Privacy statement

Version 1.31 · Last updated 2026-11-10

This explains what this product collects about people who visit a website running it and about people who use Runner and its apps, what happens to that information, and the choices a person has. It is written to describe how the software actually behaves rather than to describe an intention.

What is collected, and from whom

Two different groups of people show up in this product, and what is collected about them is not the same.

People who visit a website running this product: Pages visited, the approximate organisation the visit appears to come from, and the network address the request arrived from. In the United States, and only there, a visit can also be matched to a named person — see the section on how far identification goes.
People who open the chat widget: What you type, and information about the session itself: when it started, the network address it came from, whether it was matched to someone already known, and events such as the panel being opened. If you leave feedback, the comment you write is kept with it.
What the chat widget does not collect: It does not record your screen, your camera, or your microphone, and it does not read your browser's user-agent string. If you use the microphone button, your own browser turns your speech into text and only the text is sent — no audio reaches this product.
People who work for a customer using the product: The account details needed to sign in and the record of what they did in the product. This is ordinary business-account information, held for as long as the account exists.
Voice input, for people who use Runner: Runner's own microphone is another way to type, and the person using it chooses how speech becomes text. Built in: their browser or phone does it with its own speech service (in Chrome, that is Google's), and only the text reaches Runner. On their computer: the Runner desktop app does it on the computer, and no audio leaves it. OpenAI, only if they choose it: the sentence they said, at most a minute long, passes through Runner to OpenAI to be turned into text. Runner does not store or log that recording, or the text that comes back. The text then goes wherever typed text would.
Business contacts held by a customer: A customer can import and hold business contact details in the product. That data is theirs, collected under their own decisions about who to contact; the product stores and processes it on their behalf, except as described next.
People who identify themselves on a customer's site: If you submit a form or sign in on a site that uses this product, the identifiers involved are also kept in an identity graph Runner operates across its customers, and can be used to recognise the same person on other sites that use it.

If you have a Runner account, and Runner's apps

This part is for the people who use Runner itself, on the web, in the Runner apps for iPhone, iPad, Android and watches, and in Runner Pouch. The phone and tablet apps open the same Runner you use in a browser, so what is kept is the same wherever you sign in.

What Runner keeps about you: Your name, email address and account ID. What you write to your teammates and the assistant. The business records your team adds. Pictures you choose to attach. Support requests you send. A record of the actions you take, kept for security and audit.
Passwords kept in Pouch: For each account your organization stores in Pouch: the website, sign-in name and password, and, if you add them, notes and a two-factor (2FA) key; and a record of which agent was given which account and when. The password, notes and 2FA key are encrypted before they are stored, and no part of them is written to Runner's logs or audit records. Revoking an account takes it out of use; it does not erase the encrypted copy.
Who can see what is stored: A saved password, note or 2FA code is shown only to owners and admins of the organization or of that product, or to a member given that one login, and only after they confirm it's them with a passkey or authenticator code. Each time one is shown or copied is recorded. Agents never see them, and other members see which services are stored and which agents hold them, not the sign-in.
Giving a login to a person: An owner or admin can also give one saved login to a named member of the product, for a set time or until they take it back. That member can then see or copy it after confirming it's them, and every view is recorded.
One-time links: When an owner or admin shares a saved password through a one-time link, Pouch encrypts it in their browser with a key that stays inside the link. Runner stores only the encrypted copy, cannot read it, and erases it as soon as the link is opened or cancelled, or after at most 7 days.
Exporting: The organization's owner can export every saved login, including passwords and 2FA keys, to a file after confirming it's them. Each export is recorded.
AutoFill on your devices: If you turn on AutoFill in the Pouch app, it can fill a saved login on that device after Face ID, Touch ID or your device passcode. Each fill is recorded, and you can remove the device in Pouch at any time.
Pouch history to your own systems: If your organization connects a webhook for Pouch history, we send each act to the address you chose: what was done and when, who did it and anyone given access (their Runner user id, and their email while they are a member), the agent's name, the login's service and, if login details are on, its website. We never send a password, notes, a 2FA code or the login's sign-in name.
Agents signing in to your own website: If you show Runner a website is yours, an agent on your team can sign in to it with a password you keep in Pouch, each time a person on your team approves. Runner's own browser enters the password; the agent never sees it. That browser runs on Google Cloud, so the password passes through Google Cloud for that one sign-in. What it reads on your website goes to your product's AI model, which writes a short note: Runner keeps the note and drops the text. Every use is recorded.
From your phone or watch: If you turn notifications on, a notification token and a device label, so Runner can reach that device. If you pair a watch, its token, which Runner's server stores only as a hash. Settings, Devices shows both: turn notifications off or revoke a watch there.
What the apps do not collect: No advertising and no tracking across other apps or websites. No analytics or crash reporting tools. No location. Runner does not read your photo library or your phone's contacts, calendar or health data. A picture leaves your phone only when you choose it and press send. Calls you make from the app are not recorded. Speech you dictate becomes text, and no recording is kept; see voice input above.
Why: To run Runner for you and your team: to sign you in, show your work, keep each organization's data separate, and keep the account secure. Runner may also use de-identified measures of how it performs, never tied to you, to improve it, unless your organization's owner or admin has switched this off; see the terms. Runner does not sell it or use it to advertise to you.
How long: For as long as your account exists, as described in how long any of this is kept below.
Deleting your account: In Runner, on the web or in the app: open Settings, choose Delete account, then Delete my account. Your sign-in, memberships, personal settings and devices are deleted 30 days later, and you can cancel until then. Work you created for your organization stays with it, shown as a former member. You can also ask at privacy@runtheworld.ai.

