Privacy Policy

1. Who we are and how to contact us

For privacy questions or requests, email contact@corerush.net with the subject “Privacy request.” State of incorporation: [STATE OF INCORPORATION]. Mailing address: [MAILING ADDRESS]. These highlighted items need confirmation; they are not statements of an assumed location.

2. Information you provide

Contact and quote forms, consultation bookings and project intake can collect your name, business or company, email, phone, service interest, budget, timing, project requirements and messages. Account records can include names, verified email, authentication identifiers, profile information, roles, team membership, account status and access permissions.

3. Electronic signatures and document records

When you view or sign a document, CoreRush can record the account and verified email, document ID, immutable version and content hash, PDF access time, typed signer name, consent to electronic records, signature time and the completed PDF. An authorized company representative can separately authorize a company counter-signature; uploaded sender signature images can be used in documents.

Authentication, hosting, security and provider systems may process IP addresses, browser/device details and request logs associated with access. The current CoreRush signature receipt itself records identity, version, time and consent; it is not an IP/device-fingerprint certificate or a certification of legal enforceability. We do not claim to collect evidence that the app does not actually record.

5. Email, campaigns, AI and integrations

Resend processes transactional email recipients, subjects, message content, PDF/project attachments, provider message IDs and available delivery events. This includes intake, contracts, letters, staff correspondence and signed copies. After an actual contract signature, the service can store the completed PDF and email it to both parties. Provider acceptance is not a claim that a message was delivered or read.

Klaviyo supports configured marketing/contact-list and campaign functions. Authorized customer campaigns are limited to explicitly assigned audiences. Marketing preferences and unsubscribes are separate from essential service notices. Third-party open/click or delivery information is used only where that provider or feature actually supplies it.

Ad Studio and other enabled AI/media workflows can process prompts, selected input files, generated results, model/settings, provider job identifiers and usage/credit records. Higgsfield is used for connected media-generation workflows; Hugging Face is a supported AI-provider connection. Additional providers can be configured in the secure integration vault; information is sent to an additional provider only as needed for an enabled operation. Provider terms govern their handling, retention and any model-training use; we do not promise a universal zero-retention or no-training arrangement. Do not submit confidential, regulated or children’s data without an appropriate agreement and review.

The secure integrations vault can hold encrypted provider credentials, connection metadata, project authorization and usage/audit records. Project access keys are handled server-side with restricted access and hash-based verification. Never send passwords, API keys or private credentials through ordinary email or chat.

6. Usage data, cookies and advertising

Essential cookies and browser storage support authentication, private staff sessions, return-PIN security, cookie choices and functionality. Signing drafts can be saved in browser storage per account, document and exact version until successful submission. Browser/device information, request events and security logs may be processed by our infrastructure and authentication providers. Do not use a shared device without signing out.

Optional analytics and advertising default off until you choose them. With advertising permission, the Meta Pixel and server-side Meta Conversions API can send permitted events such as lead submission or purchase, event IDs/times, source pages, value/currency, browser identifiers and matching information. Some matching contact data is hashed before transmission; hashing does not make it anonymous. The current website setup uses consent checks and event deduplication, not WhatsApp messaging identifiers merely because Meta supports them.

Use “Cookie preferences” in the footer or on this page to reject optional categories or change a previous choice. We honor supported Global Privacy Control signals by blocking optional advertising, and the server preference/conversion handlers also check supported GPC/Do Not Track signals. Browser settings and content blockers may provide additional controls. Necessary account/security operations remain available. Previously transmitted data is not automatically erased by changing a browser preference; contact us to request applicable deletion.

We do not sell personal data for money or run a data-broker business. Optional disclosures for Meta advertising can nevertheless be considered “sale,” “sharing” or targeted advertising under state privacy laws, even without payment. Reject advertising or use GPC to opt out of that activity; you can also email a privacy request. We do not knowingly sell or share children’s data for advertising.

7. Why we use information and our legal bases

Where EU/UK rules apply, our bases are steps requested before a contract and performance of a contract; legitimate interests in secure, reliable operations and fraud prevention, subject to your rights; legal obligations such as accounting and responding to valid legal process; and consent for optional tracking, relevant marketing and opt-in public profiles. You may withdraw consent for future processing without invalidating earlier lawful processing. We do not use AI generation or a referral calculation as a claim that a legally significant decision has been made solely by AI.

8. Who receives information

Authorized CoreRush personnel, team members and assigned service providers receive information needed for their permitted tasks. Customers receive their documents and communications. Parties to an agreement receive relevant signed copies. Information you choose for a public team profile or a permitted portfolio entry may be visible publicly.

