Privacy Policy
Version: 2026-10-20b
Last updated: 2026-10-20
This policy explains what personal data Rushlume collects, why, who receives it, how long we keep it, and your rights. In short:
- We collect what we need to run your account and make your edits: your email and display name, the videos you upload and what our software finds in them.
- Your song never leaves your device. Your browser measures it and sends us only timing data.
- Your uploads and finished edits are deleted automatically after your plan's storage period (Free: 1 day, Basic: 3 days, Creator: 14 days and Pro: 30 days).
- We use no advertising trackers and no analytics cookies. We count page visits with Vercel Web Analytics, run by our host, without cookies (§3 D).
- You can delete your account and all your files yourself at any time.
1. Controller and contact
The controller of your personal data is Branislav Milke, Branisková 22, 040 01 Košice, IČO 57497117, registered in Živnostenský register Okresného úradu Košice, č. 820-111862 ("we").
You can send privacy questions and requests by post to the address above or by email. Our email for them is privacy@rushlume.app.
We have not appointed a data protection officer, as we are not required to (Art. 37 GDPR).
2. What data we process and where it comes from
| Category | Examples | Source |
|---|---|---|
| Account data | Display name, email address, whether the email is verified, password (stored only as a hash), plan | You, at sign-up and in account settings |
| Google sign-in data (only if you use it) | Name, email, profile picture URL, Google account ID, OAuth tokens | Google, when you choose "Sign in with Google" |
| Session and device data | Session identifier, IP address and browser/device type (User-Agent) for each signed-in device, sign-in and last-activity times | Your browser, automatically |
| Uploaded videos | Gameplay recordings or clips you upload, and copies we derive from them (previews, proxies) | You |
| Project data | Project names, game, optional in-game nickname, which side you played on, your edit settings, moments you select or correct | You |
| Detection results | Moments our software found (time, type such as kill or goal, whether it is yours), including text read from the game's kill feed, which can contain gamer tags of you and other players | Generated by us from your videos |
| Song measurement | Beat, bar and section times, drum/instrument onset times and a bass-loudness curve. Not the audio, the file name or a fingerprint of the file | Your browser, computed on your device |
| Finished edits | The rendered videos | Generated by us |
| Usage data | Credits used, jobs started/finished/failed and their technical details, and simple product events (e.g. registered, active day, upload completed with file size, quota reached, a moment corrected) | Generated by us when you use the Service |
| Visit statistics | Pages viewed (address without query parameters), the referring website, country, browser, operating system and device type. To tell visits apart without cookies, our host forms a hash from the request (IP address and browser) that changes every day; neither the IP address nor the hash is kept | Your browser, automatically, when you open a page of our website |
| Communications | Emails you send us; account and contract emails we send you (password reset, email confirmation, plan confirmation, withdrawal confirmation) | You / us |
| Content reports | If you report content: your name, email, where the content is, why you consider it illegal, and a keyed hash of your network address for rate limiting | You |
| Sign-up checks | When an account is created: keyed hashes (not the values) of the email address in its canonical form, of the network address (IPv4, or the /64 block of IPv6) and of the browser number from the device cookie, with the time; no account identifier | Generated by us when you sign up |
| Terms and age confirmation | The terms version you accepted, that you confirmed the minimum age, and when | You, at sign-up |
| Subscription data (paid plans) | Plan, subscription status, renewal date, Stripe customer and subscription identifiers, and the confirmations you gave on our checkout page (immediate start, age, terms version, time). Payment details (card, billing address, tax data) are collected by our reseller Stripe/Link and never reach us. | You / Stripe |
People who appear in your videos. Recordings can contain other players' gamer tags, chat messages, voice chat or a face camera. We process this data only as part of processing your video for you (see §3, purpose A) and it is deleted together with the video. Our detection reads gamer tags only to decide which plays are yours; the tags it reads are not kept in the results we store. Device, time or location tags embedded in an uploaded file are removed from the previews and edits we deliver.
What we do not collect: your song audio, payment card numbers, your date of birth, precise location, contacts, or any data from advertising or analytics networks. We do not use device fingerprinting.
Is providing data required? Email, display name and a password (or Google sign-in) are required to create an account; without them we cannot provide the Service. Uploading videos is required to make edits. Your in-game nickname is optional — without it, detection may find fewer of your plays.