How far identification goes, and where it stops

When someone visits a site running this product, the software tries to work out where the visit came from. How far it is allowed to go depends on where the visitor is, and the decision is made by the software rather than left to whoever installed it.

There are three outcomes. It can resolve nothing. It can resolve the organisation a visit appears to come from, which is a statement about a company and not about a person. Or, in the United States only, it can resolve a named person — and that requires the customer to have connected their own account with an outside provider that offers it.

Outside the United States, person-level identification is not performed. If the software cannot work out where a visitor is, it refuses the higher tier rather than guessing: an unknown location never unlocks more collection than a known one.

A person-level match is an inference, not a fact: It comes from an outside provider matching a network address against their own data. It can be wrong, and the product treats it as a claim to be weighed rather than as something known.
Being identified does not make you a contact: An identification of this kind does not create a contact record on its own, does not add anyone to a mailing list, and does not start any outreach. Those are separate steps a person at the customer has to take deliberately.
A Global Privacy Control signal stops the person-level tier: If your browser sends the signal, an attempt to resolve you to a named person is refused and recorded as refused. See the section on that signal for everything else it changes.

Why each kind of information is handled

Different information is handled for different reasons, and the reason changes what choice you have. Where the reason is your permission, you can take it back and the handling stops. Where it is not, you can still object and ask for deletion.

Company-level information about a visit: Handled because a business has a genuine interest in knowing which organisations look at its site, and because it describes a company rather than a person. No permission is requested for it, and no banner is shown asking for one.
Person-level identification of a visitor: Only in the United States, only where a customer has connected a provider for it, and never where a Global Privacy Control signal is present. In regions where the rules require permission first, this tier is not offered at all.
What you type into the chat widget: Handled to answer the question you asked. It is not used for marketing unless you separately and explicitly opt in, and opening a chat is never treated as agreeing to anything.
Marketing contact: Only on permission that was actually recorded, never assumed from the fact that we hold your details or that you contacted us. You can take that permission back at any time.
Security and abuse prevention: Session and request information is kept so that abuse of the widget can be detected and stopped. A business has a genuine interest in not having its own systems misused.

Global Privacy Control, and exactly what it does

If your browser sends a Global Privacy Control signal, this product acts on it. It is honoured on its own terms: no lookup of where you are, no check of whether your region requires it, and no way for the company running the site to switch it off.

Because a vague description of this is worse than none, here is precisely what changes.

