Privacy policy

• Operator: Marius Serban.
• Tax id (NIF): [NIF pending].
• Address: [address pending], Spain.
• Privacy contact: privacy@runomine.com.
• Data protection officer: none appointed.

The operator details required by LSSI art. 10 are in the legal notice.

• Measuring this public site. We count visits to the public pages and the signup page with runomine itself, server-side and without cookies: path, referrer and campaign, browser, device and country, and a visitor hash computed from the IP and user agent with a key that changes every day (the IP isn’t stored). When you sign up, create a site or a site receives its first data, we record that as an event with your user id (no name or email). Why: knowing which pages and sources bring people and whether they get set up. Legal basis: legitimate interest in measuring and improving our own service (GDPR art. 6(1)(f)). Retention: visits, 400 days; events, while the account exists [to confirm].
• Visiting this public site. The public site sets no cookies. Our hosting provider logs each request: IP, time, path and possibly the user agent. Why: serving the site, security and diagnostics. Legal basis: legitimate interest in keeping the service secure (GDPR art. 6(1)(f)). Retention: our hosting provider’s log retention [period to confirm].
• Signup and account. Name, email and password, stored as a bcrypt hash, never in clear. Why: creating and running your account and workspace. Legal basis: performance of the contract (GDPR art. 6(1)(b)). Retention: while you have the account; then [period pending] to deal with possible legal claims.
• Dashboard session. Session id, IP and user agent (in the sessions table), and the technical cookies in section 3. Why: keeping you signed in and protecting your account. Legal basis: performance of the contract, and legitimate interest in security. Retention: the session expires after 120 minutes idle, and expired sessions are deleted periodically.
• Abuse protection. A key derived from your IP through a hash, not the IP in clear, to rate-limit attempts at login, signup and the API. Why: preventing brute force and abuse. Legal basis: legitimate interest in security. Retention: it expires within a minute to an hour, and expired entries are deleted daily.
• Invitations. The invitee’s email, role, inviter and dates. The link is stored only as a hash. Why: granting access to a workspace or a site. Legal basis: the inviter’s and the invitee’s legitimate interest in working together. Retention: not deleted automatically today [period to be decided].
• Personal tokens and CLI. The token’s name, last use, and the name of the device approving runomine login. Tokens and codes are stored as hashes. Why: access to the API, the MCP server and the CLI. Legal basis: performance of the contract. Retention: until you revoke the token; device codes expire after 10 minutes.
• Sites and integrations. Each site’s name and URL, markers, payment-provider credentials (encrypted) and the provider account’s name. Why: providing the service. Legal basis: performance of the contract. Retention: until you delete the site or disconnect the integration.
• Messages. Whatever you write to us. Why: answering you. Legal basis: legitimate interest or performance of the contract. Retention: as long as needed to deal with it.

We make no automated decisions with legal effects and do no profiling. We don’t sell data.

Your sites’ visitors’ data. When you use runomine to measure your sites, we process your visitors’ data on your behalf, as a processor. That is governed by the data processing agreement (DPA, GDPR art. 28), not by this policy. The agreement is being prepared and is pending legal review: ask us for it at privacy@runomine.com.

The public site (runomine.com and runomine.com/en) sets no cookies.

The dashboard (/app, /login, /signup) sets only technical cookies, strictly necessary for the service you ask for and therefore exempt from consent (LSSI art. 22.2):

• runomine-session: keeps you signed in. Lasts 120 minutes idle.
• XSRF-TOKEN: protection against cross-site request forgery (CSRF). Lasts as long as the session.
• remember_web_…: “remember me” at login, ticked by default today. Lasts up to 400 days, or until you log out.

The beacon (r.js) that our customers’ site visitors may load sets no cookies and uses no localStorage.

• Railway Corporation (US): hosting of the service and the database, in its “EU West” region.
• Cloudflare, Inc. (US): the domain’s DNS, with the proxy off, and forwarding what you write to hello@ or privacy@runomine.com (Cloudflare Email Routing) to our mailbox [mailbox provider to confirm].
• Email: the application sends no email today. Invitations are shared as a link. If we add a provider, we’ll list it here.

We share no data with third parties except where the law requires it.

The data is hosted in the EU. Railway is a US company, and its processing agreement provides for access from the US; Cloudflare is a US company too. The safeguards are the EU-US Data Privacy Framework, where they are certified [to confirm], or otherwise the European Commission’s standard contractual clauses (Decision 2021/914).

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacy@runomine.com.

The app has no profile page or delete-account button yet: to correct your data or delete your account, write to us. We answer within one month.

If you think we haven’t handled your request properly, you can complain to the Spanish data protection authority, the AEPD (www.aepd.es), or to your local authority.

• HTTPS.
• Passwords stored with bcrypt.
• Tokens, codes and invitations stored only as hashes.
• Encrypted third-party credentials.
• Role-based access control.
• Rate limiting, with keys that don’t store the IP in clear.

If we change this policy in a material way, we’ll tell you in the dashboard or by email before the change applies.