Rush — Privacy Policy

Last Updated: July 31, 2026 Effective Date: July 31, 2026 Version: 3.0 (Business Model v4 alignment — added disclosure of Stripe Financial Connections for Firm bank-account verification and ACH authorization; clarified weekly Friday payout data processing.)

Rush Marketplace, Inc. ("Rush", "we", "us", or "our") respects your privacy. This Privacy Policy describes how we collect, use, disclose, and protect information when you use the Rush Platform (the mobile application, website, and related services).

By using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree, do not use the Platform.

1. Scope

This Privacy Policy applies to:

• Workers: Individuals who create a Worker account and use the Platform to apply for or perform Shifts.
• Firms: Business entities (and their authorized representatives, including designated Managers) that create a Firm account and use the Platform to post Shifts.
• Visitors: Individuals who visit the Rush website or interact with the Platform without creating an account.

Additional terms may apply to specific features (for example, Stripe Connect account creation is subject to Stripe's Privacy Policy, which is separate from this Policy).

2. Data Controller

Rush Marketplace, Inc., a Delaware corporation with a principal address at 2810 North Church Street, Suite 88801, Wilmington, DE 19802, is the data controller for personal information collected through the Platform.

For privacy-related inquiries, contact:

• Email: privacy@rushshifts.com
• Mail: Rush Marketplace, Inc., Attn: Privacy, 2810 North Church Street, Suite 88801, Wilmington, DE 19802

3. Information We Collect

3.1 Information You Provide Directly

Account creation:

• Full name
• Date of birth
• Email address
• Mobile phone number
• Profile photograph (optional)
• Password (stored in salted/hashed form; Rush never stores your plaintext password)

Worker-specific:

• Skills and work history (self-declared)
• Bank account information for payouts (collected and stored by Stripe; Rush stores only a tokenized reference)
• Tax identity information (Social Security Number or Individual Taxpayer Identification Number, collected by Stripe for 1099 reporting; Rush does not store this data)
• Self-declared work eligibility status
• Optional government-issued identification (for identity verification; retained per Section 6)

Firm-specific:

• Business legal name, d/b/a, and operating address
• Employer Identification Number ("EIN") or equivalent tax identifier
• Business contact information (phone, email)
• Bank-account verification and ACH authorization data — collected by Stripe via Stripe Financial Connections (or comparable Stripe-provided instant bank-verification technology) at the time the Firm links a business bank account for ACH debit under Section 4 of the Firm Terms and Conditions. Financial Connections may collect the Firm's online-banking credentials or read-only account metadata (institution, account number, routing number, account holder name, account type, and, for verification purposes, recent transaction history and balance information) directly from the Firm's financial institution. Stripe does not disclose banking credentials to Rush. Rush receives only tokenized references, verification status, account nickname/last four digits, and NACHA-authorization records.
• Backup Card information — collected and stored by Stripe; Rush stores only a tokenized reference and card brand + last four digits.
• Business photos and descriptions
• Manager contact information (name, phone, email — collected with Manager's consent when added by a Firm)

Communication content:

• Messages exchanged between Workers, Firms, Managers, and Rush support
• Support tickets and correspondence

3.2 Information Collected Automatically

• Device information: device model, operating system, browser type and version, unique device identifiers
• Network information: IP address, Internet Service Provider, general geographic location derived from IP
• Platform usage: pages visited, features used, search terms, time spent on the Platform, referrer URLs, click patterns
• Cookies and similar technologies: see Section 8

3.3 Location Information

Rush collects location information for the following purposes:

• Verifying Worker presence at a Shift location at check-in and checkout ("Shift-level GPS verification")
• Calculating distance from Worker to available Shifts
• Fraud prevention (detecting Shift attempts by Workers far from the posted location)
• Dispute resolution

Precise geolocation is collected only when the Worker or Firm has granted the corresponding permission on their device. Workers may revoke location permission at any time through device settings, but doing so will limit the Platform's ability to verify Shift completion and may affect Worker Reliability Score.

Rush does not collect continuous background location. Location is captured only around Shift check-in and checkout events, and while the Rush application is actively in use.

3.4 Information From Third Parties

• Stripe: payment status, payout status, tokenized identity references, KYC verification status, ACH-debit success/return status, and, for Firms, tokenized bank-account references and NACHA-authorization records returned from Stripe Financial Connections
• Stripe Financial Connections: for Firms only — instant bank-account verification data (tokenized account and routing references, ownership verification, and account-status signals) returned to Rush when a Firm links a business bank account for ACH debit under Section 4 of the Firm Terms and Conditions. Rush does not receive online-banking credentials or full transaction history from Financial Connections; Stripe does.
• Communication providers: phone-number verification signals
• Analytics providers: aggregated usage data
• Public records: for the limited purpose of verifying Firm business registration

3.5 Sensitive Personal Information

The following categories of "sensitive personal information" under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA"), may be collected through the Platform:

• Government-issued identification (Worker ID upload, if provided)
• Precise geolocation (Shift-level GPS)
• Racial or ethnic origin, religious beliefs, and health information (only if voluntarily disclosed by a Worker in messaging; Rush does not solicit this information)

Rush uses sensitive personal information solely for the purposes described in this Policy, including identity verification, fraud prevention, and Shift verification. Rush does not use sensitive personal information for cross-context behavioral advertising or profiling in furtherance of decisions producing legal or similarly significant effects concerning a consumer.