You are not resolved to a named person: Any attempt to match your visit to a specific individual is refused, and the refusal is recorded as a refusal rather than silently passed over. This is checked before anything about your location is considered.
No third-party person lookup is made about you: The request to the outside provider that performs that matching is not sent. If the software cannot tell whether you sent the signal, it refuses that lookup as well.
Nothing lasting is stored in your browser: No persistent identifier is written. The visit uses a temporary value that is not kept after the page is closed, so you are not recognised on your next visit.
No permission is granted on your behalf: Where the software would otherwise have treated an analytics category as allowed by default, it does not, and it does not go looking for a stored permission for you.
If you send us an enquiry form, it is not tied to your browsing: The enquiry itself still reaches the company you sent it to — you asked them a question and they get it — but the link between that enquiry and your earlier browsing is dropped.
If recording is ever switched on, the signal raises the bar: It would require a separate, explicit yes rather than a notice, and it rules out any secondary use of what was said — no model training, no profile building, no sharing with an identity or advertising partner.
What it does not do: It does not stop the site from counting the visit at all, and it does not stop the organisation a visit appears to come from being resolved — that is a statement about a company rather than about you. If you want no measurement of any kind, a browser content blocker is the tool that achieves it, not this signal.

Where you are changes what happens

The rules that apply to you are not the same everywhere, so the software decides per visit rather than applying one posture to the world. Your location is taken from the hosting platform's own reading of the connection, not from anything your browser claims, so a changed browser setting cannot talk the software into a weaker posture.

In the United States: Person-level identification is possible, if the company running the site has connected a provider for it and you have not sent a Global Privacy Control signal. Where the specific state cannot be read, the most protective United States setting is applied rather than the most permissive.
In the European Economic Area and the United Kingdom: Identification stays at the level of the organisation a visit appears to come from. Person-level identification is not offered.
Everywhere that has not been reviewed: The software refuses rather than guesses. An unreviewed location gets the more protective treatment, and if recording is ever switched on it would not be available there at all.
When no rule can be satisfied: Nothing proceeds. The absence of a known rule is never read as permission, and the outcome is recorded with the reason so it can be checked afterwards rather than looking like nothing happened.

Analytics on this website, and who receives it

This section is about this website — the pages you are reading now — rather than about the product. Three outside companies are involved. Google and Microsoft provide analytics, and what each one receives depends on the analytics choice you make in the notice this site shows you. Cloudflare checks this site's forms that send what you type to us, and the quizzes' “Use this plan in Runner” button, and only once you start filling in a form or press that button.

The notice itself, and the record of what you chose, are ours rather than a third party's. They are served from our own systems, which is why declining still works when you block outside scripts.

Google Analytics, before you decide: Google receives one signal from the page even if you never answer the notice. It carries a flag saying every consent category is denied, sets no cookie, and is not tied to you or to a profile. This is how Google's consent mode is built to behave, and we would rather describe it than let you discover it in a network log.
Google Analytics, after you accept analytics: Google receives the pages you visit and the events this site defines, and may set its own cookies to recognise a returning browser. Accepting marketing as well allows advertising signals; leaving it off keeps them denied while analytics runs.
Microsoft Clarity: Clarity records a replay of how a page was used — pointer movement, clicks, scrolling — and builds heat maps from it. It is not loaded until you accept analytics, so a visitor who declines or never answers sends nothing to Microsoft and downloads none of its code. Text you type into a form field is masked before it leaves the page, in every mode Clarity offers.
Taking analytics back: Reopening the notice and declining stops both. Clarity is told to stop recording and its cookies are cleared, and Google's signals return to denied. A recording already made before you withdrew is Microsoft's to expire on its schedule, which is why the question is asked before anything loads rather than after.
Cloudflare, on forms and the quiz handoff: If you start filling in one of this site's forms that sends what you type to us, or press “Use this plan in Runner” after one of its quizzes, Cloudflare's Turnstile check loads to tell a person from an automated script. Cloudflare receives information about your browser and connection, such as your IP address, to make that decision; most people never see it. It runs whatever you choose in the analytics notice, because it protects what you send rather than measuring you, and it does not load for anyone who does neither.
Taking a quiz plan into Runner: If you press “Use this plan in Runner” after one of this site's quizzes, your four answers, and which quiz you took, go to Runner. They are kept on your account's sign-up record only if you finish signing up, and setup shows them as suggestions that set nothing on their own. Clearing them there deletes them. If your browser sends a Global Privacy Control signal, Runner drops them.
What this does not include: None of the three is sent your name, your email address, or anything you enter into an application form. If you submit one, what you typed goes to our own database and to the people who read applications.

The AI assistant, and who is actually reading

If you open the chat widget, the replies you get are generated by software. There is no person sitting on the other side reading your messages as you send them and typing back.

That is said first, before anything else about the conversation, because it is the thing most likely to be misunderstood — and because the assistant may be shown with a name and a portrait. The portrait represents the assistant. It is not a photograph of someone replying to you.

