Privacy Policy

This policy explains what personal data Runback Pty Ltd, an Australian company based in Melbourne, Victoria ("Runback", "we"), acting as data controller, collects, how we use it, and the choices you have. It covers our website and our managed cloud service. It does not change the rights you have under applicable law. Data-protection queries: privacy@runback.dev.

1. Data we collect

Account & contact data

When you sign in or contact us we process your work email, name, and the organisation you belong to. Sign-in is passwordless — we email a one-time link and store only a hashed token, never a password.

Usage & diagnostic data

For our website and managed cloud we process standard technical data — IP address, browser, pages viewed, and product events — to operate, secure, and improve the service.

Agent trace data (managed cloud only)

If you use our managed cloud, the traces your instrumented agents send us are stored to power observe, replay, evals, and audit. Sensitive values (secrets, keys, emails, card numbers, SSNs) are designed to be redacted inside your own process before a trace ever leaves it. You control what your instrumentation sends.

2. How we use data

• To provide, secure, and operate the service and your account.
• To respond to your requests and provide support.
• To detect, prevent, and investigate abuse or security incidents.
• To meet legal, accounting, and regulatory obligations.

We do not sell personal data, and we do not use your agent trace data to train models.

3. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract (to provide the service), legitimate interests (to secure and improve it), consent (where required, e.g. certain cookies), and legal obligation.

4. Sharing & sub-processors

We share data only with vendors that help us run the service (hosting, email delivery, payments, analytics), each under contract and only as needed. Our current sub-processor list and our Data Processing Agreement are available in the DPA and on request via privacy@runback.dev.

5. International transfers

Where data crosses borders, we use appropriate safeguards such as Standard Contractual Clauses. The managed cloud currently resides in the United States (US); self-host customers keep data in their own region by definition. EU or Australian residency requires the Enterprise self-hosted tier.

6. Retention

We retain personal data only as long as needed for the purpose collected or as required by law:

• Account & contact data — retained while your account is active, plus 30 days after account closure (to allow for reactivation), then deleted unless a longer period is required by applicable law.
• Agent trace data — retained in two phases. Raw event payloads are deleted at the end of your plan's retention window (7 days on Community, 30 days on Starter, 60 days on Growth/Scale, 90 days on Pro, configurable on Enterprise). Run-level summary metadata (name, status, token counts, timestamps) is retained for up to twice the plan window before permanent deletion. You can delete any run at any time; deletion queues removal from active systems within 30 days.
• Usage & diagnostic data — retained for up to 24 months from collection.
• Billing records — retained for 7 years to meet accounting and tax obligations.

Self-host customers control retention entirely — data never reaches us and this section does not apply.

Records that cannot be deleted by design. The audit ledger is append-only and hash-chained: removing an entry breaks the chain, which is precisely the property that makes tampering detectable. Leaf hashes, Merkle roots, signed checkpoints and any external time-stamp tokens therefore persist for the life of the ledger, and entries already written to the public transparency feed cannot be withdrawn by anyone, including us. These are hashes and counters, not content. Our approach to erasure is to keep personal data out of the record in the first place, through in-process redaction; where personal data did reach a managed-cloud record and we receive a verified erasure request, we delete the underlying run, which breaks the chain at that point — and the break is itself the honest record.

Public transparency feed. When a workspace seals an audit-ledger checkpoint, the checkpoint hash, Merkle root and sequence number are published to a public, append-only feed under a random workspace identifier that is not derived from your organisation or any person. No run content and no customer name is published. Because the sequence number is the count of sealed entries, the feed reveals roughly how much a workspace records over time. Publishing can be turned off for future checkpoints in Settings.

Newsletter subscribers. If you subscribe, we store your email address and the broad topic area inferred from the page you subscribed on, so the content matches your interest. We use it only to send that newsletter. Every email carries a one-click unsubscribe, and unsubscribing removes you from the list. This is the only marketing use we make of an email address.

6a. Australian privacy law

Runback Pty Ltd is an Australian company and handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where this policy describes rights or obligations framed under the GDPR, Australian individuals have corresponding rights under the APPs — access and correction (APP 12 and APP 13), and the right to complain about our handling of personal information.

If we become aware of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. You can complain to us at privacy@runback.dev; if you are not satisfied with our response you may complain to the OAIC at oaic.gov.au.

7. Security

We protect data with measures including in-process redaction, hashed credentials, encrypted transport, role-based access, and tamper-evident audit records. See our security page for specifics and an honest view of what is and isn't yet in place.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object or withdraw consent. To exercise them, email privacy@runback.dev. We will respond within one calendar month of receiving your request (extendable by two further months for complex or numerous requests, with explanation). We may ask you to verify your identity before acting on a request.

Supervisory authority complaints. You may also lodge a complaint with your local data-protection authority. For users in the United Kingdom, the relevant authority is the Information Commissioner's Office (ICO) — ico.org.uk. For users in the EEA, the relevant authority is the supervisory authority of your country of residence or establishment.

9. Automated decision-making

Runback's policy enforcement engine may automatically block or flag agent actions based on configured policy rules. These automated checks operate on your agents' outputs — they do not produce legal or similarly significant effects on individuals in the sense of GDPR Art.22(1). You, as the controller, design the policies and remain responsible for any decisions that affect individuals. Where your use of Runback does give rise to Art.22(1) automated decisions, you are responsible for meeting the applicable obligations (providing human review, explaining the logic, and enabling individuals to contest outcomes). Contact privacy@runback.dev if you need assistance assessing your Art.22 obligations.

10. Cookies

We use strictly necessary cookies only — a single session cookie (__Host-rb_session) that authenticates your signed-in session. No analytics, tracking, or advertising cookies are deployed on this site. Because we use only strictly necessary cookies, no consent banner is required and no non-essential cookies can be configured through your browser.

We do measure page views, using Vercel Web Analytics — our hosting provider's own measurement, so no additional company receives your data. It sets no cookies and stores no cross-site identifier. We see aggregate counts: which pages were viewed, which site referred you, and a country. We cannot identify you from it, and it is never joined to your account. That is why the paragraph above remains true and why there is no consent banner to dismiss.

Analytics run on this hosted site only. A self-hosted Runback deployment loads no analytics script and sends us nothing — the measurement is switched off unless the operator configures it, because a self-hoster's traffic is theirs.

11. Change of control

If Runback is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify account holders by email or a prominent notice on the service before personal data is transferred or becomes subject to a different privacy policy. You may delete your account and data before any such transfer takes effect.

12. Changes to this policy

We'll update this policy as the product evolves and post the new effective date here. Material changes will be communicated to account holders.

13. Contact & DPO

Privacy questions: privacy@runback.dev. Security reports: security@runback.dev.

Runback has assessed its obligations under GDPR Art.37 and does not currently meet the criteria requiring mandatory appointment of a Data Protection Officer. Privacy and data-protection matters are handled directly by our team at privacy@runback.dev. If our processing activities change in a way that requires DPO appointment, we will update this policy.