Data processing agreement

Version 1.0 · Last updated 2026-11-01

This agreement says how SHMAPLEX handles personal data for the organisations that use Runner. It sits alongside the terms of service and needs no signature.

1. Who this is between

This agreement is between SHMAPLEX and the organisation that agreed to Runner's terms of service, called "you" here. It applies whenever SHMAPLEX processes personal data for you through Runner.

SHMAPLEX: SHMAPLEX (슈마플렉스), business registration number 208-06-17257, 서울특별시 강남구 선릉로 428, 2층, Republic of Korea.
You: The organisation that holds the Runner account.
Privacy contact: privacy@runtheworld.ai
Security contact: security@runtheworld.ai

2. Who does what

You decide what personal data goes into Runner and why, so you are the controller of that data and SHMAPLEX is your processor.

Where you handle the data for someone else, such as an agency working for a client, you are the processor and SHMAPLEX is your sub-processor. You are then responsible for holding that client's permission.

You are responsible for having a lawful basis for the personal data you put into Runner, and for telling people what the law says they must be told.

Three uses fall outside these roles. SHMAPLEX decides the purpose of each, so it does not act as your processor for them.

Runner accounts and billing: The details of the people who hold Runner accounts, and the accounting records of paying for Runner. The privacy statement covers these.
The identity graph: When someone identifies themselves on a site you connect, Runner adds the identifiers to an identity graph it operates across its customers, and may use that graph to recognise the same person elsewhere, including for other customers. The terms of service make you responsible for telling the people who use your sites. You can keep a product out of the graph in its visitor identification settings. Identifiers added before that stay until they are removed separately.
Improving Runner: The terms of service let Runner use what you connect, and de-identified measures of how the product performs, to improve Runner. An owner or admin can turn this off in Settings, Organization. It never uses your contacts or other personal data this way.

3. What is processed, and why

Apart from the three uses above, SHMAPLEX processes Customer Personal Data only to run Runner for you: to store it, show it back to you, send what you ask Runner to send, carry out the AI tasks you use, and fix things when they break. SHMAPLEX does not sell it.

Your instructions are the terms of service, this agreement, the settings and actions you use in Runner, and anything else agreed in writing. SHMAPLEX follows them unless the law stops it, and tells you promptly if it cannot follow one.

Whose data: Your contacts and prospects, visitors to your sites, people who message you, fill in your forms or book with you, and your own staff.
What data: Names, email addresses, phone numbers, job titles and company details. The messages, conversations and form answers people send. Visit records, including network addresses and the organisation a visit appears to come from. Consent and suppression records. Anything else you put into Runner.
Data Runner is not designed for: Health records, payment card numbers, government identity numbers and children's data. The terms of service say not to put them in. Message text is kept and processed as written, so anything a person types into a message goes with it.
AI tasks: When you use an AI task, the content it needs goes to the AI provider doing it, including any personal details typed into that content.
How often: Continuously, for as long as you use Runner.
How long: Until the data is deleted under section 10. The privacy statement says how long each kind of data is kept while you use Runner.

4. Sub-processors

You give SHMAPLEX general authorisation to use the providers named on the providers page (/subprocessors) as sub-processors. That page says what each one does.

Before adding a provider that page does not name, SHMAPLEX updates the page and emails your account's owners at least 15 days before the provider starts. Anyone who asks for provider updates gets the same notice.

On AI included, SHMAPLEX chooses among the AI vendors that page names and may change that choice at any time without notice, because a switch among them adds no one.

You can object to a new provider by writing to privacy@runtheworld.ai before it starts. Both sides will then try in good faith to resolve it. If they cannot, you can stop using the feature concerned or end the agreement, as the terms of service allow.

What you connect yourself: A service you connect, or an AI vendor you use on your own key, runs under your own agreement with that service. It is not SHMAPLEX's sub-processor.
The terms each provider works under: Each provider handles data under its own commercial terms, which SHMAPLEX relies on. Those terms are not the same as this agreement, and some let the provider use what it is sent to train its own models. The providers page says which.
Who answers for them: SHMAPLEX stays responsible to you for what its sub-processors do with Customer Personal Data, within the limits in section 12.

Providers

5. Where data goes

SHMAPLEX is established in the Republic of Korea, and Runner's database is in Seoul.

Runner also runs on hosting and provider infrastructure that is not confined to any one country. Assume Customer Personal Data is processed in the United States and in other countries where those providers operate. You authorise those transfers as far as they are needed to run Runner.

There is no option to keep data in a particular region.

This agreement adds no transfer mechanism. It does not include the EU standard contractual clauses or the UK addendum, and SHMAPLEX does not claim any other. If your law requires one for a transfer, raise it before you put that data into Runner.

Where in the world this data goes

6. Security measures

SHMAPLEX keeps the measures below in place. It may change them, as long as the overall protection of Customer Personal Data does not fall.

