Effective Date: September 8, 2026
This Privacy Policy describes how RunBy Technologies Inc. ("RunBy," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information when you use the RunBy platform and the products, features, and services we make available (the "Service").
This Privacy Policy applies in addition to our Terms of Service and our Cookie Policy.
1. Our Role and Yours
The Service lets customers submit documents and other information for storage, collaboration, automated analysis, and operational or compliance workflows. Those materials may contain personal information about employees, contractors, representatives, counterparties, project participants, investors, or other people who do not use the Service themselves.
For personal information in materials a customer submits, the customer normally determines why and how the information is processed and we process it on the customer's instructions to provide the Service. In privacy-law terms, the customer is generally the controller or accountable organization and we are generally its processor or service provider. The customer is responsible for having a lawful basis, giving required notices, and obtaining required consents.
We are the controller or accountable organization for personal information we collect for our own business purposes, including account administration, billing, security, support, and operation of our website and Service.
2. Information We Collect
2.1 Account and Workspace Data
When you create or use a RunBy account, we collect:
- Email address and authentication information
- Password credentials in protected form when password authentication is used; we do not store your password in plain text
- Display name, team or organization name, role, workspace membership, and permissions
- Account preferences and records of invitations or account changes
2.2 Documents and Other Content You Submit
We store the documents, prompts, instructions, corrections, and other content you submit, together with text extracted from supported documents. The categories of information depend on your use of the Service and may include:
- Names, identifiers, and contact details
- Employment, professional, project, representative, membership, or affiliation information
- Contractual, commercial, compensation, budget, financing, and other financial information
- Opinions, evaluations, instructions, obligations, and other information contained in submitted materials
- Any special-category, sensitive, or regulated information that a customer chooses to submit
For current film and television workflows, submitted materials may include deal memos, contracts, cast and crew lists, credit obligations, credit lists, and guild or union agreements. We also record file metadata such as filename, file type, size, a content hash used to detect duplicate uploads, and the uploading user.
2.3 Derived Data and Analysis Output
We store structured information and other Output produced through the Service so that customers can review, correct, compare, and export it. Depending on the workflow, this may include extractions, classifications, summaries, citations, rule results, possible conflicts or compliance findings, recommendations, corrections, workflow state, and source references. Film-credit Output may, for example, include credited people and organizations, roles, stated union or guild numbers, and citations to source provisions.
2.4 Usage, Device, and Log Data
When you use our website or Service, we may collect:
- IP address
- Browser type, device type, and operating system
- Service activity, feature usage, authentication events, and workspace interactions
- Server and application logs, including errors and timings
2.5 Payment and Transaction Data
If you purchase a paid Subscription, Stripe processes your payment. We receive payment-provider and customer references, transaction and invoice information, subscription status, and related billing or tax records needed to administer the Subscription. We do not receive or store complete payment-card numbers. Stripe handles payment information under its own privacy terms and PCI-DSS obligations.
2.6 Communications and Support
We collect information you provide when you contact us, request support, respond to a survey, participate in a pilot, or otherwise communicate with us. This includes the content of the communication and information needed to respond.
3. How We Use Information
We use personal information to:
- Provide the document, analysis, compliance, workflow, collaboration, reporting, and decision-support features selected by the customer
- Authenticate users and authorize access to workspaces, documents, and features
- Process transactions and manage Subscriptions
- Send transactional communications such as account alerts, invitation emails, service messages, and security notices
- Provide support and respond to requests
- Monitor, maintain, troubleshoot, secure, and improve the operation and usability of the Service
- Detect and prevent fraud, abuse, and security incidents
- Enforce our agreements and comply with legal obligations
We do not use your submitted documents or content, or Output derived from them, to train generalized machine learning models.
4. Automated Processing and Where Data Goes
Some Service features use automated processing, including large language models, to extract, classify, compare, summarize, and analyze content. Output from that processing is decision support for customer review. The Service does not itself make decisions that have legal or similarly significant effects on people; customers decide how to use Output and are responsible for appropriate human review.
