RushDB Privacy Policy

Effective date: November 3, 2026

This Privacy Policy explains how Individual Entrepreneur Artemii Vereshchinskii ("RushDB", "we", "us", or "our") collects, uses, shares, and protects information when you visit rushdb.com, use RushDB Cloud, use app.rushdb.com, interact with the RushDB API, or contact us.

RushDB is developer infrastructure for storing and querying connected application data, graph records, semantic indexes, and agent memory. This policy describes how RushDB handles account data, workspace data, project data, customer content, product telemetry, and billing information.

If you use self-hosted RushDB, you control the infrastructure where your self-hosted instance runs. This policy applies to RushDB-hosted websites and cloud services, not to data processing that happens only inside your own self-hosted deployment.

Who We Are

RushDB is operated by Individual Entrepreneur Artemii Vereshchinskii, registered in the Republic of Armenia under state registration number 264.1331568, taxpayer identification number (TIN) 72997435.

Contact: hi@rushdb.com

For security or privacy review requests, include your company name, workspace or project context if applicable, and the request type.

Information We Collect

Account information

When you create or use a RushDB account, we may collect:

• email address or login;
• first and last name, when provided;
• password hash for email/password accounts;
• OAuth identifiers for Google or GitHub login, when you use those login methods;
• email confirmation, password reset, and account status metadata;
• account creation, edit, and last activity timestamps.

RushDB does not store your plain-text account password. Passwords are hashed before storage.

Workspace and project information

RushDB Cloud stores information needed to operate workspaces and projects, including:

• workspace names, member roles, and membership metadata;
• workspace invitations and invited email addresses;
• project names, descriptions, status, timestamps, and access lists;
• API token metadata, including token name, description, scope or access level, expiration, and project association;
• OAuth client, authorization request, consent, code, and refresh-token metadata for MCP/OAuth flows;
• connector configuration and status metadata, when connectors are enabled.

API token values are stored encrypted at rest in the platform database. OAuth refresh-token records are stored as hashed token identifiers. OAuth access tokens are time-limited.

Customer content

When you use RushDB Cloud or the RushDB API, you may submit, create, import, query, or delete records, labels, properties, relationships, files, text fields, semantic indexes, relationship suggestions, connector data, and other content inside a project ("Customer Content").

Customer Content may include personal data if you choose to store personal data in RushDB. You are responsible for deciding what Customer Content you submit to the service and for ensuring that you have the rights and legal basis to process it.

RushDB processes Customer Content to provide the service, including:

• storing and retrieving records;
• creating and querying relationships;
• indexing selected fields for search or semantic retrieval;
• maintaining project schema metadata;
• running customer-requested imports, exports, connector workflows, and deletion operations;
• supporting MCP/OAuth access that you authorize for a project.

Search, embedding, and AI-related processing

RushDB supports optional Smart Search (natural-language queries), managed embeddings, semantic search, and relationship suggestions. When these features are used, the request text, project schema metadata (labels, property names, types, relationship metadata), selected text fields, or query context may be sent to the configured language-model or embedding provider to perform the requested operation.

These features are optional and depend on the project, plan, or deployment configuration. In self-hosted deployments, the deployment operator controls the provider configuration.

Billing and usage information

For RushDB Cloud, we process the billing and usage information needed to manage plans, limits, subscriptions, usage charges, and customer support. This may include:

• workspace ID and workspace name;
• account or requester email;
• plan, billing interval, subscription status, extra seats and projects, and spend-cap settings;
• usage records: stored data size per project (sampled hourly), counts of Smart Searches, managed-embedding token counts, relationship-analysis runs, and the model token counts of AI requests;
• the usage charges calculated for each usage window;
• billing inquiry messages.

Usage records contain counts and sizes, not the content of your records.

Payments. Payments are handled by Paddle.com, which acts as Merchant of Record for our orders. When you subscribe, Paddle collects and processes your payment details, billing address, and tax information under its own privacy policy. We receive from Paddle the customer and subscription identifiers, the plan purchased, transaction status and amounts, and the country and email associated with the purchase. RushDB does not receive or store full payment card numbers.

Billing records from subscriptions created before November 10, 2026 may include Stripe identifiers; we keep them only for accounting and legal purposes.

Website and product analytics

We use website and product analytics to understand how visitors and customers use RushDB, improve the product, measure conversion, and debug user flows. The website uses Google Tag Manager and Google Analytics-style events only after consent where required by our cookie banner and consent mode implementation.

Analytics events may include page views, CTA clicks, documentation clicks, pricing plan clicks, signup-start events, blog interactions, language-switch events, and limited code-copy previews. We avoid intentionally sending sensitive Customer Content in analytics events.

Cookies and local storage

We use cookies and browser storage for authentication, administration sessions, preferences, consent choices, and analytics consent. Paddle uses cookies in checkout and its customer portal.

