Invite onlyRunAV is currently invite-only. You'll need a workspace invitation to join.

RunAV
ProductHow it worksPricingFAQ

RunAV · Legal

Data Processing Agreement

Last updated June 2026

This DPA forms part of the Terms between your organization and RunAV. Your organization is the controller and RunAV is the processor. It governs how RunAV processes personal data on your behalf when you use RunAV.

This document is a working draft template, not legal advice. It must be reviewed and adapted by qualified counsel before RunAV relies on it or opens public signups.

1. Roles

For the operational data your organization stores in RunAV about its clients, crew, and contacts, your organization is the controller and RunAV is the processor. RunAV processes that data only to provide the service and on your documented instructions, including as configured through the product.

2. Details of processing

  • Subject matter: provision of the RunAV rental-management service.
  • Duration: for the term of your subscription plus the deletion window.
  • Nature and purpose: hosting, storing, and processing records to operate the service.
  • Data types: contact details, job and scheduling data, financial line items, and files you upload.
  • Data subjects: your staff, crew, clients, suppliers, and contacts.

3. Processor obligations

  • Process personal data only on your instructions and as needed to provide the service.
  • Ensure personnel are bound by confidentiality.
  • Implement appropriate technical and organizational security measures (tenant isolation, encryption, access control).
  • Assist you, taking into account the nature of processing, with data-subject requests and your security, breach, and impact-assessment obligations.
  • Notify you without undue delay after becoming aware of a personal-data breach.
  • On termination, delete or return personal data, save where retention is required by law.

4. Sub-processors

You authorize RunAV to engage sub-processors to provide the service, currently including Supabase (hosting, database, authentication), Stripe (payments), Cloudflare (bot protection and CAPTCHA on sign-in), and our email-delivery provider. RunAV imposes data-protection obligations on each and remains responsible for their performance. We will give notice of intended changes to sub-processors so you can object.

5. International transfers

Where personal data is transferred outside the EEA, it is protected by appropriate safeguards such as the Standard Contractual Clauses.

6. Audits

RunAV will make available information reasonably necessary to demonstrate compliance and will allow for and contribute to audits, subject to reasonable confidentiality and security conditions.

7. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service.

8. Contact

To raise a data-processing matter or request the current sub-processor list: privacy@runav.io.