Privacy policy

Who we are

RapidCreate (“we”, “us”, “our”) is the website at rapidcreate.io and the RapidCreate app. RapidCreate is run by a business based in the United Kingdom.

You can reach us at support@rapidcreate.io.

We are the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What we keep on our server

Your account. Your email address. If you sign in with Google, also the name and profile picture Google shares with us. We don’t use passwords.

Your plan. Which plan you have, its status and renewal date, and the customer reference our payment provider, Stripe, gives us. Stripe holds your card and billing details; we never see your full card number.

Your credits. Your balance, and a ledger of credits granted, held, spent and refunded.

Your jobs. For each piece of AI work, a record of its kind (for example, “video script” or “post”), how many videos or posts it covered, whether it succeeded, when it ran, the number of AI tokens it used and what it cost us. This is how we charge credits fairly, refund failures and keep prices sustainable.

Your devices. For each computer signed in to the app: the name the computer gives itself, its operating system, the app version and when it was last used. We keep only a scrambled (hashed) form of the device’s sign-in token, never the token itself. We also keep a scrambled identifier of the computer, which the app makes, so that the free first videos are offered once for each computer and an invite between two accounts on one computer isn’t counted.

Your free first videos. When a new account is given its free first run, we record that it was claimed, with scrambled (hashed) forms of your email address, of the computer’s identifier and of the IP address it was claimed from. We use the record only to stop the offer being claimed again.

Invites. If you open a friend’s invite link or share your own, we record which account invited which and how the invite stands (signed up, on a plan, rewarded). The friend who invited you sees that, beside a masked form of your email address (its first letter and its domain), never the address in full. To stop people inviting themselves, we compare the two accounts’ computers and ask Stripe whether they paid with the same card; we never see the card number.

Emails about your account. We email you when you join, when a plan starts, when your credits run low and when an invite of yours moves on. We keep a note that the welcome was sent, and of the low-credits notice for each billing period, so that neither is sent twice.

The waitlist. If you join the waitlist: your name, email address, which computer it’s for, anything you choose to tell us, when you joined, the page and campaign tags you came from, your country, and a scrambled (hashed) form of your IP address used only to stop repeat submissions. We use it only to email you about RapidCreate’s launch, and every email has an unsubscribe link. If you later create an account with the same email, we link the two.

Messages to us. If you email us, we keep the conversation so we can help you.

Technical logs. Our hosting records requests to the website and the server, including IP addresses, to keep the service secure and working. Our logs hold ids and counts, never your content or sign-in tokens.

What we don’t store

We don’t keep your brand kits, your hooks, the scripts and posts we write for you, your pictures or your videos.

When the app asks our server to write a video or a post, it sends the inputs for that one request, such as a hook and your brand details. Our server passes them to our AI provider, returns the result to the app and keeps only the job record described above. The content itself is not saved.

When the app searches for stock footage, photos or music, the search goes through our server. We may keep the results of a search for a short time so the next search for the same words is faster, but not who searched.

The app on your computer

RapidCreate is a desktop app, and most of its work happens on your computer, not on our server:

• Your projects, brands, media library, exports and settings are stored on your computer.
• Cutting, captioning, rendering and exporting happen on your computer.
• Transcription (turning speech into captions) runs on your computer. Your audio is not uploaded.
• Stock searches go through our server, which asks Pexels, Pixabay or Openverse for you: they see the search words, not who you are. We keep their answers for a day to share between searches, and we don’t log the words.
• Stock files download straight from the provider to your computer, so that provider sees your IP address, as any website you visit would. Their own privacy policies apply.

The app keeps its sign-in token in your operating system’s encrypted storage. If the app runs into an error, it may send us an error report (see Sentry below).

Who handles your data for us

We use these service providers. Each works under a contract that requires it to protect your data, and each uses it only on our instructions, with one exception: as well as handling payments for us, Stripe uses payment data for its own purposes, such as preventing fraud and meeting its legal duties, under its own privacy policy.

