videos and reply to them publicly (see section 8 ter). TikTok may process data outside the European Union, under its own privacy policy.
• Meta Platforms Ireland Ltd. (Threads) and Google (YouTube, via the official YouTube API): providers of the platforms on which we reply publicly to the comments left under our own posts and videos (see section 8 ter).

For the processing of your footage by artificial intelligence, the files concerned (audio, video, transcripts) are sent on the fly to the following AI providers, depending on the feature used:

• Anthropic (Claude model, detection of key moments / “smart clips”): United States.
• Google (Gemini model, AI Cleanup): United States.
• ElevenLabs (Scribe model, transcription and subtitles): United States.

These AI providers process the content only for the time needed to produce the result and do not reuse it to train their models. The files are deleted once processing is complete (see section 5).

In the event of a legal request, we may be required to disclose certain data to the competent authorities.

7. Transfers outside the EU

Some of these processors process data outside the European Union: in the United States (Vercel Inc., Resend, Google Analytics 4, Microsoft Clarity, Meta Pixel, Anthropic, Google, ElevenLabs, and, depending on their policies, Meta Platforms Ireland / Instagram / Threads and TikTok), as well as in Singapore (TikTok Pte. Ltd.) and in Japan (Supabase, Tokyo region). These transfers outside the EU are governed by the European Commission's Standard Contractual Clauses (SCCs), supplemented where applicable by the EU-US Data Privacy Framework (DPF), ensuring a level of protection equivalent to that of the GDPR. Processing related to audience measurement and advertising conversions (Google Analytics 4, Microsoft Clarity, Meta Pixel) is only enabled after your consent (see the Cookie policy). Processing carried out within the European Union (Stripe) involves no transfer outside the EU.

8. Third-party videos: respective responsibilities

The footage you import into the plugin may contain personal data of third parties (faces, voices, recorded statements). For this data:

• You are the data controller for this data and you warrant that you have obtained all the necessary authorisations and consents (image rights, neighbouring rights, consent of the people filmed) before processing this content through the plugin.
• Rushly acts as a processor for this processing: we only act on your instructions, for the time needed to produce the result. The content is processed on the fly and deleted within 6 hours at most, without being kept or reused.

The full clause governing this controller / processor relationship appears in our Terms of Sale.

8 bis. Instagram: automatic replies to comments and messages

Rushly uses a Meta app (“Rushly Comment Flow”) connected, through Meta's official Instagram API, to the professional Instagram accounts managed by IRYS, including the Rushly account. It is used to reply automatically, publicly and then by private message, to people who comment on a post from these accounts with a keyword (for example to send them a free resource), and to reply to them within the 24-hour window that follows their reply. This app is only used by IRYS on its own accounts: it is not offered to third parties.

Data concerned (people who comment on or write to our accounts):

• Instagram identifier specific to our app (“IGSID”) and public username;
• text and identifier of the comment, identifier of the post concerned;
• messages exchanged with our accounts (text of the messages received and sent, date, status);
• clicks on the link to the resource sent (tracked link), with no browsing data other than the date and the link token.

We do not collect your Instagram password, the list of accounts you follow, or any non-public data from your profile. The data comes exclusively from your own comment or message sent to our accounts.

Purposes and legal bases. Replying to you and sending you the resource you requested by commenting (handling of your request, Art. 6(1)(b) GDPR); measuring the proper functioning of the automation and preventing abuse (legitimate interest, Art. 6(1)(f)). No automated decision producing legal effects is taken about you.

Information about the automation. The public reply and the private messages sent following your comment are automatic. You can reply “STOP” at any time: we then stop all messages and keep only your identifier in order to respect your refusal.

Recipients. Meta Platforms Ireland Ltd. (provider of Instagram and of the API), Vercel Inc. (hosting of the tool) and Supabase (database, Tokyo region, Japan). No resale, no advertising use of this data, no transfer to other third parties.

Retention period. Comments and messages: 12 months maximum after the last exchange, then deletion or anonymisation. Tracked links: 12 months. Instagram access tokens for our accounts: until the account is disconnected.

Your rights and the deletion of your Instagram data. You can request access to, rectification or deletion of the data above by writing to hello@rushly-ai.app with your Instagram username: we delete it within 30 days at most and confirm the deletion to you. If you have removed our app's access from your Instagram / Facebook settings (“Apps and websites”) and requested the deletion of your data, Meta forwards the request to us and we delete the data associated with your identifier. The detailed instructions, in English and in French, are on the Instagram data deletion page.

8 ter. Automatic replies to comments on TikTok, Threads and YouTube

IRYS uses internal tools, connected to the official APIs of TikTok, Threads (Meta) and YouTube (Google), to reply automatically in public, under our own videos and posts, to people who comment with a keyword (for example “plugin”). The reply is a short public message, for example “The link is in the bio 👆” or one of its variants. These tools only work on the Rushly / IRYS accounts: they are not offered to third parties. They send no private message on TikTok, publish no video and act on no account other than ours.

Data concerned (people who comment on our videos and posts):

• identifier of the comment and identifier of the video or post concerned;
• text of the comment;
• public username of the comment's author;
• on Threads, if the reply contains a tracked link: the click on that link (date and link token), with no other browsing data.

We do not collect your password, the list of accounts you follow, or any non-public data from your profile. The data comes exclusively from your own comment, made public by the platform.

Purposes and legal bases. Replying to you and giving you access to the resource you requested by commenting (handling of your request, Art. 6(1)(b) GDPR); checking that the automation works, avoiding replying twice to the same comment and preventing abuse (legitimate interest, Art. 6(1)(f)). No automated decision producing legal effects concerning you or similarly significantly affecting you is taken about you.

Recipients. TikTok Technology Limited / TikTok Pte. Ltd. for TikTok, Meta Platforms Ireland Ltd. for Threads, Google for YouTube (providers of the platforms and APIs), Vercel Inc. (hosting of the tool) and Supabase (database, Tokyo region, Japan). No resale, no advertising use of this data, no transfer to other third parties.

Retention period. Identifiers, comment text and public usernames: 12 months maximum after the comment, then deletion or anonymisation. Tracked links: 12 months. Access tokens for our accounts: until they are disconnected.

Your rights and the deletion of your data. You can request access to, rectification or deletion of this data by writing to hello@rushly-ai.app with your username (TikTok, Threads or YouTube): we delete it within 30 days at most and confirm the deletion to you. You can also delete your comment directly on the platform, and you can object at any time to these replies by writing to us at the same address. For Threads, the detailed procedure is the one described on the Instagram data deletion page.

9. Your rights

Under the GDPR, you have the following rights:

• Right of access: obtain a copy of your data.
• Right to rectification: correct inaccurate data.
• Right to erasure (“right to be forgotten”): have your data deleted.
• Right to restriction of processing.
• Right to data portability: get your data back in a structured format.
• Right to object to processing based on legitimate interest.
• Right to withdraw your consent at any time, without affecting prior processing.
• Right to set post-mortem instructions regarding what happens to your data (directives post-mortem).

To exercise these rights, write to hello@rushly-ai.app. You will receive a reply within 30 days at most. Proof of identity may be requested in the event of reasonable doubt about the identity of the requester.

10. Complaint to the CNIL

If you believe that your rights are not being respected, you can lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority:

• 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
• Website: www.cnil.fr

11. Changes to this policy

This policy may change. Any substantial change will be notified to you by email or through the website. The date of the last update appears at the top of this page.