A person may read it afterwards: People at the company you were talking to can review conversations later — to answer a question the assistant could not, to check quality, or to follow up. 'No person is reading live' is not the same as 'no person will ever read this', and it would be misleading to let the first imply the second.
Who at Runner can read it: A few Runner staff can reach what a company stores in Runner, including conversations like this one. They do not look at it unless that company asks us to for support, it is needed to investigate a security problem or abuse, or the law requires it.
Your message text goes to an AI provider: Generating a reply means sending what you wrote to an outside AI provider. Personal details you type into a message are not stripped out before that happens, so treat the box the way you would treat an email to a company you do not know well.
You can ask for a person: At any point. Asking does not require you to justify the request.
Chatting is not agreeing to marketing: Using the widget is never recorded as permission to market to you. That takes a separate, explicit opt-in.

Recorded conversations — not switched on yet

This section describes something that is being built and is not running. Nothing in this product records a conversation today. The chat widget has no ability to capture your microphone or camera, and there is no route that would accept audio from a visitor. (Runner's own voice input, for the people who use Runner, turns one spoken sentence into text and keeps no recording; it is described under what is collected.)

It is described here rather than left out so that you can see the design before it arrives, and so that this page does not have to be rewritten in secret when it does. When it becomes available, this section will be updated and the version at the top of the page will change.

Current status: not active: Nothing records you. The software that would perform it is present but is not connected to any surface, and it refuses to start for several independent reasons — including that the wording a visitor would be shown has not been approved for use.
The microphone button that exists today does not record you: If your browser offers speech-to-text, the widget can use it. Your browser does the conversion and only the resulting text is sent. No audio reaches this product. Your browser may use its own speech service to do it — that is between you and your browser, and its settings control it.
When it does arrive: you will be asked first: Recording would start switched off. You would be told, before anything could listen, that the other party is software and that the conversation would be recorded and written down. Declining would keep the conversation going as text rather than ending it.
In some places, a notice would not be enough: Where the rules require everyone in a conversation to agree, or where the local regime requires a prior opt-in, it would take a separate explicit yes rather than a notice. Where the location cannot be established, or has not been reviewed, recording would not be offered at all.
Stopping, mid-conversation: You would be able to stop at any point, and stopping would delete the recording of what you had already said rather than merely halting the capture. The conversation would carry on as text. The record that you agreed and then withdrew would be kept — deleting that would destroy the only evidence the software behaved correctly.
How long a recording would be kept: Not decided yet. Rather than print a number that has not been agreed, this page will state the period once there is one. The deletion-on-withdrawal rule above does not depend on it.

AI participants in meetings — not available to customers yet

This product is being built to let a company send an AI participant into its own video meetings: a notetaker that listens and writes things down, and a teammate that can also speak when spoken to. They are separate, and a company chooses per meeting whether either joins. Neither is available to customers. The notetaker has joined only our own internal calls, as a pilot, and the teammate that can speak has never joined a meeting. The words the notetaker says on arrival are approved for that internal pilot only and have not been reviewed by counsel, so a meeting with anyone from outside our company in it is refused.

As with recorded conversations above, the design is described here before it arrives so that it can be argued with now. When it becomes available, this section will be updated and the version at the top of the page will change.

Current status: an internal pilot, not available to customers: The notetaker has joined only our own internal Google Meet calls, and was first seen working from start to finish on 30 October 2026. It is not available to any customer. A meeting with anyone from outside our company in it is refused until the words it says on arrival have been reviewed by counsel. Nothing is kept longer than the 30 days described below.
It would arrive as itself: The participant would be named as an AI in the meeting's participant list, would say out loud on arrival that it is software and may record, transcribe, and speak, and would post the same notice into the meeting chat. The notice is both spoken and written because either channel alone leaves someone out — spoken misses people who are deaf or hard of hearing, written misses people who are blind.
Where everyone must agree, agreement comes before the join: In places where the rules require every participant to agree to recording, the design treats joining — not recording — as the thing that needs the agreement, because a bot that enters first and asks second has already heard the room. Without the agreement, it stays out. Where a location is unknown or has not been reviewed, the stricter reading applies and it stays out too.
Leaving is part of the design: A bot that is admitted but does not obtain what it needs to operate leaves after a short, fixed time rather than sitting in the room. A meeting that ends up containing only notetaking software gets left as well.
No voiceprints unless that is separately agreed: Working out who said what from the sound of a voice creates a biometric identifier. That is off by default: without a separate agreement covering it, a transcript records what was said without naming speakers by voice.
Recordings would stay on our own systems: Audio and transcripts would be processed on infrastructure we run rather than passed to an outside transcription service, and deletion on withdrawal reaches the stored recording itself, not only the text made from it.
How long a recording is kept: Anything kept is held for 30 days and then deleted, which is also what the notetaker says when it joins. When a recording is transcribed, the audio is deleted as soon as the transcript is saved, and the deletion-on-withdrawal rule above applies sooner where it applies.