3. Why we process your data and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| A. Providing the Service: creating and running your account, storing your uploads, detecting your plays, planning and rendering your edits, letting you download them, enforcing plan limits and credits | Account, project, video, detection, song measurement, edits, usage | (b) contract |
| B. Signing you in and keeping your account secure: sessions, device list, password reset, email verification, rate limiting of sign-in attempts, abuse prevention | Account, session and device data (incl. IP and User-Agent), communications | (b) contract and (f) legitimate interest in protecting accounts and the Service |
| C. Paid plans: checkout confirmations, subscription status, withdrawals and refunds | Subscription data | (b) contract; (c) legal obligation (consumer law: proof of the withdrawal-right confirmations; accounting) |
| D. Improving and running the Service: understanding how features are used (first-party product events), measuring processing times and costs, fixing errors, counting page visits | Usage data, visit statistics | (f) legitimate interest in maintaining and improving a reliable, affordable service. We keep product events only in our own database. We count page visits with Vercel Web Analytics, run by our host Vercel as our processor, without cookies; no advertising or analytics network receives your data. |
| E. Customer support and complaints | Account data, communications, relevant project data | (b) contract; (c) legal obligation for consumer complaints |
| F. Handling reports of illegal content and legal requests (Digital Services Act) | Content concerned, account data, notice details | (c) legal obligation; (f) legitimate interest in protecting rights of others |
| G. Legal claims | Data relevant to the dispute | (f) legitimate interest in establishing or defending legal claims |
Where we rely on legitimate interests, you can object (see §9). We do not currently process any data on the basis of consent; if we ever do (for example marketing emails), we will ask first and you can withdraw consent at any time.
Model training. We do not use your videos or edits to train machine-learning models.
4. Automated processing and AI
Your edits are made automatically:
- Play detection uses computer vision and text recognition (OCR) on your video to read on-screen game information (kill feed, score, announcements) and decide which moments are yours.
- Rendering may create in-between frames (for slow motion and motion blur) and enhance detail using machine-learning models.
- Edit direction: to choose between several automatically generated versions of your edit, we may send an AI language model provider (OpenAI) a description of the edit consisting of the game, the types and timing of detected events and the timing structure of your song. We do not send your videos, audio, name, email, nickname or account identifiers.
These steps do not produce decisions with legal or similarly significant effects on you within the meaning of Art. 22 GDPR; they only determine how your video is edited. You can review and, where offered, correct the selected moments.
AI support assistant. The help panel in the app ("Get help") first answers from our help articles and your own account records without any AI. When you ask the assistant (or your question doesn't match a topic), your messages, the assistant's replies and the account information it looks up for you (your plan, credits, subscription status and your projects' names and status) are sent to Anthropic to generate the replies. Each message is also checked automatically (by fixed rules, not AI) for attempts to misuse the assistant. We keep the conversation, including the guided steps, for 180 days after your last message to answer follow-ups, handle complaints and prevent abuse (legitimate interest and performance of the contract, Art. 6(1)(b) and (f)). If you ask for a person, the conversation and a summary go to our team.
Refund decisions. If you ask for a refund or for compensation credits, the amount and whether you qualify are calculated automatically by fixed rules (Terms §9) from your plan, payments and credit use, and shown to you before anything happens. Because such a decision can affect you, you can always ask for a person to review it ("Talk to a person" or by email), state your view and contest it (Art. 22(3) GDPR).
5. Your song stays on your device
When you choose a song, your browser decodes and analyses it locally and stores the file only in your browser's storage (IndexedDB) so it does not need to be uploaded. We receive only the measurement listed in §2; our servers reject audio uploads. Your browser mixes the music into the finished edit on your device. You can remove the stored song by clearing this site's data in your browser.
6. Who receives your data
We use the following service providers (processors) who process data on our behalf, under contracts that require them to protect it and use it only on our instructions (Art. 28 GDPR):
| Provider | Purpose | Data | Location of processing | Safeguard for transfers outside the EEA |
|---|---|---|---|---|
| Vercel Inc. (USA) | Hosting of the website and API, workflow orchestration, logs, visit statistics (Web Analytics) | All data handled by the web app in transit, request logs (IP, browser), visit statistics | EU (Frankfurt) for application functions; global edge network; US company | Standard Contractual Clauses |
| Supabase Inc. (USA) | Database hosting and backups | Account, project, detection, usage data | EU (Frankfurt) | Standard Contractual Clauses (for support access from outside the EEA) |
| Cloudflare Inc. (USA) | Storage and delivery of uploads and edits (R2) | Videos, edits; IP address when your browser uploads or downloads | Cloudflare data centres, not limited to the EU | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Modal Labs, Inc. (USA) | Cloud computing for detection and rendering | Videos, nickname, detection results, edit settings, song measurement | USA | Standard Contractual Clauses |
| Resend, Inc. (USA) | Sending account emails | Email address, email content | EU (Ireland) for sending; US company | EU–US Data Privacy Framework and Standard Contractual Clauses |
| OpenAI (only if edit direction is enabled) | AI edit direction (see §4) | Non-identifying edit description only | USA | Standard Contractual Clauses |
| Anthropic, PBC (USA) (only when you ask the AI assistant in the help panel) | AI support assistant (see §4) | Your chat messages and the account information the assistant looks up for you (plan, credits, subscription status, project names and status); a pseudonymous identifier | USA | Standard Contractual Clauses |
| Stripe (Stripe Payments Europe Ltd / Stripe, Inc.) | Payment-related records we create: Checkout sessions, subscription status, customer portal, refunds | Account email, Stripe customer and subscription identifiers, plan | EU and USA | EU–US Data Privacy Framework and Standard Contractual Clauses |
Independent controllers. If you use "Sign in with Google", Google processes your data under its own privacy policy.