Separation between customers: Every company's data is separated in the database itself by row-level security, apart from the identity graph described in the terms of service.
Encryption: All traffic is HTTPS, and a browser that has seen the site once refuses plain HTTP afterwards. Supabase, which hosts Runner's database, states that customer data is encrypted at rest with AES-256.
Connected credentials: Credentials you connect are stored encrypted, and the secret parts are never returned to a browser or written to a log. Revoking a connection stops the access.
Sign-in: People sign in with an emailed link, a password or a passkey. Organisation owners and admins must also use an authenticator code, or a passkey they confirm on their device.
Who at Runner can read your content: A few Runner staff can reach what is stored in a workspace, so they can run the service and fix it when it breaks. They do not look at it unless you ask us to for support, it is needed to investigate a security problem or abuse, or the law requires it.
Browser and code protections: The app enforces a content security policy, refuses to be framed, and switches off browser features it does not use. Dependency alerts and security updates are on, and secret scanning with push protection stops a credential reaching the code.
Backups: The release path takes a full backup of the production database before it changes the schema.

Security and trust

7. If there is a breach

If SHMAPLEX becomes aware of a personal data breach affecting Customer Personal Data, it tells you without undue delay, and no later than 72 hours after becoming aware of it.

The notice goes by email to your account's owners. It says what happened, what data is affected, what SHMAPLEX has done, and what you should do, as far as SHMAPLEX knows at the time. SHMAPLEX adds to it as it learns more, and takes reasonable steps to contain and investigate the breach.

A notice is not an admission of fault or liability.

8. Helping you meet your duties

SHMAPLEX gives you reasonable help with the following.

Requests from people: Your staff have tools in Runner to find, export and erase a person's record. If someone writes to SHMAPLEX about data you control, SHMAPLEX tells you and helps you answer.
Requests from authorities: If a court, regulator or other authority asks SHMAPLEX for Customer Personal Data, SHMAPLEX tells you unless the law forbids it, and discloses only what the law requires.
Assessments: Where the law requires them, SHMAPLEX helps with data protection impact assessments and consultations with a regulator, given what it knows about the processing.

9. Audits and information

SHMAPLEX gives you the information reasonably needed to show it is meeting this agreement, and allows for and contributes to audits, including inspections, by you or an auditor you appoint.

You agree to use those rights through written requests to security@runtheworld.ai, at most once a year, and SHMAPLEX answers reasonable security and due-diligence questionnaires. A regulator's requirement, or a breach affecting Customer Personal Data, justifies another request within the year.

SHMAPLEX may hold back anything that would expose another customer's data, break a duty of confidentiality, or give away its intellectual property.

SHMAPLEX has no third-party audit report or security certification to share.

10. Deleting and returning data

You can delete personal data in Runner at any time, and an erasure reports anything it could not reach.

Ending the agreement does not delete your data by itself, because a customer who leaves in a hurry may need it back. You choose: take it, delete it, or both.

To take it, an owner or admin requests a takeout in Settings: one download of the organisation's contacts, consent and suppression records, approvals, audit trail, campaigns and content drafts. If a takeout is too large to build in full, ask support.

To delete it, an owner closes the organisation in Settings, Organization. Sending, campaigns and agents stop at once, and an owner can reopen it for 30 days. After that SHMAPLEX deletes the organisation's data from Runner's database and emails the person who asked. An organisation with a paid plan cancels the plan first, and one under a legal hold cannot close until the hold is lifted.

You can also ask for deletion at privacy@runtheworld.ai.

Files in storage: Uploads and generated media sit outside the database, and closing the organisation does not remove them. SHMAPLEX deletes them when you ask at privacy@runtheworld.ai.
Backups: A backup of the database is not changed when data is deleted, and no fixed period applies to backups. Deleted data can remain in one until that backup is removed.
Copies held by providers: A provider's copy runs out on that provider's own schedule. The providers page gives it where the provider publishes one.
What stays: The record that a deletion was asked for and done, and anything the law requires SHMAPLEX to keep, for as long as that requirement lasts.

11. How this fits with the terms

This agreement adds to the terms of service. If the two disagree about personal data SHMAPLEX processes for you, this agreement wins.

It is governed by the same law, and decided in the same courts, as the terms of service. Data protection law still applies wherever it applies, and nothing here reduces it.

It starts on the later of the day you agree to the terms of service and the day this version is published, and it lasts for as long as SHMAPLEX processes Customer Personal Data.

This agreement carries a version number and a date at the top of this page. A substantive change bumps the version. When a new feature changes what section 3 describes, SHMAPLEX updates that section. A change that materially reduces your protection is notified before it takes effect.

12. Liability

The limits in the terms of service apply to this agreement too, and this agreement adds no other limit.

Nothing here limits liability to a person for their data protection rights, or anything that cannot lawfully be limited.

Only the organisation that agreed to the terms of service can bring a claim under this agreement.

Limits

13. What the words mean

Where a law uses other words for the same roles or the same data, those words are meant too.

Customer Personal Data: Personal data you put into Runner, or that Runner collects for you, which SHMAPLEX processes as your processor or sub-processor.
Controller, processor, personal data, processing: These have the meanings given in data protection law.
Data protection law: The laws that apply to processing that data, which can include Korea's Personal Information Protection Act, the GDPR and the UK GDPR.
Personal data breach: A breach of security leading to the accidental or unlawful destruction, loss or alteration of Customer Personal Data, or its unauthorised disclosure or access.
Sub-processor: A company SHMAPLEX uses to process Customer Personal Data for you.
Runner: The product SHMAPLEX provides under the terms of service.