Text message reminders

A booking page can offer one text reminder before a meeting. The box is never ticked for you, and you can book without it.

What is kept: If you tick the box: your mobile number, the sentence you agreed to, and when you agreed. That is the record that you asked for the text.
Who receives your number: Twilio, the company that delivers the text, receives your number and the message in order to deliver it. On a booking page run by a Runner customer, that customer holds your number too, and the text goes out on its own account.
Never for marketing: Your mobile number and your agreement to receive texts are not sold, and are not shared with third parties or affiliates for their marketing or promotional purposes.
Stopping: Reply STOP to any text and no more go to that number. Reply HELP for help, or email privacy@runtheworld.ai.

How long any of this is kept

The honest summary is that some deletion is on a fixed timer and some is not yet, and this page distinguishes the two rather than rounding both up to the reassuring answer.

The content of a conversation: 90 days after it is closed: Messages, attachments, and the stored copies of messages that arrived from another platform are deleted 90 days after the conversation is marked closed. This runs automatically. If a conversation is never closed, that timer never starts — so an abandoned conversation can sit longer than 90 days.
Everything else: as long as it is needed, then deleted: Account records last as long as the account. Visit and session records are kept while they are useful for measurement and for spotting abuse. Some of these deletion steps are still carried out on request rather than on a timer; where that is the case, asking us is what makes it happen, and we would rather tell you that than imply a schedule that is not running.
Records that deliberately survive a deletion: If you ask not to be contacted, the record of that request is kept — otherwise we would have no way to keep honouring it, and you would end up back on a list. The same applies to the record of a permission being given and taken back, and to accounting records we are separately required to hold.
A legal hold pauses deletion: If information is subject to a legal hold, deletion is blocked and the request is reported as blocked rather than quietly skipped. Silently keeping something after you asked for it to go is the failure worth guarding against.

What you can ask for, and how

Depending on where you live you may have rights to see what is held about you, to correct it, to have it deleted, to object to how it is used, or to take it elsewhere. Rather than list rights in the abstract, here is which of them you can exercise directly today and which need a person to act on.

Stop marketing email — immediate, no account needed: Every marketing message has a one-click unsubscribe. There is also a preferences page reached from those messages where you can change what you receive. Opening either does nothing on its own; the change happens when you choose it.
Stop being tracked — immediate, no account needed: The tracking used on a customer's site can be withdrawn from the site itself, which clears the identifier stored in your browser. A Global Privacy Control signal achieves the identification part of this automatically and permanently.
See, correct, or delete what is held about you: Ask the company whose website you were on. They hold the relationship and they can act on it. Their staff have tools in this product to find your record, export it, and erase it, and an erasure reports honestly on anything it could not reach rather than reporting success.
If you were only ever an anonymous visitor: There is currently no self-service way to file a deletion request for someone who never became a contact, because there is no verified record to attach the request to. Contact the company whose site you were on and they can act on it. We would rather state this gap than describe a form that does not exist.
Complain: You can raise a concern with your local data protection authority. Doing so does not require you to have contacted us first.

Outside providers, and how to find out which ones

Some things are done by other companies on our behalf — generating an AI reply is the main one, along with hosting, sending email, and telephony where a customer uses it.

Which AI provider processes a given conversation depends on how the product is configured, and it is becoming a customer-selectable choice. So rather than print a vendor name here that could be wrong for your situation, the published provider list is generated from the configuration that is actually in force. It names each provider, what they do, and how long they keep what they receive.

