Privacy Policy

1. Who we are

rushes (rushes.cc) is a video hosting and community platform for filmmakers operated by rushes.cc Ltd, a company registered in England and Wales.

We are the data controller for the personal data we collect through our platform, meaning we determine the purposes and means of processing that personal data. We are responsible for handling it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information we collect

2.1 Account information

When you create a rushes account, we collect:

• Your name, username, display name and email address
• Your date of birth to verify that you meet our 18+ account requirement
• Your password in securely hashed form; we do not store plaintext passwords

2.2 Content and metadata

When you upload or manage content on rushes, we may collect:

• The video files, thumbnails, subtitles and other files you upload
• Titles, descriptions, tags, credits and other information you add to content
• Technical information such as resolution, duration, codec and file size
• Comments, review feedback and other information submitted through rushes features

2.3 Usage and analytics data

We collect information about use of the platform where necessary to operate rushes, provide creator analytics, maintain security and improve the Service. This may include:

• Pages and features used
• Upload and viewing activity
• Playback duration, completion and retention information
• Session identifiers and timestamps
• Traffic source and referring hostname
• Technical request information, which may include IP address and user-agent information where needed for delivery, security or abuse prevention

2.4 Anonymous visitors

When you view videos without signing in, rushes may use a temporary randomly generated browser session identifier to distinguish viewing sessions and provide creators with viewing analytics. We may also record playback activity, traffic source and referring hostname.

The temporary analytics identifier is not your name or email address. Further information about browser storage used for this purpose is provided in our Cookie Policy.

2.5 Payment and invoicing data

If you subscribe to a paid plan, your payment is processed by Mollie B.V. We do not store your full payment card details. We may receive and retain information needed to administer your subscription, issue receipts, meet tax and accounting requirements, prevent fraud and handle support requests, including billing country, transaction identifiers and limited payment-method information supplied by Mollie.

3. How we use your data

3.1 Lawful bases for processing

• Contract performance (Article 6(1)(b) UK GDPR): We process account information, content and related metadata as necessary to provide the Service under our Terms of Service, including hosting and delivering videos, managing subscriptions and providing customer support.
• Legitimate interests (Article 6(1)(f) UK GDPR): We process appropriate usage, analytics and security information to provide creator analytics, maintain the reliability and security of rushes, prevent abuse and improve the Service.
• Legal obligation (Article 6(1)(c) UK GDPR): We process and retain information where required to comply with legal obligations, including tax and accounting requirements, online-safety obligations and lawful requests from competent authorities.
• Consent (Article 6(1)(a) UK GDPR): Where a feature or browser-storage technology requires consent, we rely on consent and provide a means to withdraw it.

4. Age requirement

rushes accounts are restricted to users aged 18 and over. We currently collect date of birth during registration to verify that an account holder meets this requirement and retain the verification information with the account. Our age-assurance and retention approach may be updated as the Service and applicable regulatory requirements develop.

5. Who we share your data with

We use a limited number of service providers to operate rushes. They receive only the information reasonably necessary for their role.

5.1 Infrastructure and content delivery

• Hetzner Online GmbH (Germany): Provides server infrastructure used to operate our backend services and self-hosted database. Our primary application and database infrastructure is hosted in the European region.
• Impossible Cloud: Provides object storage for uploaded video files and streaming assets. Our rushes storage is located in the European region.
• Bunny: Provides content-delivery-network services used to deliver website and video content efficiently. In providing CDN services, Bunny may process network and request information such as IP address, requested URL, device or browser information and traffic logs.

5.2 Communications processor

Mailjet (Sinch Group): Provides transactional email and newsletter delivery. Information such as your email address, name and relevant communication or subscription information may be processed by Mailjet when we send messages through the service.

5.3 Payment provider

Mollie B.V. (Netherlands): Processes subscription payments. Mollie acts as an independent data controller for payment data that it must process for payment-services, fraud-prevention and regulatory purposes. Information you provide directly to Mollie is also governed by Mollie’s privacy policy.

5.4 Other disclosures

We may disclose personal data where required by law, court order or other binding legal process, or where reasonably necessary to protect the rights, property, security or safety of rushes, our users or third parties.

We do not sell personal data. We do not share personal data with advertisers. We do not use user content to train artificial intelligence models.

6. Data retention

We retain personal data only for as long as reasonably necessary for the purposes for which it is processed and to meet legal, accounting, security and dispute-resolution requirements.

• Account and content data: Normally retained while your account remains active. When an account is deleted, operational account data and content are deleted or scheduled for deletion, subject to temporary backups and information we are required or permitted to retain for legal, tax, accounting, fraud-prevention, security or dispute purposes.
• Payment, receipt and tax records: Retained for the periods required by applicable accounting and tax law even if the related rushes account is deleted.
• Viewing and analytics data: Retained only for as long as reasonably necessary to provide analytics, protect the Service and maintain relevant aggregate statistics. We periodically review these retention periods.

7. International data transfers

Our primary database and video-storage infrastructure is located in Europe. Some service providers, particularly global content-delivery and communications services, may process limited personal data from locations outside the United Kingdom or European Economic Area as part of operating their services.

Where a transfer of personal data outside the UK requires additional safeguards, we require an appropriate transfer mechanism such as an adequacy regulation, the UK International Data Transfer Agreement, or approved contractual clauses and UK addendum as applicable.

You may contact us for further information about the safeguards applicable to a particular provider.

8. Data security

We use appropriate technical and organisational measures designed to protect personal data, including:

• encryption of data in transit using TLS;
• access controls and authentication measures;
• secure password hashing;
• rate limiting and security controls on platform and API access; and
• review of our infrastructure and service-provider security arrangements.

No method of transmission or storage can be guaranteed to be completely secure.

9. Your rights

Depending on the circumstances, UK data-protection law gives you rights including:

• Access: to request a copy of personal data we hold about you.
• Rectification: to ask us to correct inaccurate personal data.
• Erasure: to request deletion of personal data where the right applies. This right does not require us to erase information that we must lawfully retain.
• Restriction: to ask us to restrict processing in certain circumstances.
• Data portability: to request applicable data in a structured, commonly used, machine-readable format.
• Objection: to object to certain processing based on legitimate interests.
• Withdrawal of consent: where processing is based on consent, to withdraw that consent at any time.

To exercise a privacy right, contact support@rushes.cc. We will respond in accordance with the time limits required by applicable law.

If you are dissatisfied with our handling of personal data, you have the right to complain to the Information Commissioner’s Office (ICO).

10. Cookies and browser storage

rushes uses cookies and similar browser-storage technologies for functions including authentication, preferences and video-view analytics. Our Cookie Policy describes the technologies currently used and the choices available to you.

11. Contact information

For privacy enquiries or data-subject requests:

12. Changes to this policy

We may update this Privacy Policy to reflect changes to rushes, our technology, our service providers or applicable law. Where a change materially affects registered users, we will provide reasonable notice. The date of the current version appears at the top of this page.