For more detail, see our Cookie Policy at https://rushdb.com/cookie-policy.

Communications

If you contact us, request support, submit a billing inquiry, report a security issue, join a waitlist, or respond to our emails, we process the contact details and message content you provide.

How We Use Information

We use information to:

• provide, operate, secure, and improve RushDB;
• create and authenticate accounts;
• manage workspaces, projects, roles, tokens, OAuth consents, and access control;
• process Customer Content according to your API, dashboard, connector, or MCP/OAuth instructions;
• measure usage, apply plan limits and spend caps, calculate usage charges, and provide billing, support, and administrative workflows;
• send account, security, billing, product, and service communications;
• detect, prevent, and investigate abuse, fraud, security incidents, and service misuse;
• comply with legal obligations and enforce our Terms of Service;
• analyze website and product usage, subject to consent where required.

Legal Bases for Processing

We process personal data in accordance with applicable data protection laws, including the Law of the Republic of Armenia on Protection of Personal Data and, where it applies, the GDPR. Our legal bases may include:

• contract necessity, to provide RushDB Cloud and related services, including billing;
• legitimate interests, such as securing the service, preventing abuse, improving the product, and communicating with customers;
• consent, such as for optional analytics cookies or marketing communications where consent is required;
• legal obligation, where we must retain or disclose information to comply with applicable law, including tax and accounting law.

For Customer Content, RushDB usually acts as a processor or service provider on behalf of the customer. The customer is responsible for determining the lawful basis for the Customer Content they submit to RushDB.

How We Share Information

We do not sell Customer Content or personal data.

We may share information with:

• infrastructure, hosting, database, monitoring, analytics, email, authentication, and support providers used to operate RushDB;
• Paddle, our payment provider and Merchant of Record, when you purchase or manage a paid plan;
• OAuth providers such as Google or GitHub, when you choose those login methods;
• language-model or embedding providers, only when optional features that require them are used;
• professional advisors, auditors, accountants, or legal counsel where necessary;
• authorities, courts, or other parties where required by law or necessary to protect rights, safety, security, or service integrity;
• successors in connection with a merger, acquisition, financing, reorganization, or sale of assets.

Current subprocessor details can be shared with customers during security or procurement review.

International Data Transfers

RushDB is operated from the Republic of Armenia. We and our service providers may process information in other countries, including countries outside your own. If personal data from the European Economic Area, United Kingdom, or Switzerland is transferred internationally, we use appropriate transfer mechanisms where required, such as standard contractual clauses or equivalent safeguards.

Retention

We retain information for as long as needed to provide RushDB, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and maintain security.

General retention practices include:

• account, workspace, project, access, billing, and support records are retained while the account or workspace is active and for a reasonable period afterward;
• Customer Content is retained until deleted by the customer, the project or workspace is deleted, or retention is otherwise required for legal, security, backup, or operational reasons;
• usage records and calculated usage charges are retained as billing records;
• expired OAuth authorization requests, codes, refresh tokens, and related temporary records are periodically cleaned up;
• backups may retain deleted information for a limited period before normal backup expiration;
• legal, tax, billing, fraud-prevention, and security records may be retained longer where required or reasonably necessary.

Customer Controls

Depending on your account, plan, and deployment mode, you may be able to:

• access and update account information;
• create, update, export, and delete Customer Content through the dashboard, API, SDK, or MCP tools;
• create and revoke API tokens;
• authorize and revoke OAuth/MCP consents;
• manage workspace members and invitations;
• view usage, change your plan, set a spend cap, and download invoices through Billing and the Paddle customer portal;
• delete projects or request workspace/account deletion.

If you need assistance with data export, deletion, access, correction, or privacy review, contact hi@rushdb.com.

Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, object to processing, or withdraw consent for personal data. You may also have the right to complain to a data protection authority, including the Personal Data Protection Agency of the Republic of Armenia or the authority in your country.

If your personal data is contained in Customer Content controlled by a RushDB customer, we may refer your request to that customer or process the request on their instructions. For payment data held by Paddle, you can also contact Paddle directly.

Security

RushDB uses technical and organizational measures designed to protect information, including access controls, encrypted transport, password hashing, token protection, project/workspace access checks, backups, and security review processes.

No system is perfectly secure. You are responsible for using strong credentials, protecting API keys and OAuth grants, limiting Customer Content to data you are authorized to process, and configuring self-hosted deployments securely.

Children

RushDB is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, contact us so we can review and delete it where appropriate.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date and provide notice where required by law.

Contact

Individual Entrepreneur Artemii Vereshchinskii State registration number: 264.1331568 TIN: 72997435 Republic of Armenia

Email: hi@rushdb.com Website: https://rushdb.com