Privacy Policy

This policy explains what personal data Runback Pty Ltd, an Australian company based in Melbourne, Victoria ("Runback", "we"), acting as data controller, collects, how we use it, and the choices you have. It covers our website and our managed cloud service. It does not change the rights you have under applicable law. Data-protection queries: privacy@runback.dev.

1. Data we collect

Account & contact data

When you sign in or contact us we process your work email, name, and the organisation you belong to. Sign-in is passwordless — we email a one-time link and store only a hashed token, never a password.

Usage & diagnostic data

For our website and managed cloud we process standard technical data — IP address, browser, pages viewed, and product events — to operate, secure, and improve the service.

Agent trace data (managed cloud only)

If you use our managed cloud, the traces your instrumented agents send us are stored to power observe, replay, evals, and audit. Sensitive values (secrets, keys, emails, card numbers, SSNs) are designed to be redacted inside your own process before a trace ever leaves it. You control what your instrumentation sends.

2. How we use data

• To provide, secure, and operate the service and your account.
• To respond to your requests and provide support.
• To detect, prevent, and investigate abuse or security incidents.
• To meet legal, accounting, and regulatory obligations.

We do not sell personal data, and we do not use your agent trace data to train models.

3. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract (to provide the service), legitimate interests (to secure and improve it), consent (where required, e.g. certain cookies), and legal obligation.

4. Sharing & sub-processors

We share data only with vendors that help us run the service (hosting, email delivery, model inference, payments, analytics), each under contract and only as needed. Our current sub-processor list and our Data Processing Agreement are available in the DPA and on request via privacy@runback.dev.

5. International transfers

The managed cloud stores and processes customer data in Sydney, Australia (AWS ap-southeast-2), including backups. Some of our service providers are located outside Australia: transactional email is delivered by Resend in the United States (US), and Vercel's edge network may terminate a request outside Australia before it reaches our servers in Sydney. When you replay a step, score a run with the LLM judge, generate a run narrative or generate adversarial test cases without your own provider key, the captured prompt content is sent to the model provider (Groq, OpenAI or Anthropic), which processes it outside Australia. Where data crosses borders, we use appropriate safeguards such as Standard Contractual Clauses. Self-host customers keep data in their own region by definition. EU residency requires the Enterprise self-hosted tier.

6. Retention

We retain personal data only as long as needed for the purpose collected or as required by law:

• Account & contact data — retained while your account is active, plus 30 days after account closure (to allow for reactivation), then deleted unless a longer period is required by applicable law.
• Agent trace data — retained in two phases. Raw event payloads are deleted at the end of your plan's retention window (7 days on Community, 30 days on Starter, 60 days on Growth/Scale, 90 days on Pro, configurable on Enterprise). Run-level summary metadata (name, status, token counts, timestamps) is retained for up to twice the plan window before permanent deletion. Runs are removed in three ways. A signed-in workspace admin can delete any run (per-run delete, from a browser session rather than an API key, with a confirmation step): the run, its events, its regression-test copy, its alert-delivery records and its share of the dashboard totals are removed, unless a legal hold covers it, in which case the deletion is refused. Runs are also removed at the end of the retention window, and erasing the account of a workspace's only member deletes the workspace and all its runs, while in a shared workspace your membership is removed and the workspace's runs remain. A deleted run's hash-chained records (see below) and the governance records that refer to it by id (approvals, incidents, attestations, policy decisions, external access grants that list it, dataset items copied from it) are kept. You can also ask us at legal@runback.dev to delete a specific run.
• Usage & diagnostic data — retained for up to 24 months from collection.
• Billing records — retained for 7 years to meet accounting and tax obligations.

Self-host customers control retention entirely — data never reaches us and this section does not apply.

Records that cannot be deleted by design. The audit ledger is append-only and hash-chained: removing an entry breaks the chain, which is precisely the property that makes tampering detectable. Leaf hashes, Merkle roots, signed checkpoints and any external time-stamp tokens therefore persist for the life of the ledger, and entries already written to the public transparency feed cannot be withdrawn by anyone, including us. These are hashes and counters, not content. Our approach to erasure is to keep personal data out of the record in the first place, through in-process redaction; where personal data did reach a managed-cloud record, the run can be deleted (by a workspace admin, or by us on a verified erasure request). Its ledger entry stays, explained by a tombstone recording that it was deleted and by whom, so the ledger still verifies. On plans with the audit ledger, a signed checkpoint covers that tombstone; who deleted it is recorded but is not part of what the checkpoint signs. AI narratives and security findings about a run are hash-chained the same way and are kept when the run is deleted.

