Privacy Policy

Rush Studio Ltd. ("Rush Studio", "we", "us") operates the translation workspace at rush.studio. This policy explains what personal data we collect, why we collect it, what we do with it, and what rights you have over it.

We've tried to write this in plain English. The bits where we couldn't avoid the legal phrasing, we've marked. If anything is unclear, tell us and we'll fix it in the next revision.

We collect three kinds of data:

• Account data — your name, work email, company, and the password you set (hashed with bcrypt, never stored plaintext). Required to give you a workspace.
• Content data — files you upload, segments you translate, glossaries, translation memory entries, comments. This is the data you're trusting us with; we treat it as confidential.
• Telemetry — IP address, browser type, page views, feature usage, error reports. We use this to keep the service running and to figure out which features people actually use.

We don't collect tracking IDs across other websites. We don't run ad networks. We don't profile you.

We process your data for one of these reasons:

• To provide the service — translating your files, syncing with your integrations, sending you the emails you signed up for. This is a contractual necessity.
• Legitimate interest — security, fraud prevention, debugging, product improvement. We do this in ways that don't compromise your privacy.
• Consent — for optional marketing emails and any feature you've explicitly opted into. You can withdraw consent at any time.
• Legal obligation — tax records, audit logs, anything else the law requires us to keep.

To produce machine-translation drafts and quality/resonance analysis, we route segments of your content to AI providers: DeepL and Google Cloud Translation for machine translation, and OpenAI for context-aware translation, quality estimation, and reader-resonance analysis. Which provider we use depends on the language pair and feature — see the languages page for the per-language breakdown.

We send the segment being processed plus the limited context the task needs — neighbouring segments for continuity, your glossary terms, and your brand-voice / tone settings. We do not send file names, account, billing, or authentication data. Requests to OpenAI are sent with storage disabled so they are not retained for training or evaluation; DeepL and Google process your content under their standard no-training business terms. Customers on our Scale plan can ask us about an OpenAI account-level Zero Data Retention agreement.

If you'd rather your data never leave Rush Studio's infrastructure, our Scale plan offers an on-premises translation engine; talk to sales.

Rush Studio is operated from the European Union. Primary data storage is in Frankfurt, Germany (eu-central-1). Backups are replicated to Dublin, Ireland (eu-west-1). We do not store production data in the United States.

Some of our sub-processors are based outside the EU. Where personal data is transferred internationally, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. See our sub-processor list for details.

We keep your data only as long as we need it:

• Account data — for the lifetime of your account, plus 30 days after deletion (in case you change your mind).
• Content data — same as account data; deleted within 30 days of account closure, or sooner if you delete the project explicitly.
• Translation memory & glossaries — yours to keep; exportable in TMX/CSV at any time, deleted alongside the account.
• Telemetry — 13 months in identifiable form, then aggregated.
• Billing records — 7 years, as required by tax law in our jurisdiction.

Under GDPR and equivalent laws elsewhere, you have the right to:

• Access the personal data we hold about you — request a copy from your settings.
• Rectify data that's inaccurate.
• Erase your data, subject to the retention rules above and any legal obligations.
• Restrict processing while a complaint is being resolved.
• Object to processing based on legitimate interest.
• Portability — receive your data in a machine-readable format. We provide JSON + TMX exports.
• Lodge a complaint with your data protection authority. In the EU, that's typically your country's DPA.

Most of these are one click in your account settings. For anything more involved, email privacy@rush-studio.com and we'll respond within 30 days (usually much sooner).

We use a small number of strictly-necessary cookies to keep you signed in and to remember your workspace preferences. We don't use advertising cookies, third-party trackers, or fingerprinting.

The only optional cookie is for our product analytics, and we ask before setting it. You can decline; the service works the same.

We follow industry-standard practices: TLS 1.3 in transit, AES-256 at rest, hashed passwords, role-based access controls, audit logs, and SOC 2 Type II certification. Our infrastructure runs on AWS in EU regions.

We run pentests annually with an external vendor. The most recent report is available under NDA — email legal@rush-studio.com.

Rush Studio is a B2B product. We don't knowingly collect data from anyone under 16, and there's no reason for them to be using us. If you believe a minor has signed up, write to us at privacy@rush-studio.com and we'll delete the account.

We'll email everyone with an active account if we make a material change. We'll post the change here at least 30 days before it takes effect, and we keep a public changelog of revisions at rush.studio/privacy/changelog.

Trivial fixes — typos, broken links, clarifications that don't change meaning — we make silently.

Data Controller: Rush Studio Ltd., 12 Hatton Garden, London EC1N 8AT, United Kingdom.

Data Protection Officer: Pedro Almeida — privacy@rush-studio.com.

General privacy questions: privacy@rush-studio.com. We respond within one business day.