Data Processing Agreement

The Privacy Policy explains what Runday does with personal information. The Terms set out what you agree to. This document is the missing third piece: what we owe you about the personal information you put into Runday about your clients.

When your client's name and phone number go into Runday, you remain the one responsible for that person. We hold it for you. Canadian privacy law expects that relationship to be written down rather than assumed, and this is where it is written down.

• You — the business using Runday. You decide what client information is collected and why. You are accountable to your own clients for it.
• Runday — the service provider. We process that information only to provide the service to you, and only as this agreement allows.

For information you give us about yourself and your staff — account details, billing, staff records — we are responsible directly, and the Privacy Policy governs it.

Only what the product needs to work: client names and contact details, appointment and walk-in records, services performed, sale amounts, tips, and the commission calculated from them, plus any notes your staff choose to write.

We process it to run the platform for you, to support you when you ask, to keep the service secure, and to meet legal obligations. Nothing else. Specifically, we do not use your clients' information for our own marketing, we do not sell it, and we do not use it to train models.

• Process your clients' information only to provide the service, or where the law compels us
• Keep it confidential, and limit internal access to people who need it to do their job
• Maintain the safeguards described in section 5, and not materially weaken them while you are a customer
• Tell you about a confidentiality incident affecting your data, per section 8
• Help you respond when one of your clients exercises a right, per section 7
• Return or delete the data when you leave, per section 9

These are the measures actually in place today, not aspirations:

• Encrypted in transit over HTTPS/TLS, and at rest by our hosting providers
• Row-level security in the database, so your records are unreachable from another business's account as a property of the data layer rather than a UI restriction
• Passwords hashed by our authentication provider; never stored readably
• Staff logins you create must be changed by that staff member on first use
• Rate limiting on public endpoints, and file-type validation on uploads
• Not yet in place: mandatory multi-factor authentication, formal access logging, and independent security testing.

Runday uses the third parties below. Each is bound to protect the information and to use it only to provide their service to us. A new one is added to this list before it starts handling your clients' information, not afterwards, and the same applies when a processor already on this list begins handling a category it did not before.

We will tell you before a new subprocessor starts handling your clients' information, and you may object. If you object and we cannot offer a reasonable alternative, you can export everything and close your account rather than be moved onto a processor you did not accept.

We have deliberately not fixed a number of days' advance notice yet. Runday is free and still adding integrations, and a fixed window we would miss repeatedly is worth less to you than one we can keep. A specific period, with the usual exception for replacing a processor in an emergency, will be set when Runday moves to paid accounts. The commitment to tell you, and your right to object, apply now regardless.

Your clients' information is now mostly stored in Canada. Some still leaves Canada — the application server is in France, and providers including Stripe, Resend, and Google Analytics operate in the United States. Section 6 gives the detail, and the Privacy Policy explains what that means. You should know this before you decide Runday is appropriate for your clients.

Law 25 requires a privacy impact assessment before personal information is communicated outside Québec. None has been completed for the transfers that remain. This affects you as well as us, since you are the one accountable to your clients.

When one of your clients asks to see, correct, delete, or receive a copy of their information, that request goes to you — they are your client. We will give you what you need to answer it, at no charge and within a reasonable time. If a request reaches us directly, we will point them to you rather than act on it ourselves.

If your clients' information is accessed, disclosed, or lost without authorisation, we will tell you within 72 hours of becoming aware, with what we know: what happened, what data was involved, what we are doing, and what we suggest you do.

If we do not have the full picture by then, you get what we have on time and the rest as it comes. A complete report that arrives late is worse for you than an incomplete one that arrives while you can still act on it.

We will tell you even where we judge the risk to be low, because that assessment is yours to make for your own clients, not ours to make for you.

You can export everything at any time from Settings, as a single file, at no cost and without asking us. Deleting your account removes the data from our active systems immediately, except anything we must keep by law. Backups age out on their own cycle within 30 days.

Because the export is self-serve, there is no window in which you depend on us to hand your data back. Take it before you delete the account and nothing is lost.

This agreement applies for as long as you use Runday, and its confidentiality and deletion obligations continue afterwards until they have been carried out. Where it conflicts with the Terms of Service on the handling of your clients' personal information, this document governs.

To be written: United States — state-level processor terms and service provider obligations.

• Runday, operated from Québec, Canada
• Privacy Officer (a founder of Runday) — [email protected]
• Runday is run by its two founders and is not yet a registered business. A legal name and business address will be added here once registration is done.

See also our Privacy Policy, Confidentiality Policy, Cookie Policy, and Terms of Service.