Privacy policy

Sample text for the theme’s demo. This page is written for Runnel Labs, an invented software company, and is not legal advice. Replace it with the text for your own product, and have that reviewed by someone qualified for your country before you publish.

This policy explains which personal data Runnel Labs Ltd (“Runnel Labs”, “we”) collects when you visit this website or the documentation, create an account, use Runnel Cloud, write to us, subscribe to release notes or apply for a job, why we do so, how long we keep it and what rights you have. It does not cover Runnel Server when you run it yourself: in that case we receive no data at all.

Who is responsible

Runnel Labs Ltd, PO Box 0000, Dublin, Ireland (company number 000000) is the controller for the personal data described in this policy. We are a remote company and have no public office. You can reach us about privacy at privacy@runnel.example; our data protection lead answers every request.

Two kinds of data

We handle personal data in two different roles, and the rules differ:

Data about you as our customer, such as your account, your team members and your billing details. For this data we are the controller, and this policy applies.
Data your jobs send to Runnel Cloud: payloads, outputs, step results and log lines. This data belongs to your organisation. We process it only to run your jobs, as your processor, under our data processing agreement. We do not look at it except when you ask us to in a support request, or when we must to keep the service secure.

What we collect, and why

When you create an account: your name, email address, the organisation and project names you enter, and a password hash or the identity your single sign-on provider sends us. We use them to run your account. Legal basis: the performance of our contract with you or your organisation.
When you use Runnel Cloud: the actions you take in the dashboard, CLI and API, with your IP address and the time, kept as an audit trail; and usage figures such as runs, concurrency and storage, for billing and capacity planning. Legal basis: the performance of our contract, and our legitimate interest in keeping the service secure.
When you pay: billing name, address, VAT number and the last four digits of your card. Our payment provider handles the full card details; we never see them. Legal basis: the performance of our contract and our legal obligations.
When you write to us through the contact form, support or Discord: your name, work email, company, expected volume and message. We use them to answer you. Legal basis: our legitimate interest in answering questions, or steps towards a contract at your request.
When you subscribe to release notes: your email address. We send one email per release, each with a link to unsubscribe, and we do not track opens or clicks. Legal basis: your consent, which you can withdraw at any time.
When you apply for a job: your name, contact details, CV and anything else you send, used only to consider your application. Legal basis: steps towards an employment contract at your request.
When you visit this website: our hosting provider processes your IP address and the pages you request so the site can be delivered and protected. Legal basis: our legitimate interest in running a secure website.

We do not sell personal data, use it for advertising, or use your jobs’ data to train models or build products.

Cookies and similar technologies

This website and the documentation use no cookies for analytics, advertising or tracking, and load no third-party trackers. If you close the announcement bar or choose a colour theme, your browser remembers that in its local storage; it is never sent to us. The dashboard at app.runnel.example sets one session cookie when you sign in, which is strictly necessary and needs no consent.

Who we share data with

We share personal data only with service providers that help us run Runnel, and only as far as each one needs it. They act as our processors (or sub-processors for your jobs’ data) under written agreements. The current list of sub-processors, with their locations, is published at runnel.example/subprocessors, and we give customers 30 days’ notice before adding one. They include:

our cloud infrastructure providers, which host Runnel Cloud in the region you choose;
an email delivery service, for account emails, alerts and release notes;
a payment provider and our bookkeeping software, for billing and the records the law requires;
a support desk and a chat service, for the messages you send us.

We may also disclose data when the law requires it. We publish a summary of any government requests we receive.

Where your data is stored

Account and billing data is stored in the European Union. Your jobs’ data is stored in the region you choose for each project (EU or US, and on Enterprise the UK or a dedicated region) and does not leave it. Where a provider transfers personal data outside the European Economic Area, we rely on an adequacy decision or the European Commission’s standard contractual clauses.

How long we keep it

Run payloads, outputs and logs: for your plan’s retention period (3 to 90 days or more), then deleted. Run metadata without payloads is kept for 13 months for billing.
Account data: while your account is open, and deleted within 30 days after you close it, except what we must keep for billing.
Audit trail: 30 days on Scale and one year on Enterprise; 30 days for our own security monitoring on other plans.
Messages to us: up to two years after our last contact.
Release notes: until you unsubscribe; we then keep only your address on a suppression list.
Job applications: six weeks after the role is filled, or one year if you agree.
Invoices and payment records: six years, as Irish tax law requires.

Your rights

Under the General Data Protection Regulation you can ask us for access to your personal data, to correct or delete it, to restrict its use, or to receive it in a portable format. You can object to processing based on our legitimate interest and withdraw consent at any time. Write to privacy@runnel.example; we answer within one month and may ask you to confirm your identity first. For data in your jobs, contact the organisation that runs them; we will help them answer you.

You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live or work. Our lead authority is the Irish Data Protection Commission.

Security

All traffic to Runnel is encrypted in transit. Payloads, outputs and logs are encrypted at rest with a separate key for each project. Access to production systems is limited to on-call engineers, requires hardware security keys and is logged. If a breach puts your data at risk, we tell you and the authority as the law requires, and customers within 48 hours of confirming it. Report a vulnerability to security@runnel.example.

Changes to this policy

When we change this policy, we update the date at the top of this page. If a change matters for how we use your data, we email account owners at least 30 days before it takes effect.

Contact

Runnel Labs Ltd, PO Box 0000, Dublin, Ireland. Email: privacy@runnel.example.