Privacy Policy

1. Data controller

AERES Digital is the controller of the personal data processed to operate the Rufus website, accounts, subscriptions and licenses. Privacy questions and requests can be sent through the support channel listed under “Contact” in this policy.

2. Core principle: your videos stay on your Mac

Rufus is a native app. Videos, audio, transcripts, projects and exported files are processed and stored locally on your computer. Transcription uses a model that runs on your Mac. AERES does not receive, host or have access to your project content unless you send something to us voluntarily, for example when asking for support.

When you choose to use an external service (such as AI providers, cloud rendering or social networks), data travels directly between your Mac and that service, using the account and credentials you configured yourself. See section 5.

3. Data we collect

• Account data: name and email address provided when you create an account or sign in with an access code.
• Billing data: billing country, CPF or CNPJ (for customers in Brazil, as required by tax rules), subscribed plan, subscription history and invoices. Card details are collected and processed directly by Stripe; AERES does not store full card numbers.
• License and device data: a technical identifier for each activated Mac, computer name, app version, and activation and license validation dates. We use this data to unlock the Pro plan and enforce the subscription’s computer limit.
• Website session data: strictly necessary cookies that keep you signed in (access and refresh tokens in httpOnly cookies) and a cookie that remembers your chosen language.
• Technical data: IP address, browser type, access date and time, and error logs generated by our servers, kept for security purposes and to comply with Brazil’s Internet Civil Framework (Law No. 12,965/2014).
• Support communications: messages, files and contact details you send us, including via WhatsApp.

4. Purposes and legal bases

We do not sell personal data. We do not use the content of your videos to train artificial intelligence models.

• Create and maintain your account, authenticate access and provide the Service — performance of a contract (LGPD art. 7, V).
• Process payments, charge subscriptions and issue tax documents — performance of a contract and compliance with legal obligations (art. 7, II and V).
• Validate licenses, prevent misuse, fraud and abuse, and protect the security of the Service — legitimate interest (art. 7, IX) and performance of a contract.
• Answer support requests and send operational messages about your account, billing and relevant changes — performance of a contract and legitimate interest.
• Keep access logs and comply with requests from authorities — compliance with legal or regulatory obligations.
• Send news and offers — only with your consent, which you may withdraw at any time.

5. Third-party services you connect

Some features rely on services you choose to connect, with their own accounts and terms. When you use them, transcript excerpts, text, images, videos or metadata may be sent by the app directly to those services, which act as independent controllers:

• Artificial intelligence: Claude Code (Anthropic), Codex (OpenAI) or OpenRouter, for transcript analysis and agent-built ads.
• Cloud rendering and review: HeyGen, when you connect your account to render or share HyperFrames compositions.
• Video import: yt-dlp, to download videos from YouTube links that you have the right to use.
• Publishing: YouTube, TikTok, Instagram and Facebook, when you authorize Rufus to publish to your accounts.

6. Sharing with processors and partners

We share data only as needed with: Stripe, for payments and subscription management; hosting, infrastructure and email providers that operate the website and the account system; GitHub, which hosts the app installer; WhatsApp (Meta), when you choose to contact us through that channel; accounting and legal advisers; and public authorities, when required by law or court order.

The home page may show YouTube videos in privacy-enhanced mode (youtube-nocookie.com). The player loads only when you choose to play a video, after which Google’s privacy policy applies.

7. International transfers

Some partners, such as Stripe, GitHub and AI or hosting providers, may process data outside Brazil, including in the United States. In these cases we rely on the safeguards set out in LGPD art. 33, such as contractual clauses and the selection of providers with adequate data protection commitments.

8. Cookies

The website uses only cookies required for it to work: account session (renewed for up to 30 days) and language preference (up to one year). We do not use advertising cookies or third-party tracking tools. You can delete cookies in your browser at any time; doing so will sign you out.

9. Retention

We keep account data while the account is active. After it is closed, we delete or anonymize the data, except what we must keep by law: tax and billing records (generally up to 5 years) and application access logs (at least 6 months, under the Internet Civil Framework). Support data is kept for as long as needed to resolve the request and any follow-up.

10. Security

We apply reasonable technical and organizational measures to protect data, such as HTTPS connections, httpOnly cookies, short-lived access tokens, origin checks on account requests and restricted system access. No system is completely immune to incidents; if an incident may create relevant risk or harm, we will notify affected data subjects and Brazil’s National Data Protection Authority (ANPD), as required by law.

11. Your rights

Under LGPD art. 18, you may request: confirmation that processing takes place; access to your data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or unlawfully processed data; portability; deletion of data processed based on consent; information about sharing; information about the option not to consent; and withdrawal of consent. You may also object to processing based on legitimate interest and lodge a complaint with the ANPD or your local data protection authority.

To exercise your rights, contact us through the channel below. We may ask for information to verify your identity before fulfilling the request.

12. Children and teenagers

The Service is not intended for people under 18 without the supervision and consent of their parents or legal guardians. Paid plans must be purchased by an adult. If we learn that a child’s data was collected without the required consent, we will delete it.

13. Changes to this policy

We may update this policy to reflect changes to the Service or to the law. The last updated date appears at the top of this page. Material changes will be announced on the website, in the app or by email.

Contact

For questions about this document or to exercise your rights, contact AERES Digital support on WhatsApp: +55 54 99655-1744