Where to look: The providers page linked from the footer of this site. If you are dealing with a specific company using this product, ask them which providers their configuration uses — the answer is theirs to give and it may differ from the default.
What we do not claim: We are not going to tell you an agreement is signed that this page cannot verify. If you need the contractual terms covering a provider's handling of your data, ask for them directly rather than treating this page as evidence of them.

Where in the world this data goes

This product runs on hosting and provider infrastructure that is not confined to any one country. If you are outside the United States, assume your information is processed there and in other countries where our providers operate.

There is no option to keep data in a particular region, and no region selector. If your situation requires one, this product does not offer it today and you should know that before choosing it rather than after.

What we are not claiming: This page does not claim any particular transfer mechanism, certification, or audit. We hold no security certification that we are asserting here, and we would rather say that than let a reader assume one from silence.

If you are invited into a deal room, or sign in one

A business that uses Runner can send you a private link to its deal room, and you can open it without an account. Either side can sign an agreement there. This part says what Runner keeps when you do.

What you do in the room: Runner keeps the questions your side asks, and notes each read, each shared document opened and each change to the plan, whether your team or your agent made it, and when. The business that invited you sees that record, and so does your side, in your room and through your agent. One guest company never sees another's.
A code to your work address: If the business named your company's domain, the first time you open the link Runner emails a six-digit code to the work address you enter. Runner stores only scrambled hashes of the address, the code and the pass that keeps that browser signed in to the room.
If you sign: A signature records your name and any title, your email address, confirmed by a code when you are the other company's signer or by your account when you are the host, the time, the country your connection came from, how you signed, your consent to sign electronically, and the document's fingerprint. Runner does not store your full IP address for this. A drawn signature is kept as the shape of its strokes, and a typed one as the name and the typeface.
The signed PDF: When every party has signed, Runner seals one PDF with those details on a certificate page, keeps it in private storage with the agreement, and emails it to each signer.
A saved signature: You can choose to save your signature for next time. It is tied to your account or your confirmed email, you can delete it whenever you like, and it is never applied without you pressing Sign. A signature already on an agreement is a copy, so deleting the saved one changes no signed document.

If you connect Runner to an AI assistant

Everything above is about people who visit a website running this product. This part is for the people who use Runner itself. If you connect Runner to an AI assistant such as ChatGPT or Claude, you sign in with your Runner account and choose which of your products the assistant may read.

The assistant can then ask Runner for business information from those products: traffic and source counts, ad channel status and spend, deal stages and values, revenue totals, scheduled content, company names, and counts of items waiting for attention. In a deal room you have joined, it can also get the agents' answers the room's sharing rules release to an assistant, and ask the room's agents a question.

Outside a deal room, it does not see people's contact details: Outside a deal room, Runner never gives a connected assistant a contact's name, email address, phone number or message content. Those fields are removed before an answer leaves Runner.
In a deal room, it gets what the rules release: In a deal room you have joined, the assistant gets only the agents' answers that the room's sharing rules release to an assistant, each with the name its owner gave that agent. The questions people type, the titles of plan steps and documents, and colleagues' own replies stay in Runner. Its questions to the room's agents are answered under the same rules, and never appear in the thread the other company reads.
It drafts only if you let it: Runner's sign-in screen has a Can draft switch, on unless you turn it off. With it on, the assistant can save posts and articles as drafts and hand your growth team an idea or a document to work from. Posts and articles wait in Runner until someone approves them. Turn the switch off and the assistant only reads.
It cannot send, spend or approve: A connected assistant cannot send a message, spend money, change an ad or a budget, or approve anything — those stay in Runner, where the approval steps are. An app that asks for broader access says so on Runner's screen before you allow it. It can then also schedule or cancel posts, record costs, and suggest a note on a contact for someone to apply. Scheduling and costs run straight away only for an owner or admin; anyone else's go to Approvals first.
It only sees what you can: Each request is checked against your own Runner role at that moment and recorded in your workspace's audit log.
What happens to the answers: Once Runner answers, what the assistant does with that information is governed by the assistant provider's own terms and privacy policy, not by this statement.
Turning it off: You can disconnect an assistant at any time from Settings → MCP clients in Runner. The next request it makes is refused.

If you connect Google services to Runner

This part is also for the people who use Runner itself. You can connect Google services to a Runner product: Google Analytics, Google Search Console, Google Ads, Google Calendar, Google Meet, Gmail for sending, Google Tag Manager, YouTube and Google Drive. Each one is a separate step that asks Google only for the access that feature needs, and you choose the Google account.

