Privacy Policy

Last updated: October 21, 2026

This policy describes how Rush Clipping processes data on clipping.rushmp4.com, in its creator and Manager areas, and through its Discord, Google/YouTube, TikTok and X integrations.

1. Data controller

VIKING HAWKS, INC., a US C corporation incorporated in Delaware (United States), operating RUSH.MP4.
Delaware file number: 7730486.
Correspondence address: 10 Rue Saint Bernard, 84000 Avignon, France.
Contact: contact@rushmp4.com.

2. Data used to provide the service

• Account and sign-in: depending on your chosen method, your Discord identifier, display name and email address supplied by Discord, or your Google identifier and verified email address supplied by Google. The Google identifier is stored as a hash associated with the account. You can customize your public account name. Your email is used for account access and security; it is not displayed to other participants.
• Social accounts: platform, account or channel identifier, public name, and the method and date used to confirm its association with the participant.
• Campaigns and clips: participation records, submitted publication links, identifiers, dates, validation status, rejection reasons, and view or impression observations with their source and timestamp. Authorized manual validations are attributed and retained in the history.
• Payments: recorded earnings, withdrawal requests and payment references. Payment details entered in the service are stored encrypted.
• Operation: sign-in sessions, information needed for security, technical logs and support messages you voluntarily send.

Partnership enquiries: the business contact details, links and project information you submit through the form are used to assess your enquiry and respond. The enquiry is stored privately, and our team receives a notification through Cloudflare Email Service. These details are not published or automatically added to a newsletter; they are retained for as long as needed to follow up on your enquiry.

3. Email, Google and YouTube connections

Email sign-in: we send a sign-in link to the address you enter through Cloudflare Email Service. The link creates or retrieves your account without a password. It expires after fifteen minutes and can only be used once. We temporarily retain your address, a hash of the link and a hash associated with the requesting browser to verify the request and limit abuse; expired requests are automatically deleted. A different browser must explicitly confirm the address before opening a session. Sign-in emails are transactional and do not subscribe you to a newsletter.

Website sign-in with Google: the only permissions requested are openid email. They confirm your identity and email address to create or retrieve your Rush Clipping account. This sign-in does not grant access to Gmail, Google Drive or your YouTube channel. Google, Discord and email-link sign-ins retrieve the same account when their verified email address matches. An unverified address does not allow automatic account merging. The emailed link must be opened to confirm an email sign-in.

Google tokens received for this sign-in are verified on the server and then discarded from request memory; no Google access or refresh token is retained. Only the derived account identifier, verified email, website profile and a Rush Clipping session are stored. You can revoke this connection in your Google account and request account deletion as described in section 7.

When you choose to connect YouTube, Google displays its consent screen. The requested permission is youtube.readonly: it confirms the channel you authorize and reads its information. We use the channel identifier, public name and available username to associate it with your Rush Clipping account.

The Google token is used during this connection operation and is not retained afterwards. We do not request offline access or store a Google refresh token. Submitted-publication statistics are consulted as part of campaign tracking.

Rush Clipping does not publish, edit or delete any video on your channel. We do not request your Google password or read your messages, contacts or Google Drive files.

The use and transfer of information received from Google APIs are subject to the Google API Services User Data Policy, including its Limited Use requirements. These data are not sold, used for advertising targeting or used to train artificial intelligence models.

TikTok accounts

To associate your TikTok account with Rush Clipping, you temporarily place the code provided by the service in your public biography. Rush Clipping reads this public profile through ScrapeCreators and checks for the code. You can remove the code after the association is confirmed.

The data used include the account identifier and public name, the public profile information needed for this check, including its biography, and the identifiers, links, publication dates and available public counters of videos submitted to your campaigns (views, likes, comments and shares). Views are used for campaign accounting; the other information supports submission attribution and checks.

This workflow uses a public-data reading provider, not TikTok Login Kit or Display API. It does not request your TikTok password or TikTok OAuth authorization, and does not access your private messages or contacts. Rush Clipping does not publish, edit or delete TikTok content on your behalf. These data are not sold or used for advertising targeting.

4. Purposes and legal bases

Data are used to provide the requested account and campaigns, attribute clips correctly, track counters and budgets, prepare campaign accounting, process payments and respond to support enquiries. Depending on the purpose, these activities rely on performance of the service, our legal obligations, our legitimate interests in security and abuse prevention, or your consent where required. OAuth connections require your authorization on the relevant platform’s official interface; TikTok public-code verification is described above.

