Privacy Policy

This Privacy Policy applies to OpenRush, including our website, dashboard, API, MCP server, documentation, support, communications, and related services (the "Service"). In this policy, the words we, us, and our mean Migrate LLC, a Wyoming limited liability company doing business as OpenRush.

This policy does not cover third-party websites, AI clients, platforms, integrations, or data providers that we do not control. Their own privacy policies apply to their services.

Depending on how you use OpenRush, we may collect:

• Account information: name, email address, company, workspace, login method, account settings, and support history.
• Authentication and credential information: user IDs, OAuth grants, session metadata, API key metadata, credential status, and related security records. We do not intentionally show full secret API keys after creation.
• Billing information: plan, credits, usage, payment status, transaction identifiers, invoices, tax-related details, and limited payment metadata. Payment card details are processed by our payment provider.
• Product and API information: domains, URLs, keywords, competitors, prompts, requests, responses, tool and monitor results, change logs, logs, usage records, credit charges, configuration choices, and agent/client activity.
• Connected-account information: data you authorize us to access from search, analytics, advertising, website, content, or other business accounts.
• Device and website information: IP address, browser type, pages viewed, referral information, approximate location, device identifiers, cookies, and similar technologies.

We may use information to:

• create, authenticate, and manage accounts;
• provide marketing intelligence, reports, API responses, MCP responses, and product features;
• process credits, payments, checkout sessions, invoices, and account usage;
• set up and maintain connected accounts and integrations;
• monitor reliability, prevent abuse, debug errors, and protect the Service;
• respond to support, sales, privacy, and operational requests;
• measure product onboarding, website performance, and feature usage;
• develop, train, test, and improve our products, datasets, and AI models;
• analyze information across customers (see How We Use Service Data); and
• comply with law, enforce terms, and protect rights, safety, and security.

"Customer Data" means the domains, URLs, keywords, competitors, prompts, API requests, and other inputs you submit, and the data from accounts you connect. We use it to provide, support, secure, troubleshoot, improve, and develop the Service, and for the purposes in How We Use Service Data.

You keep your rights in Customer Data. You are responsible for making sure you have permission to submit it, connect it, and instruct us to process it.

Depending on the features you use, we collect and may keep requests, responses, tool and monitor results, change logs, and agent activity ("Service Data"). We may use Service Data to provide and personalize the Service; to analyze it across customers and create benchmarks, statistics, and insights; and to develop, train, test, and improve our products, datasets, and AI and machine-learning models. Anything we share outside OpenRush from cross-customer analysis will not identify you as a source of the data.

Connected accounts. Data from connected accounts, such as search, analytics, or advertising accounts, is handled differently. We use it to provide and personalize features for your account. We use it for the other purposes above only where that platform's terms allow it and you have given any consent they require. Some platforms set further limits, such as those in Google User Data.

OpenRush is designed to work with AI agents, API clients, MCP clients, and automations. When you connect a third-party client, that client may receive, store, or process your prompts, tool calls, outputs, credentials, or related metadata under its own terms and privacy policy.

You should only connect clients you trust, use least-privilege credentials where possible, and review agent actions before relying on them for important business decisions.

You can choose to connect Google Search Console, Google Analytics, or Google Ads to OpenRush. When you do, you authorize us to read data from those accounts. For Search Console and Analytics we request read-only scopes. Google does not offer a read-only scope for Google Ads, but we use that access only to read your reporting data — OpenRush never creates, changes, or deletes campaigns, budgets, settings, or anything else in your Google accounts.

We access the following ("Google data"):

• Google Search Console: search performance data such as queries, clicks, impressions, average position, and the pages they apply to.
• Google Analytics: traffic and engagement data such as sessions, users, events, and the dimensions you report on.
• Google Ads: advertising performance data such as campaigns, ad groups, impressions, clicks, cost, and conversions, together with account details such as the account name, currency, and time zone.
• Your Google identity: the email address and account ID of the connection, so we can label and manage it.