Runner's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What Runner reads and keeps: The email address and account ID of the Google account you connect, so you can see which account is connected and disconnect it. Google Analytics: daily sessions, events and active users for the property you choose, and that property's identifiers. Google Search Console: the search queries, pages, clicks, impressions and average positions for the site you connect. Google Ads: daily campaign, ad group, keyword and search-term results — names, status, spend, clicks, impressions and conversions. Google Calendar: free and busy times and the events on your My Day page, read when you look and not stored; Runner keeps the identifiers of events it creates. Google Meet: transcripts and participants' display names for meetings you hosted, kept for 90 days unless your organization sets a different period. Google Tag Manager: your published container, compared and not stored. YouTube: your channel names and identifiers. Google Drive: the text of the files you choose, for your workspace's knowledge base. Gmail: only the identifier Gmail returns for a message Runner sends — Runner does not read your mailbox. Reports Runner pulls from Google are kept while the product stays connected.
What Runner changes in your Google accounts: It sends email you approved from your Gmail address, and creates calendar events for meetings you or your booking page schedule. When an owner or admin approves a setup plan, it creates or updates Google Analytics properties and data streams; Runner asks Google for permission to edit Google Analytics only at that point. It creates and changes Google Ads campaigns, budgets, ads and keywords after a person approves the change, or adjusts budgets automatically only within a total an owner has set.
Who receives it: Google user data is shared only to run the features described here: with the members of your workspace who have access to that product; with the companies that host Runner's application and database, which store and process it on Runner's behalf; with the AI model provider your workspace uses, only for the features listed under AI models below; and with an AI assistant you connect yourself (see the section above). Runner does not give it to advertising platforms, data brokers or information resellers. Beyond that it is disclosed only where the law requires it, to investigate security problems or abuse, or as part of a merger or sale of the business, and in that last case only with your explicit consent first.
How it is protected: Google user data travels only over encrypted connections (HTTPS, with HSTS) and is encrypted at rest in Runner's database. The access tokens Google issues to Runner are encrypted again with AES-256-GCM, using a key kept outside the database; no user, including your workspace's own owners and admins, can read them, and they are kept out of Runner's logs. Database row-level security keeps each organization's data separate from every other organization's. Connecting and disconnecting a Google account is recorded in an audit log. Runner asks Google only for the access each feature needs, one feature at a time.
AI models: The AI model provider your workspace uses receives Google Meet transcripts, to extract notes and next steps; your Search Console queries and their figures, when you ask Runner for an SEO brief; and passages from the Drive files you add to your knowledge base, when Runner's chat assistant drafts an answer from them. Runner does not use Google user data to develop, improve or train AI or machine-learning models.
Who can see it: Members of your workspace who have access to that product, and an AI assistant you connect yourself (see the section above). Runner staff do not look at it unless you ask us to for support, it is needed to investigate a security problem or abuse, or the law requires it.
No selling, no advertising: Runner does not sell Google user data, does not use it for advertising, and does not use it to decide anyone's creditworthiness or for lending.
Disconnecting and deletion: You can disconnect each Google service in Runner's settings at any time; Runner then revokes its access with Google and stops reading. Disconnecting the Google account from a product's Analytics settings also deletes the access token Runner stored and the Google Analytics, Google Ads and Search Console reports it pulled for that product; disconnecting Google Calendar deletes its stored token too. To have anything else deleted, such as Drive text in your knowledge base, email privacy@runtheworld.ai. You can also remove Runner's access from your Google Account at myaccount.google.com/permissions.

If you connect a point-of-sale system or add its sales report

This part is for shops, cafés and restaurants that use Runner. You can give Runner your sales in one of two ways: connect a point-of-sale system (Square, Shopify POS, Clover, Lightspeed Retail or Toss Place), or drop in a sales report your point-of-sale system exports. Either way, Runner uses your sales to plan your growth team's work. Runner does not want, and does not keep, your customers' names, email addresses, phone numbers or card numbers.

