Privacy Policy

1. Introduction

Doc’s Market Place LLC (“we,” “our,” or “us”) operates VistaRush (the “Services”), a short-form video sharing platform. This Privacy Policy explains how we collect, use, disclose, and protect your information.

2. Information We Collect

2.1 Information You Provide

• Account information (name, email, username, birthdate)
• Profile information (display name, bio, profile picture)
• Content you create (videos, photos, audio recordings, comments, messages)
• Purchase and transaction information (in-app coin purchases, gifts, subscriptions)
• Communications with us

2.2 Information Collected Automatically

• Device information (model, OS, device identifiers, advertising identifier)
• Usage data (videos watched, likes, follows, app interactions, session duration)
• Precise location data (GPS, when you use the Discover Nearby map feature)
• Approximate location data (from IP address)
• Advertising data (ad interactions, ad identifiers via Google AdMob)
• Crash logs and diagnostic data
• Cookies and similar technologies

2.3 Location Data

We collect the following location data:

3. How We Use Your Information

We use your information to:

• Provide and improve our Services
• Personalize content and recommendations
• Show nearby creators and content (Discover Nearby feature, using precise location)
• Communicate with you
• Ensure safety and security
• Comply with legal obligations
• Detect and prevent fraud, abuse, and illegal activity
• Serve and measure advertisements (via Google AdMob)
• Process in-app purchases and transactions (via Stripe)

3.1 Advertising & Tracking

We use Google AdMob to serve advertisements within the app. AdMob may collect and use the following data for personalized advertising:

• Device advertising identifier (IDFA on iOS, GAID on Android)
• Usage and interaction data
• Approximate location

On iOS, you will be prompted via Apple’s App Tracking Transparency (ATT) framework before any tracking occurs. You may decline tracking at any time through your device settings. If you opt out, you will still see ads, but they will not be personalized.

3.2 Third-Party Services

We share data with the following third-party services:

• Google AdMob: Advertising identifiers and usage data for ad serving
• Stripe: Payment processing (we do not store payment card details)
• Bunny CDN: Video hosting and delivery
• Firebase: Push notifications and crash reporting
• Google Cloud Vision: Content safety (CSAM detection)
• MongoDB Atlas: Database hosting
• Mistral AI: Text and image understanding for captions, tagging and content suggestions
• Agora & LiveKit: Real-time audio and video for live rooms and calls
• AudD: Music recognition from short audio excerpts
• Resend: Transactional email such as password resets and parental-consent requests
• DigitalOcean: Application hosting

4. Legal Basis for Processing (GDPR)

We process your data under the following legal bases:

• Consent: Cookie tracking, marketing communications
• Contract: Providing Services you signed up for
• Legitimate Interest: Security, fraud prevention, service improvement
• Legal Obligation: COPPA, CSAM detection, law enforcement requests

5. Child Safety (COPPA Compliance)

Our Services are NOT intended for children under 13. We:

• Require users to be 13+ years old
• Verify age at signup
• Delete accounts of users found to be under 13
• Do not knowingly collect data from children under 13

If you believe a child under 13 is using our Services, contact us immediately at [email protected].

6. CSAM Detection

We use automated systems (Google Cloud Vision API) to detect child sexual abuse material (CSAM). Detected content is:

• Immediately removed
• Reported to the National Center for Missing & Exploited Children (NCMEC)
• Preserved for law enforcement (90 days minimum)
• Investigated by our team

7. Your Rights (GDPR & CCPA)

You have the right to:

• Access: Request a copy of your data
• Delete: Request deletion of your account (30-day grace period)
• Export: Download your data in JSON format
• Correct: Update incorrect information
• Object: Opt-out of certain processing

To exercise your rights:

• Account Deletion: Settings → Delete Account
• Data Export: Settings → Download My Data
• Other requests: [email protected]

8. Data Retention

• Active accounts: Data retained while account is active
• Deleted accounts: 30-day grace period, then permanent deletion
• Compliance logs: 7 years (legal requirement)
• CSAM reports: 90 days minimum (federal law)

9. Data Security

We implement:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest (database encryption)
• Access controls and authentication
• Regular security audits
• CSAM detection and content moderation

10. Contact Us

For questions about this Privacy Policy: