Confidentiality Policy

The Privacy Policy tells you what we collect and what your rights are. This document is different: it describes how we govern personal information internally: who is accountable, how long things are kept, how they are destroyed, and what happens when something goes wrong or someone complains.

It applies to personal information about both:

• Business Users: the businesses and staff using Runday
• End-Clients: their customers, whose records they store in Runday

The person with the highest authority over the protection of personal information at Runday is its founder, who acts as Privacy Officer, contactable at [email protected]. That person is accountable for this policy, for handling requests and complaints, and for deciding whether an incident must be reported.

Runday is a small team. Where a role below is described in the singular, that is because one person currently performs it, not because responsibility is vague.

Access is limited by role, and enforced by the database itself rather than only by what the interface chooses to show. A business's records are unreachable from another business's account.

• Business owner: creates the account, controls their own client and staff records, and decides who on their team has access.
• Staff (manager, stylist, barber, front desk): access only their own business's data, and only the parts their role needs. A staff member sees their own earnings, not the whole payroll.
• Runday personnel: administrative access to production data is used only to operate the service, investigate a fault, or meet a legal obligation. Formal access log and internal approval step not yet in place.
• Processors: Supabase (database, Montreal), DigitalOcean (application server, Toronto), Resend (transactional email), Sentry (application error monitoring), Google Analytics (website measurement), and Cloudflare (network edge). Stripe is integrated for subscription billing but processes no payments until paid plans begin, when Runday opens to shops at the start of summer 2027.

Personal information is kept only while it serves the purpose it was collected for, or while the law requires it. In practice:

• While an account is active: records are retained so the business can actually use its own history: past appointments, sales, and commission records.
• Deactivation instead of deletion, inside the product: archiving a service or deactivating a staff member deliberately preserves the financial history attached to them. A commission record that quietly vanished when someone left would make past pay periods impossible to audit.
• When an account ends: today the only way an account ends is the owner deleting it from Settings, which removes everything immediately. We do not yet have a process that closes an inactive or unpaid account, so there is no grace period to describe. When we build one, it will keep export working throughout and warn before anything is deleted, and this page will say so before the behaviour ships.
• Destruction: deleting an account from Settings removes every record belonging to it in a single operation: locations, staff, services, clients, appointments, walk-ins, sales, commission records and the staff portal logins. It is a real delete, not a hidden flag, and it runs immediately rather than being queued for later. Backup copies expire on their own cycle within 30 days, after which no copy remains. Our own accounting records, meaning what the business paid us, are held for the six years Canadian tax law requires. The business's own sales are not part of that: Runday never processes their clients' payments, so those records are theirs to keep and are deleted with everything else.

• Encrypted in transit over HTTPS/TLS, and at rest by our hosting providers
• Row-level security in the database, so tenant isolation is a property of the data layer rather than a promise made by the interface
• Passwords hashed by our authentication provider; never stored in readable form
• Staff logins created by an owner must be changed by the staff member on first use
• Rate limiting on public endpoints, and file-type validation on uploads
• Not yet in place: mandatory multi-factor authentication, formal staff privacy training, and a periodic access review.

Runday's database is hosted in Montreal, Québec, and the application server for rundays.ca is in Toronto, which is inside Canada but outside Québec. Some personal information still leaves Canada entirely: processors including Stripe, Resend, Sentry, and Google Analytics operate in the United States. Full detail is in the Privacy Policy.

A privacy impact assessment covering these transfers has been documented and is kept internally. It records what information is involved, what protections are actually in place, and what is still missing.

Its conclusion was settled on October 3, 2026 (every transfer adequately protected, texts to a shop's clients only under conditions), and a lawyer reviews it before Runday opens to shops. Two points remain open: whether free-text client notes should be treated as sensitive information, and filing each processor's written agreement, which section 17 requires (one is filed so far).

Law 25 requires an assessment before launching any project to acquire, develop or overhaul a system involving personal information, and before transferring it outside Québec.

One assessment has been carried out, covering the cross-border transfers described above. It is reviewed before any new processor is added, whenever an existing one begins handling a category it did not before, and at least once a year.

No standing process yet covers the other trigger: an assessment before launching a project to acquire, develop or overhaul a system involving personal information.

If personal information is accessed, used, disclosed, or lost without authorisation:

• We take reasonable steps to reduce the risk of harm and prevent a recurrence
• We assess whether the incident presents a risk of serious injury, considering sensitivity, likely use, and possible consequences
• Where it does, we notify the Commission d'accès à l'information and the affected individuals promptly
• Where a Business User's clients are affected, we notify the Business User so they can meet their own obligations
• Incident register: Law 25 requires a register of all confidentiality incidents, not only reportable ones. We keep one, recording what happened, whose information was involved, whether it presented a risk of serious injury, who was notified, and what we changed as a result. Entries are kept for five years after the incident becomes known. It holds one entry: from September 11 to 15, 2026, the error reports sent to our monitoring provider could include more technical detail than intended (the full address of a request, which can contain a phone number). It was corrected on September 15, 2026, presented no risk of serious injury, and was not reportable; at the time, only the founders’ own test data was in Runday.

Complaints about how we handle personal information go to [email protected]. We will:

• Acknowledge receipt and confirm who is handling it
• Investigate, and ask for anything else we need to understand what happened
• Respond in writing with our findings and what we intend to do, within 30 days, the period Law 25 sets for access requests
• Tell you where to take it if our answer does not satisfy you

You can complain to a regulator at any point, without going through us first. Contact the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

If you are an End-Client (a customer of a business that uses Runday), start with that business. They control your record; we hold it for them.

This policy is reviewed when the way we handle personal information changes, and otherwise at least once a year. The date at the top reflects the last change.

To be written: EU and UK, covering records of processing (GDPR Art. 30), DPO assessment, and controller/processor terms.

• Runday, operated from Québec, Canada
• Privacy Officer (Olivier Morin): [email protected]
• Runday is operated by Olivier Morin, an individual based in Québec, Canada. There is no registered company behind it yet, so you are contracting with that individual. A registered entity name and business address will replace this once Runday incorporates.

See also our Privacy Policy, Cookie Policy, and Terms of Service.