Named processor/service categories include Stripe for payments and Connect; Resend for transactional email; Klaviyo for configured campaigns; Clerk for authentication and account verification; Replit for application hosting and managed infrastructure; Replit App Storage and its Google Cloud Storage infrastructure for private files; PostgreSQL application storage; Supabase for the restricted staff project registry; Meta for consented advertising/measurement; and configured AI/media providers, including Higgsfield and supported Hugging Face connections. We do not treat the Supabase project registry as an authorization to access unrelated student databases.

We may disclose necessary information to professional advisers, insurers, authorities or courts where legally justified, to investigate fraud or protect rights, or in a lawful business transfer subject to appropriate confidentiality and notice obligations. External links and services have their own terms and privacy practices.

9. Retention and deletion

There is no promise that every category is automatically deleted on a fixed schedule. [RETENTION SCHEDULE — confirm applicable legal periods for contracts, financial records, messages, uploads, logs and backups]. We review deletion requests against those duties, remove or de-identify eligible information where feasible, and explain applicable exceptions. Backup removal and deletion at independent providers may take additional time.

10. Security and international processing

CoreRush and its providers may process information in the United States and other countries, whose laws may differ from yours. Where legally required for an international transfer, appropriate safeguards must apply, such as a valid adequacy decision or contractual transfer mechanism. [INTERNATIONAL TRANSFER ARRANGEMENTS — confirm applicable provider agreements and safeguards]. We do not claim a particular data-residency location or certification without confirmation.

11. Your privacy choices and requests

Depending on your location and applicable exceptions, you may request confirmation/access, a copy or portability, correction, deletion, restriction, an objection to processing, withdrawal of consent, and opt-out of sale/sharing, targeted advertising or qualifying profiling. You can decline an opt-in public profile and change cookie choices without purchasing anything.

Email contact@corerush.net with your request and enough information to locate your account. Do not email a password, full bank/card number or unnecessary identity documents. We may verify identity proportionately, request proof of an authorized agent’s authority and explain legal limits. We will respond within applicable legal deadlines and explain any permitted extension. If we deny a request, reply with “Privacy appeal” for review where the law provides an appeal. You may also complain to the relevant regulator. We do not retaliate against you for exercising protected privacy rights.

12. California and other U.S. state privacy laws

Subject to CCPA/CPRA applicability and exceptions, California residents can request to know/access, correct and delete personal information; opt out of sale/sharing; limit qualifying uses of sensitive personal information where required; use an authorized agent; and receive non-discriminatory treatment. We do not use sensitive information for unrelated advertising purposes. Advertising-related disclosures, if enabled, are explained in “Usage data, cookies and advertising”; GPC and advertising choices control them.

Residents of other U.S. states may have similar access, correction, deletion, portability, targeted-advertising/sale and certain profiling opt-out rights, plus appeal rights, under applicable state laws. Contact the same privacy email. If an appeal remains unresolved, you may contact your state attorney general or designated regulator. These notices do not falsely claim that a small-business threshold or every state law necessarily applies to CoreRush.

13. EU and UK visitors

Where GDPR or UK GDPR applies, CoreRush LLC is the controller for information it determines how to use for its own operations. When building or supporting a client’s app under that client’s instructions, the parties may instead need a separate controller/processor agreement; this policy alone is not a data-processing agreement.

You may use the rights and contact process above and complain to your competent EU supervisory authority or the UK Information Commissioner’s Office. We rely on the legal bases described in this policy, not consent for every activity. [EU/UK REPRESENTATIVE OR DATA PROTECTION OFFICER — confirm whether appointment is legally required and provide details if applicable].

14. Children

The CoreRush business website and account/team services are not directed to children under 13, or under 16 where applicable consent rules require that threshold. We do not knowingly collect children’s personal information for these services without a lawful, specifically arranged basis. Contact us if you believe a child has provided information so we can investigate and take appropriate steps.

A client may commission an education or school application; that does not authorize uploading real student records to CoreRush intake, email, chat or AI tools. School-specific privacy, parent/guardian consent, access controls and any legally required student-data agreement must be addressed separately before handling real student data.

15. Changes to this policy

We will post changes here and update the date. We will provide additional notice or obtain fresh consent when legally required. A new privacy notice is not itself permission to enable optional tracking, and changing this policy does not rewrite a previously signed agreement or historical sale snapshot.

Public client reviews

If genuine client feedback is published with permission, it may display the client's chosen name, rating, date and feedback. Administrators retain the source and authenticity confirmation. Google Places may supply public Google reviewer names, profile links, dates, ratings and review text, subject to Google's terms and privacy policy. Public Google reviews are fetched without storing or time-caching Places content; only concurrent requests are coalesced. Manual client feedback is stored and may be cached. Google feedback is distinguished from feedback submitted directly to CoreRush. Contact contact@corerush.net with correction, removal or privacy requests.