Privacy Policy

For account information and our own operations (such as sign-in, security logs, and the emails we send you), Arrebol acts as the data controller. For content that a workspace puts into the Service, including information about the workspace’s own clients, the workspace is the controller and Arrebol processes that content on the workspace’s behalf and under its instructions. If you have questions about content a workspace holds about you, the workspace that invited you is usually the right first contact.

We do not use advertising trackers or third-party analytics on the Service today. If we ever add product analytics, we will choose a privacy-respecting approach and update this policy first. The Service also does not currently include AI features that process your content; if we add them, we will update this policy first and describe what is processed and by whom.

• Provide and operate the Service, including syncing content between workspace members and delivering client portals and review links.
• Send service emails: sign-in codes, invitations, notifications your settings allow, and invoice emails a workspace asks us to deliver.
• Send occasional product news and marketing to account holders. Every such email includes a way to opt out, and opting out never affects service emails.
• Keep the Service secure: authentication, access control, abuse prevention, and incident investigation.
• Improve the Service, using aggregate or de-identified information where practical.
• Comply with law and enforce our Terms of Service.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (operating the Service you signed up for), legitimate interests (securing and improving the Service, and sending existing account holders relevant product news, balanced against your rights), consent where required (which you can withdraw at any time), and legal obligations.

We do not sell personal information and we do not share it with advertisers. Information is shared only with:

The Service uses only cookies it needs to function. We set no advertising or analytics cookies.

We keep information for as long as your account or workspace is active and as needed to provide the Service. When content is deleted in the app, it becomes inaccessible to users and is removed from live systems, then ages out of routine backups on a fixed schedule. We may retain limited records where required by law or for legitimate business purposes such as resolving disputes.

We protect information with encryption in transit and at rest, logical isolation of every workspace’s data enforced at the database layer (row-level security), short-lived signed URLs for file access, least-privilege access to production systems, and passwordless sign-in (Google or one-time email codes, so UpRush stores no passwords). No system is perfectly secure, but if we learn of a breach affecting your personal information we will notify you and the relevant authorities as required by law.

We are based in the United States and our service providers process data primarily in the United States. If you use the Service from elsewhere, your information will be transferred to and processed in the US. Where required, transfers from the EEA, UK, or Switzerland rely on appropriate safeguards such as standard contractual clauses maintained by our subprocessors.

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have corresponding rights under the CCPA/CPRA, and we do not "sell" or "share" personal information as those terms are defined there. You will never be discriminated against for exercising your rights.

To exercise a right, email privacy@grooove.io from the address associated with your account. If your request concerns content controlled by a workspace (for example, information a creative agency holds about you as its client), we will refer it to that workspace or ask you to contact them, as GDPR-style laws direct requests to the controller. You may also lodge a complaint with your local data protection authority.

We may occasionally email account holders about new features, improvements, and other UpRush news. These emails are infrequent, come from us only (never third parties), and every one includes an unsubscribe link. You can also opt out by emailing privacy@grooove.io. Service emails, such as sign-in codes, invitations, and notifications you have enabled, are separate and are not affected by a marketing opt-out.

The Service is a business tool, is not directed at children, and may not be used by anyone under 16. We do not knowingly collect personal information from children; if you believe a child has provided us information, contact us and we will delete it.

We may update this policy as the Service evolves. If a change is material, we will give notice before it takes effect, for example by email or an in-app notice. The "Effective" date above reflects the latest revision.

Arrebol Software LLC operates UpRush. For privacy questions or requests, email privacy@grooove.io.