Privacy Policy

1. Introduction

Runta, Inc. ("the Company," "we," "us," or "our") operates the website runtahq.com and the Runta runtime governance platform (collectively, the "Service"). This Privacy Policy explains what information we collect from visitors to runtahq.com and from engineering teams evaluating or using the Runta platform, how we use it, and the choices you have.

Runta builds runtime infrastructure for platform teams deploying AI agents in regulated environments. Our core product processes operational data that customers submit: agent execution traces, policy configurations, resource quota telemetry, egress enforcement records, and tamper-evident audit logs. This data is processed under a Data Processing Agreement ("DPA") entered into with each customer separately. This Policy covers data we collect in connection with the marketing and documentation website at runtahq.com. Customer-submitted operational data processed under a DPA is governed by that agreement.

The Company is based at 301 Howard Street, Suite 1100, San Francisco, CA 94105, and can be reached at [email protected].

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, work email, company, role) when you fill out the early access request form, contact form, or subscribe to blog updates;
• Technical context you choose to share about your agent deployment environment (stack, runtime, infrastructure provider, regulated-industry context);
• The content of any messages you send us through the contact form or by email.

We do not collect payment information on runtahq.com; billing for paid tiers is handled by a third-party payment processor operating under its own privacy policy.

2.2 Information Collected Automatically

When you visit runtahq.com, we automatically collect limited technical information:

• IP address and approximate location (city/region level);
• Browser type, operating system, device class;
• Pages visited, referring URLs, time on page;
• Cookie and similar identifiers (see Section 5 and our Cookie Policy).

We use anonymized, self-hosted analytics. We do not use third-party advertising trackers or behavioral advertising on this site.

2.3 We Do Not Knowingly Collect Children's Data

runtahq.com is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

We use the information we collect to:

• Respond to early access requests, technical inquiries, and support communications;
• Operate and improve the runtahq.com website and product documentation;
• Send service updates and, with your consent where required, information about Runta product developments;
• Understand which documentation pages and governance topics are most useful to platform teams, so we can prioritize writing;
• Detect, investigate, and prevent abuse or unauthorized access to the platform;
• Comply with legal obligations.

We do not sell personal information for monetary value. We do not use visitor data from runtahq.com to train machine-learning models. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see the California-specific section below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (including hosting infrastructure, transactional email delivery, and anonymized site analytics) under contractual confidentiality terms that restrict their use of data to the services they perform for us;
• Authorities, when required by law, court order, or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties and we do not disclose personal information to third parties for their own direct marketing purposes.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences, and measure usage. We do not use advertising or cross-site tracking cookies. For details and choices, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as needed for the purposes described, to comply with legal or accounting obligations, and to resolve disputes. Early access inquiry records are retained for as long as the associated evaluation is active, plus a reasonable follow-up period, and are deleted upon request. Inactive marketing-list contacts are purged after 24 months. Server access logs are retained 90 days, then aggregated or deleted.

Customer operational data processed under a DPA (agent execution logs, policy records, audit trails) is retained and deleted according to the terms of that agreement and the service tier the customer is subscribed to.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including TLS encryption in transit, restricted-access infrastructure, and least-privilege access controls. These are the same principles that underpin the Runta runtime governance product itself. No system is perfectly secure; we cannot guarantee absolute security. If you discover a security concern related to personal data, please contact [email protected].

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), California residents have specific rights regarding personal information collected about them. This section supplements the rest of the Policy.

9.1 Categories We Collect

In the past 12 months, we have collected the following categories of personal information defined under Cal. Civ. Code §1798.140: identifiers (name, work email, IP address); commercial information (platform evaluation inquiries, service tier interests); internet activity (browsing activity on runtahq.com including documentation pages and pricing); and inferences drawn from the above for service-improvement purposes. We do not collect sensitive personal information as defined in Cal. Civ. Code §1798.140(ae) through runtahq.com.

9.2 Sources, Purposes, Disclosure

We obtain this information from you directly (via forms and email) and through automatic site instrumentation. We use it to operate and improve the Service, communicate with you about the Runta platform, and meet legal obligations. We disclose it only to service providers under written contract and to legal authorities where required.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not use sensitive personal information for purposes beyond those permitted without authorization.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints can be sent to: