Who runs this site
RushAudit is an independent editorial project published at rushaudit.com. In this policy "we", "us" and "the desk" mean the editorial team that operates the site.
For any question about this policy, about the personal information we hold, or to make a privacy request, write to desk@rushaudit.com. We answer privacy requests within thirty days.
What this policy covers
This policy explains how personal information is handled when you read RushAudit, subscribe to updates, ask for a Plus seat or allow browser notifications. It is written to meet the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
RushAudit publishes reviews of mobile games and offers one optional paid membership, Plus, described in the Terms of Use. We do not run user accounts, we do not sell goods, and we do not knowingly collect personal information from children under the age of sixteen.
What we collect
- Technical log data - IP address, user-agent string, referring page, requested URL, date and time. Recorded by the hosting infrastructure and the network provider for every request.
- Cookies and similar storage - small entries kept by your browser, including the record of your choice on the cookie notice. See the Cookie Policy for the full list of categories.
- Form data - the name (optional) and e-mail address you type into the subscription form, plus the fact that you ticked the consent box and when.
- Plus membership data - if you ask for a Plus seat, your e-mail address, the state of that membership (on the waiting list, confirmed, active or cancelled) and the date it last changed. We do not receive or store card numbers, expiry dates or security codes: those are entered with our payment provider and stay with it.
- Push subscription identifiers - if you allow browser notifications, a subscription identifier generated by your browser and by our push provider, together with the browser and operating system it belongs to.
- Aggregate measurement data - counts of page views and clicks, used to understand which reviews are read.
Why we collect it, and on what basis
Technical log data is handled for the security and stability of the site and to prevent abuse. This is a necessary part of operating a website.
Form data and push identifiers are handled only on the basis of your consent, given by ticking the consent box or by allowing notifications in the browser prompt. You can take that consent back at any time - through the unsubscribe link in any message, by blocking notifications in your browser settings, or by writing to us.
Plus membership data is handled so that we can hold your place on the waiting list, tell you when a seat opens, send the digest you signed up for, and keep a correct record of when a membership started or was cancelled. Where a membership is active, that record is also kept to meet the invoicing and record-keeping duties that apply to us in Australia. Cancelling a membership does not require a reason and does not affect the free content of the site.
Cookies that are not strictly necessary are set on the basis of the choice recorded through the cookie notice.
Disclosure to third parties
We do not sell personal information. Personal information is disclosed only to the service providers listed below, and only so far as they need it to provide their service:
- Hosting and network provider - serves the pages and keeps access logs, including IP addresses.
- OneSignal - our processor for browser push subscriptions and for the e-mail addresses submitted through the subscription form. OneSignal stores the subscription identifier, the e-mail address and the tags attached to it, and delivers the messages you agreed to receive.
- Advertising networks - placements on this site may be served or measured by advertising partners, which may set their own cookies and read the identifiers described in the Cookie Policy.
- Payment provider - if you take up a Plus seat, an external provider handles the transaction and holds the card details you enter with it. We receive a confirmation that a membership is active, not your card details.
- Measurement tools - aggregate counts of page views and clicks.
- Authorities - where disclosure is required by Australian law, a court order or a lawful request.
We do not pass your e-mail address to advertising partners and we do not use it for anything other than the updates you asked for.
Storage, retention and location
Server logs are kept for up to twelve months, then deleted or aggregated beyond identification. Subscription records - e-mail address, optional name and consent record - are kept until you unsubscribe or ask for deletion, and are removed within thirty days of that request. Plus membership records are kept for as long as the membership runs and then for the period Australian record-keeping duties require, after which they are deleted. Push subscription identifiers are removed when the subscription is revoked in the browser.
Some of our providers store and process data on servers outside Australia, including in the United States and the European Union. By using the site and giving consent where it is asked for, you acknowledge this overseas disclosure. We take reasonable steps to use providers that apply comparable protection to the Australian Privacy Principles.
Security
The site is served over an encrypted connection. Access to the subscription list is limited to the editors who need it and is protected by strong authentication. No transmission over the internet is completely secure, so we cannot guarantee absolute security, but we take reasonable steps against loss, misuse and unauthorised access, and we act promptly on any eligible data breach in line with the notifiable data breaches scheme.
Your rights
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you may:
- ask for access to the personal information we hold about you;
- ask us to correct information that is inaccurate, out of date or incomplete;
- take back a consent you have given, at any time, without giving a reason;
- ask for deletion of your subscription record, your Plus membership record and your push identifier;
- ask how your information has been handled and who it was disclosed to;
- complain about the way we have handled your personal information.
Send any of these requests to desk@rushaudit.com from the address concerned, so we can be sure the request is yours. There is no charge for a request. We answer within thirty days; if we refuse access or correction, we explain why in writing.
Complaints
If you are not satisfied with our answer, you may complain to the Office of the Australian Information Commissioner (OAIC), the regulator responsible for privacy in Australia. The OAIC can be reached through oaic.gov.au or by post at GPO Box 5218, Sydney NSW 2001.
Changes to this policy
We update this policy when the site changes. The date at the top of the page always shows the current version. If a change materially affects how personal information is handled, we will make that clear on the site before it takes effect.