Public transparency feed. When a workspace seals an audit-ledger checkpoint, the checkpoint hash, Merkle root and sequence number are published to a public, append-only feed under a random workspace identifier that is not derived from your organisation or any person. No run content and no customer name is published. Because the sequence number is the count of sealed entries, the feed reveals roughly how much a workspace records over time. Publishing can be turned off for future checkpoints in Settings.

Reviewer identity in sealed approvals. When someone approves or rejects a held action, the decision is sealed into the audit ledger together with who made it (their sign-in email) and when. That sealed record cannot be edited or deleted while the workspace exists, by an erasure request or by us, because changing it would break the hash that proves the decision was made. Deleting the reviewer's account, or the run the approval refers to, does not remove it; deleting the whole workspace does. If reviewer identities must be erasable, have reviewers decide from role accounts rather than personal ones.

Newsletter subscribers. If you subscribe, we store your email address and the broad topic area inferred from the page you subscribed on, so the content matches your interest. We use it only to send that newsletter. Every email carries a one-click unsubscribe, and unsubscribing removes you from the list. This is the only marketing use we make of an email address.

6a. Australian privacy law

Runback Pty Ltd is an Australian company and handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where this policy describes rights or obligations framed under the GDPR, Australian individuals have corresponding rights under the APPs — access and correction (APP 12 and APP 13), and the right to complain about our handling of personal information.

If we become aware of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. You can complain to us at privacy@runback.dev; if you are not satisfied with our response you may complain to the OAIC at oaic.gov.au.

7. Security

We protect data with measures including in-process redaction, hashed credentials, encrypted transport, role-based access, and tamper-evident audit records. See our security page for specifics and an honest view of what is and isn't yet in place.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object or withdraw consent. To exercise them, email privacy@runback.dev. We will respond within one calendar month of receiving your request (extendable by two further months for complex or numerous requests, with explanation). We may ask you to verify your identity before acting on a request.

Supervisory authority complaints. You may also lodge a complaint with your local data-protection authority. For users in the United Kingdom, the relevant authority is the Information Commissioner's Office (ICO) — ico.org.uk. For users in the EEA, the relevant authority is the supervisory authority of your country of residence or establishment.

9. Automated decision-making

Runback's policy enforcement engine may automatically block or flag agent actions based on configured policy rules. These automated checks operate on your agents' outputs — they do not produce legal or similarly significant effects on individuals in the sense of GDPR Art.22(1). You, as the controller, design the policies and remain responsible for any decisions that affect individuals. Where your use of Runback does give rise to Art.22(1) automated decisions, you are responsible for meeting the applicable obligations (providing human review, explaining the logic, and enabling individuals to contest outcomes). Contact privacy@runback.dev if you need assistance assessing your Art.22 obligations.

10. Cookies

We use strictly necessary cookies only — a single session cookie (__Host-rb_session) that authenticates your signed-in session. No analytics, tracking, or advertising cookies are deployed on this site. Because we use only strictly necessary cookies, no consent banner is required and no non-essential cookies can be configured through your browser.

We do measure page views, using Vercel Web Analytics — our hosting provider's own measurement, so no additional company receives your data. It sets no cookies and stores no cross-site identifier. We see aggregate counts: which pages were viewed, which site referred you, and a country. We cannot identify you from it, and it is never joined to your account. That is why the paragraph above remains true and why there is no consent banner to dismiss.

Analytics run on this hosted site only. A self-hosted Runback deployment loads no analytics script and sends us nothing — the measurement is switched off unless the operator configures it, because a self-hoster's traffic is theirs.

11. Change of control

If Runback is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify account holders by email or a prominent notice on the service before personal data is transferred or becomes subject to a different privacy policy. You may delete your account and data before any such transfer takes effect.

12. Changes to this policy

We'll update this policy as the product evolves and post the new effective date here. Material changes will be communicated to account holders.

13. Contact & DPO

Privacy questions: privacy@runback.dev. Security reports: security@runback.dev.

Runback has assessed its obligations under GDPR Art.37 and does not currently meet the criteria requiring mandatory appointment of a Data Protection Officer. Privacy and data-protection matters are handled directly by our team at privacy@runback.dev. If our processing activities change in a way that requires DPO appointment, we will update this policy.