We use this data to provide the marketing intelligence, reports, API or MCP responses, and account features described in this section. OpenRush's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Stored Google data. With your consent, we store results from your Google data, from your monitors and from requests you make. A member of your account gives this consent, and we record who consented and when. We use stored Google data to provide and improve features in your account, including history, change summaries, and personalized insights and recommendations. It is not part of the cross-customer uses described in How We Use Service Data. We delete it 30 days after you delete the monitor, withdraw consent, or disconnect that Google product, unless you reconnect it within those 30 days. To get a copy of the Google data we have stored for your account, contact us at support@openrush.com.

We do not use Google data for advertising, we do not sell it, and we do not use it to train generalized AI or machine-learning models. Humans do not read your Google data except where you ask us for support, where it is needed for security, or where the law requires it.

Google access tokens are encrypted and stored only on our backend. They are never returned to your browser, your API client, or any AI or MCP client. You can disconnect at any time from your OpenRush dashboard, which revokes our access and deletes the stored token, and you can also remove access from your Google Account permissions page.

We and our providers may use cookies, pixels, local storage, logs, and similar technologies for authentication, security, preferences, analytics, performance, and product improvement. Some cookies are necessary for the Service to work; others help us understand how people find and use OpenRush.

Your browser may let you block or delete cookies. If you disable cookies, some parts of the Service may not work properly.

We may share information with:

• hosting, infrastructure, database, observability, and security providers;
• authentication, email, support, and customer communication providers;
• payment, billing, tax, accounting, and fraud-prevention providers;
• analytics providers that help us understand website and product usage;
• marketing data, search data, website data, and integration providers needed to return requested results;
• AI clients, MCP clients, and connected applications you authorize;
• others, where information is aggregated or de-identified;
• professional advisors, auditors, insurers, and legal representatives;
• government authorities or third parties when required by law or needed to protect rights and safety; and
• a buyer, successor, or affiliate as part of a merger, financing, acquisition, reorganization, or similar transaction.

Data from your connected Google accounts goes to AI or MCP clients only when you or an agent you connected requests it. We do not share it with other users.

Depending on where you are located and how you use the Service, our legal bases may include providing the Service under a contract, pursuing legitimate business interests, complying with legal obligations, protecting vital interests, or using consent where required.

Retention periods vary based on the type of information, account status, security needs, billing and tax requirements, support needs, backups, legal obligations, and whether information is needed to prevent abuse or resolve disputes.

For monitors and saved results:

• history derived from Google data is deleted as described in Google User Data; and
• running out of credits pauses a monitor but never deletes its history.

When your account is deleted, we delete the stored results linked to it. We may keep other Service Data and usage records after removing the link to your account, along with aggregated or de-identified data.

We keep consent records permanently, including after an account is deleted, as proof of what was agreed.

When information is no longer needed, we will delete, de-identify, or aggregate it where reasonably practical, subject to backups and legal or operational requirements.

We use technical and organizational measures designed to protect information, including access controls, provider security features, credential handling practices, monitoring, and operational safeguards. No method of transmission or storage is completely secure.

You can help protect your account by using strong authentication, limiting who can access your workspace and API keys, rotating credentials when needed, and connecting only trusted clients.

We are based in the United States. If you access the Service from another country, your information may be transferred to, stored in, or processed in the United States or other jurisdictions that may have different privacy laws than your location.

Depending on your location, you may have rights to request access, correction, deletion, portability, restriction, objection, or withdrawal of consent. You may also have the right to appeal a decision we make about a privacy request.

To make a request, contact us at support@openrush.com. We may need to verify your identity and account authority before acting on a request.

If a state privacy law applies to your personal information, you may have rights to know or access the categories and specific pieces of personal information we process, correct inaccurate information, delete information, obtain a portable copy, opt out of certain uses, limit certain sensitive-information uses, or appeal a rights decision.

The Service is intended for business users and is not intended for anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor provided personal information to us, contact us and we will take appropriate steps.

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify you, such as posting the updated policy, updating the date above, or sending notice through the Service.

Contact Migrate LLC doing business as OpenRush at support@openrush.com.