1. Scope

This policy describes information processed by Ruliad's website, production workspace, and integrations with AI assistants, including the Ruliad plugin for ChatGPT and Codex. It covers creating and managing ads, approved reference assets, generation, editing, review, and export.

2. Information we process

• Account and connection information: Your email, account and workspace identifiers, sign-in information, approved permissions, and records used to authenticate and revoke an assistant connection.
• Production content: Briefs, prompts, scripts, brand information, reference images and other uploaded media, talent and likeness permissions when applicable, generated images, video and audio, saved timelines, revisions, review links, and exports. Content you submit may contain personal information.
• Usage and billing records: Requested operations, generation and render jobs, model and provider usage, cost estimates, reservations, actual cost receipts, balances, budget limits, and payment-processor customer and transaction identifiers.
• Operational and support information: Request times, network and device information provided to our infrastructure, service errors, security and audit events, and messages or attachments you send to support.

3. How the ChatGPT and Codex connection works

When you connect Ruliad, you approve the listed account permissions. Ruliad receives the task-specific tool arguments and files that the assistant sends, and returns the project information, job status, media links, or results needed for that task. The integration does not request or retrieve your full ChatGPT or Codex conversation history.

An image selected for reference import is copied into your account's production storage so it can be reused in saved scenes and revisions. Generation sends the relevant scene instructions and selected reference media to the service providers that perform that operation. Tool results returned to ChatGPT or Codex are processed by OpenAI under its applicable terms and privacy policy.

The plugin uses scoped authorization rather than asking for your Ruliad password in a chat. Do not put passwords, API keys, payment-card details, government identifiers, or health information in prompts or reference files. Ruliad's separate sign-in and payment pages handle authentication and payment setup; the production plugin cannot charge a card, purchase funds, or enable automatic top-ups.

4. Purposes of use

We use this information to authenticate you, enforce workspace ownership and permissions, carry out the production and editing tasks you request, preserve saved work and reference continuity, deliver reviews and exports, meter actual usage, enforce spending limits, reconcile interrupted jobs, prevent misuse, investigate errors, provide support, and meet legal and accounting obligations.

5. Recipients and service providers

We disclose the information needed for an operation to infrastructure, authentication, storage, AI-generation, media-processing, payment, and support providers. These include Google Cloud and Firebase for hosted infrastructure and storage, OpenAI for applicable assistant and AI operations, Stripe for payment processing, and the image, video, voice, or music provider used for the requested production operation. Those providers process information under their applicable service terms and privacy practices.

When you request a review link or share an exported file, the intended recipients may access the material made available through that link. We may also disclose information when required by law or reasonably necessary to protect security, investigate abuse, resolve disputes, or protect legal rights. This policy does not grant an assistant permission to access another customer's workspace or distribute your content outside the requested task.

6. Retention and deletion

• Accounts and saved productions: Saved projects, references, generated media, and editorial revisions persist for continued use; they do not expire when a chat ends or a connection is disconnected. We retain them while the account and saved work remain in use, unless you delete them through available controls or request deletion through support.
• Connection validity: A pending connection request is valid for 10 minutes, an authorization code for 5 minutes and one exchange, an access token for 15 minutes, and a refresh token for up to 30 days before renewal. Revocation prevents further use of the affected connection. These access lifetimes do not mean that the underlying account, production, or connection audit records are automatically deleted.
• Operational logs: The production project's default operational-log bucket retains entries for 30 days. Separate billing, security, legal-audit, and saved production records are not governed by that log-bucket period.
• Billing and audit records: Financial ledgers and usage receipts have no automatic expiry in the application. We retain records needed to reconcile balances and pending operations, meet applicable accounting and legal obligations, resolve disputes, and prevent fraud. A deletion request is reviewed against these obligations; we do not describe unresolved usage as settled or erase required financial evidence.

Deletion from active application storage may not immediately remove backup copies, existing recipient downloads, or records that a service provider must retain. Contact us to request deletion and an explanation of any information that must remain and why. Disconnecting the plugin or deleting a ChatGPT conversation alone does not delete the corresponding saved Ruliad production.

7. Your controls and choices

You choose which account to connect, whether to approve the requested permissions, which content and references to provide, what production actions to request, and what budget to authorize. You can disconnect the integration using the assistant platform's connection controls. You can edit saved work through Ruliad's available controls and contact us to request access, correction, export, deletion, or revocation of account data and permissions. We verify requests to protect the account owner.

By uploading an image, you confirm that you have permission to use and share it for the requested production. Ruliad does not require a separate pictured-person signature, campaign-specific likeness form or independent approval. Image uploads do not authorize voice cloning. Review-link expiry limits future access through that link; it does not remove copies already downloaded by an authorized recipient.

8. Security and children

We use authentication, account and workspace authorization, scoped assistant permissions, and technical safeguards to protect information. No storage or transmission system can be guaranteed completely secure. Ruliad is not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe such information has been provided.

9. Changes and contact

We may update this policy to reflect changes in the service or applicable requirements. The date above identifies this version. For privacy, access, correction, deletion, security, or rights requests, contact info@theruliad.ai or 310.821.7600.