You have the right to limit our use of sensitive personal information — see Section 10.

4. How We Use Data

Rush uses personal information for the following purposes:

Operations and account management:

• Creating, maintaining, and securing accounts
• Verifying identity and eligibility
• Matching Workers with Shifts posted by Firms
• Processing applications, offers, and confirmations
• Facilitating communication between Workers, Firms, and Managers

Payments:

• Verifying Firm bank-account ownership and initiating ACH debits via Stripe (using Stripe Financial Connections)
• Processing ACH and card charges to Firms and disbursing Weekly Payouts to Workers via Stripe
• Managing new-Firm underwriting, exposure caps, and returned-ACH handling as described in Section 4A of the Firm Terms and Conditions
• Detecting and preventing payment fraud

Platform integrity:

• Enforcing Terms and Conditions, including Section 3A (Prohibited Businesses) and Section 5C (Content Standards)
• Detecting and preventing fraud, spam, and abuse
• Computing Reliability Scores
• Resolving disputes
• Content moderation (automated and human review of postings and messages for compliance)

Product improvement:

• Analyzing usage patterns to improve the Platform
• Developing new features
• Aggregated analytics (data is de-identified or aggregated before use)

Legal compliance:

• Complying with subpoenas, court orders, government requests, and legal obligations
• Enforcing our legal rights
• Responding to law enforcement requests

Communications:

• Sending transactional messages (Shift confirmations, offer notifications, payout notifications) via SMS, email, or push notification
• Sending Platform updates, safety notices, and administrative messages
• With your consent, sending marketing communications (you may opt out at any time)

5. How We Share Data

Rush does not sell personal information for money, and does not "share" personal information for cross-context behavioral advertising as those terms are defined under CCPA/CPRA.

Rush discloses personal information in the following limited circumstances:

Between users:

• Firms see: Worker name, profile photo, Reliability Score, skills, rating history for this Firm, and Shift-related communications
• Workers see: Firm business name, location, photos, ratings, and Shift-related communications
• Managers (added by Firms) see: information necessary to run Shifts assigned to them

Service providers ("processors"):

• Stripe (including Stripe Connect, Stripe Financial Connections, and Stripe Express) — payment processing, ACH debit initiation, Firm bank-account verification, KYC verification, Worker Connect Express account creation, Weekly Payout disbursement
• Cloud infrastructure providers — hosting, storage, backup
• Communication providers — email delivery, SMS delivery, push notification delivery
• Analytics providers — aggregated usage analysis
• Content moderation providers — automated review of postings for compliance with Section 5C of the Firm Terms and Conditions
• Customer support tools — ticket management, communication routing

All service providers are contractually bound to use personal information only to perform services on Rush's behalf and not for any independent purpose.

Legal disclosures:

• In response to a subpoena, court order, or other legal process
• To comply with applicable law or governmental regulation
• To protect the rights, property, or safety of Rush, our users, or the public
• To investigate or prevent fraud or abuse of the Platform
• To enforce our Terms and Conditions

Corporate transactions:

• In connection with a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of all or substantially all of our assets, or other transfer of business, personal information may be transferred to the successor entity. In such event, we will provide notice to affected users.

Aggregated and de-identified data:

• Rush may share aggregated or de-identified data with third parties for research, industry analysis, marketing, or other lawful purposes. Such data cannot reasonably be used to identify a specific individual.

6. Data Retention

Rush retains personal information for as long as necessary to fulfill the purposes described in this Policy, subject to legal and regulatory retention requirements:

After the applicable retention period, personal information is deleted, de-identified, or aggregated in accordance with industry-standard secure-deletion practices.

Where you exercise a valid right to deletion under Section 10, we will delete or de-identify your personal information within the timeframes required by applicable law, except where retention is required by law or is necessary to protect Rush's legal interests.

7. Data Security

Rush implements administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, and destruction, including:

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent)
• Access controls, role-based permissions, and multi-factor authentication for internal systems
• Regular security assessments and penetration testing
• Employee training on data protection

No security system is impenetrable. Rush cannot guarantee the security of personal information. In the event of a data breach affecting your personal information, Rush will notify you as required by applicable law.

8. Cookies and Similar Technologies

Rush uses cookies, local storage, session storage, and similar technologies for the following purposes:

• Essential: authenticating your session, remembering your login state, security tokens
• Functional: remembering preferences (language, filters)
• Analytics: aggregated usage measurement
• Performance: load-time optimization

Rush does not use cookies for cross-context behavioral advertising.