• Supabase

  Sign-in and our database

  Your account, plan, credits, job records and signed-in devices

• Vercel

  Hosts this website and our server

  Requests to the site and the server, including IP addresses, in short-lived logs; cookieless page-view counts

• Google Analytics

  Counts visits to this website, with your consent

  Only if you accept analytics cookies: the pages you view, the site that sent you, your browser and device type, an approximate location, and a random number kept in a cookie. Google Analytics doesn’t store IP addresses

• Stripe

  Payments and subscriptions

  Your name, email, billing address and payment details. We never see your full card number

• Our AI provider

  Writes scripts, posts, hooks and captions

  The inputs for each request (your hook, brand details, pictures to judge) and the result, without your name or email

• Resend

  Sends our emails

  Your email address and the email we send you, such as a sign-in link and code

• Sentry

  Error reports from the site and the app

  Technical details of an error, such as the app version, operating system and where it failed, with request bodies removed

Our AI provider processes the inputs for each request only to return the result. Under its commercial terms, it does not use them to train its models.

We may also share data when the law requires it, to protect people’s safety or our rights, or with a buyer if our business is sold (in which case this policy continues to apply to your data).

We never sell your personal data, and we don’t use it for advertising.

Website analytics

We count visits to pages of this website in two ways. Vercel Web Analytics runs without cookies and can’t recognise you on a later visit. Google Analytics runs only if you accept analytics cookies: until then it isn’t loaded, and nothing is sent to Google. It is never used for advertising. You can change your answer at any time from “Cookie settings” at the foot of any page. See our Cookies policy.

Why we use your data

UK GDPR requires a lawful basis for each use:

• To provide RapidCreate (your account, sign-in, credits, jobs, devices and payments): because it is necessary for our contract with you.
• To keep the service secure and working (technical logs, error reports, fair-use limits and fraud prevention): our legitimate interest in running a safe, reliable service.
• To understand how the website is used: your consent for Google Analytics, which you can withdraw at any time; our legitimate interest in improving the site for the cookieless page counts.
• To keep financial records: because the law requires it.
• To email you about the launch (the waitlist): because you asked us to, and you can unsubscribe at any time.
• To send you product news: only if you have agreed, and you can opt out at any time. Emails about your account, plan or security are not marketing and don’t need consent.

How long we keep it

• Your account, plan, credits, job records and devices: for as long as your account is open. When you close it, we delete them, or make them anonymous, within a reasonable time.
• A device you sign out, or that hasn’t been used for a long time, loses its sign-in token.
• The record that a free first run was claimed (scrambled email address, computer and IP address): kept after the account is closed, for as long as we make the offer, because deleting it would let the same person claim it again.
• Sign-in links and codes expire after a short time and can be used only once.
• Payment and tax records: for as long as UK tax and company law requires.
• Technical logs and error reports: for a short period, set by our providers.
• Emails with us: for as long as we need them to help you, and then deleted.
• The waitlist: until you unsubscribe, or until the launch emails are no longer needed, and then deleted.

International transfers

Some of our service providers are based in, or process data in, the United States and other countries outside the UK. When your data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where a provider is certified under it) or on the safeguards the Information Commissioner approves, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• restrict or object to how we use it;
• receive it in a portable format;
• withdraw consent where we rely on it.

To use any of these rights, email support@rapidcreate.io from the address on your account. We’ll reply within one month. It is free.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.

Security

We protect your data with encryption in transit, access controls that limit each account to its own records, and by storing sign-in tokens only in hashed form. Our AI and payment keys stay on our server and never ship in the app. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the ICO as the law requires.

Children

RapidCreate is not meant for children. You must be at least 18 to create an account, and we don’t knowingly collect data from anyone younger.

Changes to this policy

If we change this policy in a way that matters, we’ll tell you by email or in the app before the change takes effect. The date at the top shows when it last changed.

Contact

For anything about your data or this policy, email support@rapidcreate.io.