If you connect your point-of-sale system: You sign in to your point-of-sale provider and choose which locations Runner may see; with Toss POS, you enter Runner's service code in the POS instead. Runner only reads: what sold, how many, when and at which location, your item names, and, where your system reports it, how much of each item is in stock. It never changes anything in your point-of-sale system. Runner checks for new sales every hour, and sooner when your provider notifies it of a change. Customer details that come with an order are discarded before anything is stored, and point-of-sale providers do not give Runner card numbers. If you connect Shopify, Runner also checks each order's email against the leads already in your Runner workspace, in memory, and keeps only the match — the date and amount, linked to that lead — never the email itself. A shopper who isn't already one of your leads leaves no trace, and Runner never adds shoppers as contacts.
If you add a sales report instead: The file is read in your browser, on your computer, and the file itself is never uploaded. Only a summary reaches Runner. Runner does not read the report's customer columns.
What Runner keeps: A summary of your sales for a period: the number of orders, items and units, the sales total and currency, the average order, up to ten best sellers by name with their units and sales, orders by day of the week and hour, and how many locations you have. From a connected system, Runner also keeps the name and account ID of the business you connected, so you can see it and disconnect it, and, where the system reports stock, your current stock levels by item and location. From Shopify, when an order matches one of your existing leads, Runner keeps that match: the date and amount, linked to the lead.
Who receives it: The members of your workspace who have access to that product; the companies that host Runner's application and database, which store and process it on Runner's behalf; and the AI model provider your workspace uses, which receives your best sellers and your busy and quiet times, so your team can plan and draft its work. Runner does not sell your sales data or give it to advertising platforms or data brokers.
How it is protected: Sales data travels only over encrypted connections and is encrypted at rest. The access tokens your point-of-sale provider issues to Runner are encrypted again with AES-256-GCM, using a key kept outside the database. No user, including your workspace's own owners and admins, can read them, and they are kept out of Runner's logs. Database row-level security keeps each organization's data separate. Connecting and disconnecting is recorded in an audit log.
Disconnecting and deletion: You can disconnect your point-of-sale system in Runner at any time. Runner then revokes its access where your provider allows it, stops reading, and deletes the access token it stored, the sales summaries it synced and any stock levels, and any Shopify lead matches. Removing Runner from inside your point-of-sale system does the same. To have the summaries from reports you added deleted, email privacy@runtheworld.ai.

Paying through a payment link

If a business you buy from sends you a payment link through Runner, Runner records for that business which of its contacts paid for which item.

How a payment is matched: By the link it sent you, or by your email address matching a contact the business already had.
What Runner does not do: It does not create a contact from a payment, does not store your card details, and does not use this to send you marketing.

How a customer's own settings change this

This product is installed and configured by the company whose website you were on. Several things on this page are theirs to turn on or off, so the accurate answer for any specific site is 'this, as that company configured it'.

Whether person-level identification happens at all: It requires the customer to connect their own account with an outside provider. Most of what this page describes about that tier does not apply if they have not.
Whether the chat widget is on the site, and what it looks like: Including the assistant's name and portrait. The portrait represents software; it is not a photograph of a person replying to you.
Which outside providers process what you type: See the section on outside providers below.
What the customer does with the result: Whether anyone is contacted, and how, is the customer's decision and their responsibility. Ask them directly what they hold about you.

Who is responsible for this, and how to reach them

The organisation behind this product is established in the Republic of Korea, so Korean privacy law applies to it directly. That law requires a named person to be responsible for how personal data is handled, and requires that you be told how to reach them.

Privacy requests go to privacy@runtheworld.ai. Use it to ask what is held about you, to have something corrected, to have something deleted, or to complain. It is a working address rather than a formality, and a request sent to it is answered.

If a company used this product on their website and your question is about what that company holds, they will usually be able to answer faster — they decide what is collected on their site. Either route works; that one is often shorter.

개인정보 보호책임자: Privacy requests and complaints: privacy@runtheworld.ai. The designated officer is the representative of SHMAPLEX, named on the terms page.
How long a request takes: Korean law allows ten days to answer a request to see what is held about you. If something will take longer than that, you are told why rather than left waiting.
If you are not satisfied: You can raise it with the Korea Internet & Security Agency's privacy complaint centre (privacy.kisa.or.kr, 118) or the Personal Information Protection Commission. Saying so here is not an invitation to skip us — it is a route you have whether or not we mention it.

How to reach us about this

If a company used this product on their website and you want to ask what they hold about you, ask that company first. They decide what is collected on their site and they can answer for it; this product is the software they run.

If you want to reach us directly about this statement, use the address in the section above. We would rather answer a question than have you guess from this page.