1. Who we are
RunAV (Portugal) is the controller for personal data about account holders and visitors. For the operational data your organization stores in RunAV about its own clients and crew, your organization is the controller and RunAV is the processor, see the DPA.
2. Data we collect
- Account data: name, email, organization, role, language, and profile details you provide.
- Usage data: log and device information needed to run and secure the service.
- Billing data: handled by Stripe; we receive subscription status and limited details, never full card numbers.
- Content: the records your organization creates (jobs, inventory, clients, crew, files).
3. How and why we use it
We process personal data for four reasons. To provide and secure the service, which is how we perform our contract with you. To bill subscriptions and meet legal and accounting duties, which the law requires. To tell you about the service. And to improve and protect it, which is our legitimate interest, weighed against your rights. By default we send only operational emails.
4. Processors we use
We share data with vetted sub-processors that act on our instructions. Supabase hosts our database and handles authentication. Stripe processes payments. Our email provider delivers messages. Cloudflare runs the CAPTCHA on the sign-in and sign-up forms, described under "Bot protection" below. Each one is bound by data-protection terms.
5. International transfers
Data is primarily hosted in the EU (eu-west-1). Where a processor transfers data outside the EEA, it is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. Retention
We keep account and content data while your subscription is active and for a limited window afterwards to allow export and to meet legal obligations, after which it is deleted or anonymized. Billing records are retained as required by tax law.
7. Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction, portability, and object to certain processing. You can exercise most of these in-app or by contacting us, and you may lodge a complaint with the Portuguese supervisory authority (CNPD).
8. Cookies
We use only the cookies and local storage necessary to keep you signed in, remember preferences, and operate the app. We do not use advertising trackers.
9. Bot protection
To protect the sign-in and sign-up forms from automated abuse, we use Cloudflare Turnstile, a privacy-focused CAPTCHA. When you load those forms, Turnstile performs a verification that may process client-side signals such as your IP address, browser User-Agent, and similar technical data, and may store a short-lived token in your browser. Turnstile does not use this data for advertising or cross-site tracking. Cloudflare's processing in this context is described in the Cloudflare Turnstile Privacy Addendum.
10. Security
We use encryption in transit, row-level tenant isolation, encrypted storage of integration credentials, and access controls. No system is perfectly secure, but we work to protect your data and will notify you of breaches as required by law.
11. Children
The service is for business use and is not directed to children. We do not knowingly collect data from anyone under 16.
12. Changes
We will post updates here and, for material changes, notify you in-app or by email.
13. Contact
Privacy questions or requests: privacy@runav.io.