Privacy policy
Effective August 25, 2026
This Privacy policy describes how Runtime (“we”, “us”) collects, uses, and shares information when you use the Runtime web application and related services (the “Service”). Runtime is a business product. It is not directed at consumers or children.
Who this covers
We process information on behalf of the organization that invited you (your “Customer”). The Customer is typically the controller of business data in the Service. This policy explains our practices as operator of the Service.
Information we collect
- Account. Name, email, role, memberships, and authentication records.
- Workspace. Chat sessions, messages, tool-call traces, files you attach, and settings such as timezone.
- Connected systems. Data ingested from systems your organization connects (for example point-of-sale, labor, reservations, or messaging), including credentials or tokens stored to keep those connections working.
- Usage. Logs needed to run and secure the Service: timestamps, request metadata, and error reports.
How we use it
We use this information to:
- authenticate you and enforce tenant isolation
- run agent turns, tools, and connected-system jobs you request
- provide admin, audit, and support functions to the Customer
- maintain, secure, and improve the Service
- comply with law and enforce the license agreement
We do not sell personal information. We do not use Customer business data to train public foundation models.
Cookies and sessions
We use an httpOnly session cookie to keep you signed in. That cookie is required for the Service to function. We do not use advertising cookies or third-party ad trackers on these pages.
Sharing
We share information only:
- with subprocessors that host, store, or run the Service for us
- with model and tool providers needed to complete a request
- with the Customer’s administrators and other users in the same tenant, as the product is designed
- when required by law, or to protect the Service and its users
- in a merger, acquisition, or similar corporate transaction
Retention
We keep account, session, and connected-system data for as long as the Customer’s workspace remains active and as needed for security, audit, and legal obligations. The Customer may request deletion through their administrator. Residual copies may remain in backups for a limited period.
Security
We use access controls, encryption in transit, tenant isolation, and session management to protect information. No method of transmission or storage is fully secure. Report suspected incidents to your Runtime administrator.
Your choices
You may update profile fields the product exposes (such as timezone). Access, correction, or deletion of workspace data is handled through your Customer administrator, who controls the tenant. If you are in a jurisdiction with additional privacy rights, exercise them via that administrator; we will support the Customer’s response as required.
Children
The Service is for business users. We do not knowingly collect information from children under 16.
Changes
We may update this policy by posting a revised version on this page with a new effective date.
Contact
Privacy questions go to your Runtime administrator. License terms are in the End-user license agreement.