Our current automated document-analysis workflow uses Google Cloud Vertex AI. Customer data at rest and our application infrastructure are in Amazon Web Services in the US East (N. Virginia) region. For model inference, we send a pattern-masked text copy of a supported document to Google Vertex AI in the US Central region and receive structured Output in return. We do not send the original document. We configure this workflow so that our customer data is not stored at rest in Google Cloud.
If you are outside the United States, your personal information is transferred to and processed in the United States. Information in another country may be accessible to courts, law enforcement, or national-security authorities under that country's laws. We use contractual and other measures intended to require our service providers to protect personal information and use it only for the services they provide to us.
5. Masking and Its Limits
Before supported document text is sent for model inference, we produce a masked copy. The current masking process is designed to replace recognizable email addresses, phone numbers, street addresses, government and guild or union identification numbers, monetary amounts, and names appearing in a contact block alongside those values.
Masking may leave names, roles, organization names, project details, contractual language, and other content that the selected analysis needs. What remains depends on the document and workflow. Remaining information may still be personal, confidential, or commercially sensitive and is protected as described in this Policy.
Masking is pattern-based. It reduces exposure but may miss values in unusual formats, text embedded in complex layouts, and context-dependent information. It is not anonymisation and we do not describe it as such.
Some file types we accept cannot currently be converted to text, including legacy .doc and .xls files and images. Those files may be stored for authorized users to access but are not masked, analyzed, or sent to the model.
6. Service Providers and Other Disclosures
We use third-party service providers to operate the Service. We require them by contract or other appropriate means to protect personal information and limit their use of it to the services they provide to us.
- Amazon Web Services — application hosting, document storage, caching, secrets management, and logging. United States (us-east-1).
- Supabase — hosted PostgreSQL database and authentication. United States (us-east-1).
- Google Cloud (Vertex AI) — model inference on pattern-masked document content. United States (us-central1). Original documents are not sent.
- Stripe — payment processing and Subscription management.
- Resend — transactional email delivery.
- GitHub — storage for our marketing-site content. We do not use it to store customer documents.
6.1 Legal and Corporate Disclosures
We may disclose information as reasonably necessary to:
- Comply with applicable law, legal process, or a valid government request
- Enforce our Terms of Service and protect legal rights
- Detect, investigate, or prevent fraud, abuse, security threats, or harm to people or property
- Evaluate or complete a financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice where required
6.2 Customer-Directed and Third-Party Features
If you direct us to share information with an integration, professional adviser, financing provider, project participant, or other third party, we process that direction to provide the feature you selected. The third party may process the information under its own terms and privacy policy. We will describe material sharing and request any consent required before enabling a future feature that introduces a new purpose.
6.3 No Sale of Personal Information
We do not sell personal information, customer documents, or derived Output to third parties for advertising or marketing. We do not use them for cross-context behavioural advertising.
7. Data Retention and Deletion
Retention depends on the type of information, the customer's instructions, the period needed to provide the Service, security and dispute needs, and legal, tax, accounting, or regulatory requirements. Our current practices include:
- Account and Workspace Data: Retained while the account is active and for a reasonable period afterwards where needed for administration, security, disputes, or legal obligations.
- Uploaded Documents: Retained while available in an active workspace. Deleting a document removes it from active workspace use. Because original-document storage is versioned, restricted residual object versions may remain after in-product deletion and are not subject to the masked-copy expiry below. Contact us to request permanent deletion, subject to legal, security, and technical limitations.
- Masked Copies: Current masked copies are automatically deleted 90 days after creation; superseded masked versions have a shorter expiry.
- Derived Data and Workflow Records: Retained while needed to provide the applicable workspace and workflow and for reasonable support, security, and troubleshooting periods.
- Logs: Application infrastructure logs are generally retained for 30 days. Particular security or incident records may be kept longer when reasonably necessary.