5. Access and service providers

People authorized to manage a campaign can access the information needed to manage it and validate submissions. Campaign rankings may display participants’ display names, avatars and recorded earnings. Payment details and email addresses are not displayed to other creators.

Cloudflare provides hosting and technical storage. Social platforms receive the requests needed for connections and statistics. The relevant payment provider, including PayPal, processes the information needed for payment. These providers may operate in several countries; their own terms and data-processing safeguards apply to their services.

TikTok data reads: ScrapeCreators receives the public profile identifiers or video links needed for the requested verification and tracking. Relevant responses are processed on Rush Clipping’s server; your payment details and sign-in email address are not needed for these reads. See also TikTok’s Privacy Policy.

6. Retention

Sessions are time-limited. Temporary elements of the YouTube OAuth flow expire after ten minutes. Account and campaign information is retained to provide and secure the service. Information needed to substantiate campaign accounting, payments, disputes and accounting obligations is retained for the periods applicable to those purposes.

The current TikTok workflow does not collect TikTok access or refresh tokens. Removing an account association stops its use for new submissions; it does not erase observations and supporting records needed for campaigns, campaign accounting, payments or disputes. Historical account identifiers are not reassigned to another participant. Requests to delete data no longer needed for these purposes can be sent to our contact, as described in section 7.

7. Disconnecting, revocation and deletion

You can manage linked accounts in Accounts. Removing an active association retains the necessary history of clips, observations and payments. Restrictions relating to unsettled campaigns are displayed before the action.

You can revoke Google authorization in your Google account permissions. The Google Privacy Policy describes Google’s processing.

To request access, rectification, erasure of data not legally required, restriction, applicable portability, or to exercise your right to object or withdraw consent, contact contact@rushmp4.com. You can also lodge a complaint with the CNIL.

8. Data protection and security

We apply the following measures to protect personal data, including sensitive data and information received from Google and YouTube APIs, against unauthorized access, disclosure, alteration or loss:

• Encryption in transit: exchanges between your browser and Rush Clipping, and requests to Google and YouTube APIs, use HTTPS/TLS. Communications with the Cloudflare D1 database are also encrypted in transit.
• Encryption at rest: data in our private Cloudflare D1 database, including YouTube channel identifiers associated with accounts, are encrypted at rest with AES-256 by Cloudflare, which manages the encryption keys. Payment details also receive application-level AES-GCM encryption before storage.
• Restricted and controlled access: the server checks sessions, identities and permissions before granting access to private data. Participants access their own information; managers access information needed for campaigns they are authorized to manage. The Admin area is reserved for the owner and requires an additional time-limited unlock.
• Technical credential protection: application secrets, including the Google OAuth client secret and service keys, are kept in encrypted Cloudflare Workers secrets and used on the server. They are not sent to the browser.
• Google connection protection: the OAuth flow uses S256 PKCE and a random browser-bound state, valid for ten minutes and usable once. Website sign-in identity tokens are checked against Google’s public keys, the intended client, expiration time and a nonce. YouTube confirmation remains a separate flow tied to the session and participant.
• Google data minimization: the access token is used only in server memory while confirming the channel; it is not stored in the database, browser or application logs. We do not request offline access or retain a Google refresh token. We retain the channel information needed to associate it with your account, as described in section 3.
• Session protection: authentication cookies are marked Secure, HttpOnly and SameSite. Sessions expire, and their tokens are stored as hashes on the server. OAuth responses use no-store to prevent caching.

The service does not collect passwords for your Google, social or payment accounts. To report a security issue or request data deletion, contact contact@rushmp4.com; revocation procedures and applicable rights are described in section 7.

9. Cookies and audience measurement

Session and security cookies are necessary for sign-in and OAuth flows.

Optional audience measurement is disabled by default. After your explicit agreement on the Cookies page, a random browser identifier, valid for 90 days, is used to count visits and calls-to-action clicks. After sign-in, these visits and sign-ins may be associated with your account to understand website usage. This history is retained for 90 days and accessible only to the owner in a protected Admin area. Without agreement, this measurement records no visit identifier, navigation, click or sign-in events.

Account data and session logs needed to provide and secure the service remain separate from this optional measurement. We do not record the contents of input fields, URL parameters or a device fingerprint in analytics. These data are not sent to an advertising service. You can refuse or withdraw agreement at any time on the Cookies page and exercise your rights through our contact. Withdrawal stops future collection; it does not automatically delete earlier events, which remain subject to their retention period.

10. Contact and updates

For any questions: contact@rushmp4.com. This page is updated when features or processing activities change. See also our Terms of Service.