RUNTA PRIVACY NOTICE

We may modify this Privacy Notice from time to time, in which case we will update the “Last Updated” date at the top of this Privacy Notice. If we make material changes to how we use or disclose information we collect, we will use reasonable efforts to notify you and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Notice, please do not continue using or accessing the Services.

When you use or access the Services, we collect certain categories of information about you from a variety of sources. In addition to the specific uses discussed below, we may use this information to provide and improve the Services and to maintain our business relationship, including by enhancing the safety and security of our Services, providing customer support, complying with applicable legal obligations, enforcing any applicable terms of service and protecting our rights and the rights of our employees, users or other individuals.

Information You Provide to Us

We collect information that you provide directly to us or that is created when you configure and use the Services. You may choose not to provide certain information, but some features may then be unavailable. This information includes:

• Account and profile information, such as your name, email address, avatar, user identifier, authentication provider, and login or session information. We use this information to authenticate you, maintain your account, and provide support.
• Waitlist, organization, and workspace information, such as company name, role, team size, use case, organization memberships, roles, and permissions. We use this information to evaluate access requests and administer organizations and workspaces.
• Runtime, service configuration, usage, and diagnostic information, such as runtime names and identifiers, configuration settings, resource usage, audit events, error data, and service diagnostics. We use this information to operate, secure, troubleshoot, and improve the Services.
• Payment and subscription information, such as billing address, subscription tier, credits, invoices, transaction history, and payment status. Stripe processes payment-card or bank-account details; Runta receives limited billing and transaction information needed to administer your account. Metronome processes usage and billing information.
• Communications and support information, including messages, support requests, feedback, and other information you choose to provide when you contact us.

Customer Content

The Services may process content submitted, stored, generated, or transmitted by you or on your behalf ("Customer Content"), including runtime files and source code, commands and terminal input or output, environment configuration, secrets and API credentials, runtime disk contents, checkpoints, logs, and other data processed within a runtime.

When we process Customer Content for an organization, we generally act as a processor or service provider on that organization's behalf and in accordance with its instructions and applicable agreement. The organization is responsible for providing required notices and obtaining permissions from its users. For account, website, waitlist, security, and billing information, Runta may act as the controller or business that determines the purposes and means of processing.

Optional LLM Tool I/O Capture (Token Analyze)

LLM tool input and output capture is disabled by default. If an organization enables it for a runtime, Runta captures tool names, arguments, results, and related metadata from supported OpenAI and Anthropic API traffic to provide Token Analyze. Captured data may contain personal information, source code, secrets, or other confidential information and may be viewed by authorized members of that organization. Runta does not use captured data to train or fine-tune Runta or third-party AI models. Token Analyze data is retained for 7 days unless it is deleted earlier or a different period is specified in the applicable customer agreement.

Information Collected Automatically

We and our service providers automatically collect certain information when you use the Services. We use this information to operate, secure, diagnose, and improve the Services. This information includes:

• Device and network information, such as browser type, operating system, device type, IP address, and approximate location derived from IP address.
• Service usage and diagnostic information, such as pages or features used, dates and times, requests, errors, logs, performance data, and security events.
• Cookie and session information used for authentication, session management, fraud prevention, security, and service functionality, including Cloudflare Turnstile signals used to distinguish legitimate users from automated traffic.

For further information on the use of Tracking Technologies and your choices, see the section below, Cookies and Other Tracking Technologies.

Information Collected from Other Sources

We receive information from third parties when you use authentication, integration, payment, or billing features, including:

• Authentication providers, including Google, GitHub, and Apple, which may provide your name, email address, avatar, provider identifier, and other profile information you authorize them to share.
• GitHub integrations, which may provide account, organization, repository, installation, and related integration information that you authorize Runta to access.
• Billing providers, including Stripe and Metronome, which provide customer, subscription, invoice, payment-status, transaction, and usage-billing information.

We handle information received from these sources in accordance with this Privacy Notice. Third-party services process information under their own privacy notices and terms.

Deidentified Information

Finally, we may deidentify or anonymize your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you (“deidentified information”) (or we may collect information that has already been deidentified/anonymized), and we may use deidentified information for any purpose. To the extent we possess or process any deidentified information, we will maintain and use such information in deidentified form and not attempt to re-identify the information, except for the purpose of determining whether our deidentification process satisfies legal requirements.

We and our service providers use cookies and similar technologies for authentication, session management, security, fraud prevention, and service functionality. Most browsers allow you to block or delete cookies, but doing so may prevent login and other features from working correctly.

Because there is not yet a universally accepted standard for browser-based Do Not Track signals, the Services do not currently respond to those signals. Runta does not sell personal information or share it for cross-context behavioral advertising.

We disclose information as needed to provide, secure, support, and administer the Services, including to:

• Infrastructure, authentication, and security providers, including Supabase for authentication and account data, Google Cloud and object-storage providers for hosting, databases, logs, runtime artifacts, and checkpoints, and Cloudflare for Turnstile and security services.
• Authentication and integration providers, including Google, GitHub, and Apple, when you choose to use their authentication or integration features.
• Communications and billing providers, including Resend for email, Stripe for payments, and Metronome for usage and billing.
• Customer-selected AI providers, including OpenAI and Anthropic, when a runtime sends requests to those providers at the customer's direction. Those providers process information under their own terms and privacy notices.
• Professional advisers, auditors, insurers, and transaction counterparties; law enforcement, regulators, courts, or other parties when required by law or reasonably necessary to protect rights, safety, and security; and a successor in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.

Runta does not sell personal information and does not share personal information for cross-context behavioral advertising.

We may provide links to third-party websites or platforms and display or make available content, data, applications or materials from third parties. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms, or the accuracy, completeness or reliability of third-party materials. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.

We have implemented commercially reasonable security measures designed to protect your personal information from unauthorized access, use or disclosure. However, despite our efforts to protect your information, no security measures are impenetrable, and we cannot guarantee “perfect security.” Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Notice. Account information and Customer Content are generally retained while the account or customer relationship is active and as required by the applicable agreement; billing and transaction records may be retained as required by law; and Token Analyze data is retained for the period stated above. We may retain information longer to resolve disputes, enforce agreements, prevent fraud or harm, protect rights and security, comply with law, or maintain limited backups. When retention is no longer required, we delete or deidentify the information in accordance with our procedures.

We are based in the United States. If you are using the Services from outside the United States, please be aware that the information we collect from you may be transferred to, stored and processed in the United States or other countries outside your country of residence.

Runta is operated by Runta Inc. located at 3 E 3rd Ave, Suite 207, San Mateo, CA. If you have questions about this Privacy Notice or want to make a privacy request, contact us at support@runta.com.

Depending on applicable law, you may request access to, correction of, deletion of, or a copy of your personal information. We may need to verify your identity and authority before completing a request. If you use the Services through an organization, please direct requests concerning Customer Content to that organization first; we will assist the organization as required by our agreement and applicable law.