- Billing and Transaction Records: Retained as required for Subscription administration and applicable tax, accounting, dispute, and legal obligations. Stripe retains payment information under its own retention practices.
To request access, correction, or deletion, contact our Privacy Officer at privacy@run-by.com. We will acknowledge or respond to a verified request within 30 days, unless applicable law permits an extension. Some information may be retained where required or permitted by law.
8. Security Measures
We use technical and organizational measures designed to protect personal information, including:
- Encryption of data in transit and at rest
- Row-Level Security policies enforced at the database level to isolate customer workspaces
- Document storage with public access blocked and short-lived signed links issued to authorized users
- Role-based access controls and multi-factor authentication for personnel access to customer documents
- Managed storage for secrets and credentials
- Dependency, code, and security review practices
- Incident-response procedures
No method of transmission or storage is completely secure. We cannot guarantee absolute security.
9. Privacy Breaches
We investigate suspected privacy and security breaches and take steps intended to contain, assess, and remediate them. We maintain breach records and notify regulators, customers, or affected individuals where applicable law requires.
Under Canadian federal privacy law, this includes reporting to the Office of the Privacy Commissioner of Canada and notifying affected individuals when a breach creates a real risk of significant harm. Other laws may apply different thresholds and timing, including a 72-hour regulatory-reporting period for certain breaches governed by the GDPR.
10. Your Privacy Rights
10.1 Rights Available to Users
Subject to applicable law and exceptions, you may ask us to:
- Access personal information we hold about you and understand how it has been used or disclosed
- Correct inaccurate or incomplete personal information
- Delete personal information that we are not required or permitted to retain
- Export information associated with your account in an available portable format
- Withdraw consent where processing is based on consent, subject to legal or contractual restrictions and reasonable notice
- Challenge our compliance and receive information about our privacy practices
Contact our Privacy Officer at privacy@run-by.com. We may need to verify your identity and authority before completing a request.
If your information appears in content submitted by a customer, that customer controls the content and should normally receive your request. You may also contact us. We will help direct the request or support the customer in responding where appropriate.
10.2 Canada
You may raise a concern with our Privacy Officer using the contact information below. If we do not resolve your concern, you may have the right to complain to the Office of the Privacy Commissioner of Canada or an applicable provincial privacy regulator.
10.3 Additional Rights for EEA and UK Residents
If European or United Kingdom data-protection law applies, you may also have rights to restrict processing, object to processing, request erasure, receive portable data, and lodge a complaint with your local supervisory authority. Where required for transfers from those regions, we use safeguards such as contractual data-protection terms with our service providers.
10.4 Additional Rights for California Residents
If the California Consumer Privacy Act applies, you may have rights to know, correct, or delete personal information and to receive equal service for exercising your rights. We do not sell or share personal information as those terms are defined for cross-context behavioural advertising.
11. Cookies and Similar Technologies
Our web dashboard uses cookies and similar browser storage for authentication, session management, security, and preferences you select. We do not currently use advertising or third-party tracking cookies or run a web analytics provider. See our Cookie Policy for details.
12. Children's Privacy
The Service is a business tool and is not directed to children under 13. We do not knowingly allow children under 13 to create accounts or submit personal information directly to us. Contact our Privacy Officer if you believe a child has done so.
Customer-submitted materials may contain information about minors, such as child performers, beneficiaries, or project participants. We process that information on the customer's instructions as described in Section 1. The customer is responsible for the lawful basis, notices, consents, and safeguards required for that information.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date and provide notice by email or through the Service at least 30 days before the changes take effect, unless a shorter period is reasonably required by law, security, or circumstances beyond our control.
14. Contact Our Privacy Officer
Direct questions, concerns, complaints, and privacy requests to:
Privacy Officer
RunBy Technologies Inc.
Email: privacy@run-by.com
We will acknowledge or respond to inquiries within 30 days.