Paid plans are sold through Stripe Managed Payments: Stripe, shown to you as Link, is the merchant of record and processes your payment, billing and tax data as an independent controller under its own privacy policy.
We also disclose data to public authorities or courts where the law requires it, and to professional advisers (lawyers, accountants) bound by confidentiality. We never sell your data and do not share it with advertisers.
7. International transfers
Some of our providers are established in the USA or may access data from outside the European Economic Area. Where that happens, we rely on an adequacy decision (for US companies certified under the EU–US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses, together with additional measures where needed. You can request a copy of the relevant safeguards using the contact details in §1.
8. How long we keep your data
| Data | Retention |
|---|---|
| Uploaded videos, previews and finished edits | Deleted automatically after your plan's storage period (Free: 1 day, Basic: 3 days, Creator: 14 days and Pro: 30 days), counted from upload/render — or earlier if you delete them. Active processing can delay deletion until the edit finishes. |
| Song measurement | Deleted together with the project's files at the end of the storage period, or when you delete the project |
| Project information and detection results (without the video) | Until you delete the project or your account. Gamer tags read from the footage are not kept in detection results at all. |
| Account data | Until you delete your account |
| Session data (IP, device type) | While the session is valid (up to 30 days, renewed while you use it), deleted 7 days after it expires |
| Usage data and product events | Product events: 25 months. Technical job records: 13 months. Credit usage: until you delete your account. Sign-in rate-limit counters: 24 hours |
| Visit statistics | Only aggregated counts, kept by Vercel for up to 24 months. The daily hash used to tell visits apart is not kept beyond the day |
| Terms acceptances, checkout confirmations, subscription and withdrawal records | Until you delete your account (they prove what was agreed) |
| Invoices and payment records | Kept by our reseller Stripe/Link under its own legal obligations; we keep subscription records and checkout confirmations until you delete your account |
| Emails with us and complaint records | 3 years after the matter is closed (the general limitation period) |
| Help chat with the AI assistant | 180 days after your last message; requests handed to a person: 2 years after they are resolved. Refund and credit offers made in a chat are deleted with it |
| Records of content reports and moderation decisions | 2 years after the decision. The sender's network address is never stored, only a keyed hash used for rate limiting |
| Sign-up checks (keyed hashes) | 90 days after the sign-up, also when the account is deleted earlier (so a deleted account cannot be recreated at once for new free credits) |
| Server logs at our providers | Up to 30 days (depending on the provider) |
| Backups | Deleted data may remain in encrypted database backups for up to 7 days until they are overwritten |
Deleting your account (Account → "Delete my account…") immediately deletes your account, every edit and every uploaded file; storage deletions that fail are retried automatically. Copies in backups and provider logs expire on the schedules above.
9. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy (Art. 15) — the download in your account gives you most of it at once;
- rectification of inaccurate data — you can change your name in account settings (Art. 16);
- erasure — you can delete projects and your whole account yourself (Art. 17);
- restriction of processing (Art. 18);
- data portability — receive the data you gave us in a machine-readable format (Art. 20): use Account → Your data → Download my data;
- object to processing based on legitimate interests (Art. 21), including at any time to direct marketing;
- withdraw consent where processing is based on consent, without affecting earlier processing.
To exercise your rights, contact us using the details in §1; if you write by email, please use your account email address. We answer within one month (extendable by two months for complex requests, in which case we tell you). We may ask you to confirm your identity.
Complaints. You can lodge a complaint with a supervisory authority, in particular in the EU country where you live or work, or with the Slovak authority: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, Slovakia, https://dataprotection.gov.sk.
10. Children
The Service is not intended for anyone under 16. We do not knowingly collect data of children under 16. If you believe a child under 16 has created an account, contact us and we will delete it.
11. Security
We protect your data with measures appropriate to the risk, including: a private storage bucket accessible only through short-lived signed links; encrypted connections (HTTPS); passwords stored only as hashes; limits on sign-in attempts; per-user access checks on every request; processing servers that receive only time-limited links to the files they need, never database or storage credentials; and automatic deletion of files. If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay.
12. Cookies and similar technologies
We use only cookies and browser storage that are necessary for the Service or that remember choices you make (such as your language). We count page visits with Vercel Web Analytics, which sets no cookies and stores nothing in your browser. See our Cookie Policy.
13. Changes to this policy
We will publish changes on this page and update the date above. If changes are significant, we will notify you by email or in the app before they take effect.