You may control cookies through your browser settings. Disabling essential cookies will impair Platform functionality.

Rush honors Global Privacy Control (GPC) signals as an opt-out request under CCPA/CPRA where applicable.

9. Your Privacy Rights

9.1 All users

You may:

• Access your account information through the Platform's Profile settings
• Correct inaccurate account information through the Platform or by contacting privacy@rushshifts.com
• Delete your account through the Platform's Profile → Delete Account flow, subject to Section 6 retention obligations
• Opt out of marketing communications at any time via the unsubscribe link in emails or by contacting privacy@rushshifts.com
• Withdraw consent for location tracking through device settings

9.2 California residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information Rush has collected, used, disclosed, and shared about you
• Delete personal information Rush has collected from you, subject to legal exceptions
• Correct inaccurate personal information Rush maintains about you
• Opt out of the "sale" or "sharing" of personal information (Rush does not sell or share personal information for cross-context behavioral advertising)
• Limit the use of sensitive personal information to purposes necessary to provide the services (see Section 3.5)
• Non-discrimination for exercising these rights

To exercise these rights, contact privacy@rushshifts.com or use the Platform's Privacy Request form (Profile → Privacy → Submit Request).

Rush will respond within forty-five (45) days, subject to a one-time forty-five-day extension where reasonably necessary.

Rush uses reasonable methods to verify your identity before responding to a rights request. This may include confirming information already associated with your account (email, phone number, transaction history). If we cannot verify your identity, we may deny the request and will explain why.

You may designate an authorized agent to submit requests on your behalf by providing signed written authorization. Rush may still require you to verify your own identity to Rush directly.

You may appeal a denial of your rights request by emailing privacy@rushshifts.com with "Appeal" in the subject line. We will respond to appeals within sixty (60) days.

9.3 Virginia, Colorado, Connecticut, Utah, and other state-law residents

If you reside in a state with a comprehensive consumer privacy law (including Virginia's Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, and Utah Consumer Privacy Act, and any similarly effective state laws), you have similar rights to those listed above for California residents. To exercise these rights, use the same contact methods.

9.4 EU/UK/EEA residents

Rush does not currently offer the Platform to residents of the European Union, United Kingdom, or European Economic Area. If you access the Platform from these regions, you do so at your own initiative, and processing of your personal information may not fully comply with GDPR or UK GDPR. Rush does not intend to establish a European presence at this time.

10. Automated Decision-Making

Rush uses automated systems, including algorithmic matching and Reliability Score computation, to facilitate the Platform. These systems:

• Match Workers with available Shifts based on skills, location, and history
• Rank applications for a Firm's review
• Update Reliability Scores based on Shift outcomes
• Flag potentially prohibited content for human review

These automated decisions are not fully automated in a manner producing legal or similarly significant effects on individuals — final Shift-offer decisions are made by Firms (not by Rush's system), and Reliability Score changes are based on objective, deterministic rules described in the Community Guidelines & Safety Policy.

You may request meaningful information about the logic involved and may contest a Reliability Score change or automated content-moderation decision by emailing privacy@rushshifts.com or by using the in-Platform dispute mechanism.

11. Children

The Platform is not directed to and is not intended for use by individuals under 18 years of age. Rush does not knowingly collect personal information from anyone under 18. If you believe a Worker under 18 has created an account, contact privacy@rushshifts.com and Rush will promptly investigate and, if verified, terminate the account and delete associated personal information.

12. International Users

The Platform is hosted and operated in the United States. If you access the Platform from outside the United States, your personal information will be transferred to, stored, and processed in the United States and other countries where our service providers operate. By using the Platform, you consent to this transfer.

13. Data Breach Notification

In the event of a data breach affecting your personal information, Rush will notify you and applicable regulators in accordance with the timelines and content requirements of applicable law, including without delay where required by state breach-notification statutes.

14. Third-Party Links

The Platform may contain links to third-party websites or services (for example, Stripe payout onboarding, external help articles). Rush is not responsible for the privacy practices of such third parties. We encourage you to review the privacy policies of any third-party site you visit.

15. Changes to This Policy

Rush may update this Privacy Policy from time to time. Rush will notify users of material changes by email to the account email address, by prominent in-Platform notice, or both, at least thirty (30) days before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

For non-material changes (typos, clarifications, formatting), Rush will update the "Last Updated" date at the top of this Policy without additional notice.

16. Contact

For questions, concerns, or requests related to this Privacy Policy:

• Email: privacy@rushshifts.com
• Mail: Rush Marketplace, Inc., Attn: Privacy, 2810 North Church Street, Suite 88801, Wilmington, DE 19802

For general Rush inquiries: support@rushshifts.com

For legal notices: legal@rushshifts.com