Privacy Policy

This policy covers rascalugc.com and the Rascal UGC application. We operate from Germany and process personal data under the GDPR.

Who is responsible

Rascal UGC is the data controller for the personal data described here. For anything in this policy, write to hello@rascalugc.com.

What we collect, and why

If you hold an account

Your email address, a hashed password or the identifier from the provider you signed in with, and your workspace and plan. We process this to perform our contract with you.

Content you upload

Reference videos, avatar images and generated output. Avatar images are likely to be photographs of identifiable people, and may therefore be biometric data under Article 9 — so upload them only where you have the consent described in the Terms of Service. We store and process this content solely to run the pipeline for you. We do not use it to train models, and we do not sell or share it.

Provider credentials

Any API token you enter, such as an Apify token, is encrypted with AES-256-GCM before it is stored and is only ever sent to the provider it belongs to. Your Codex and Kling sessions are not sent to us at all: they stay on your own machine.

Payments

Handled by Stripe. Card details go to Stripe directly and never reach our servers. We keep the customer and subscription identifier, plan, and the invoices we are required to keep for tax purposes.

Technical logs

Request logs including IP address, kept for a short period to keep the service secure and working, on the basis of our legitimate interest in operating it.

Usage analytics

We use PostHog EU to measure visits, referring websites, campaign links, feature use, signups and paid subscriptions. Usage analytics runs without analytics cookies or browser storage, including when you decline recordings. PostHog temporarily processes the IP address and browser user agent to calculate a daily visitor identifier. We do not send your name, email, workspace name, uploaded content or provider credentials as analytics properties, and we do not create analytics user profiles. We use these measurements for our legitimate interest in understanding and improving Rascal.

Cookies and optional homepage recordings

The application uses a necessary session cookie to keep you signed in. If you allow recordings in our cookie prompt, PostHog also uses a first-party cookie and browser storage to record clicks and scrolling on the homepage. Inputs and private elements are hidden. We never record the dashboard or the free tools. Recordings are kept for 30 days. We remember your recording choice for up to 180 days. You can withdraw consent at any time through Cookie preferences in the website footer. Declining recordings does not disable cookieless usage analytics. Our Cookies page explains these choices in more detail.

Who else processes your data

• Cloudflare — hosting.
• Stripe — payments, tax, and invoices.
• PostHog EU — usage analytics and optional homepage recordings, hosted in Frankfurt, Germany.
• The model providers you connect — receive the content required for the generation you asked for, under their own privacy terms.

Some of these are in the United States. Transfers rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

• Account data: for as long as the account exists; minimal account and billing records may remain after content deletion.
• Uploaded and generated content: until you delete it, or 90 days after paid access ends without renewal.
• Invoices: seven years, as tax law requires.

Your rights

You may ask for a copy of your data, correct it, delete it, restrict or object to how we use it, withdraw consent, or receive it in a portable format. Write to hello@rascalugc.com and we will answer within one month. You can lodge a complaint with a data protection supervisory authority, including the competent authority in Germany.

Changes

If this policy changes materially we will say so by email or in the application before the change takes effect.