Privacy Policy

Runday ("we", "us", "our") provides a business management platform used by service businesses such as barbershops and salons ("Business Users") to manage bookings, checkout, staff commissions, and client records.

It applies to three groups of people whose personal information we may process:

• Business Users: the businesses and staff who sign up for Runday directly.
• End-Clients: the customers of those businesses, whose information a Business User enters into Runday while running their business.
• Partners: people and businesses who apply to, or take part in, the Runday Partners programme.

We act as a service provider for End-Client data. The Business User controls that relationship and is responsible for obtaining any consent needed from their own clients. We act as the organisation responsible for the information Business Users give us directly, such as account and billing details.

From Business Users:

• Name, email address, phone number
• Business name, address, and business type
• Billing information, processed by Stripe (we never store card numbers ourselves)
• Staff records, including commission rates and pay-period earnings, the hourly rate and the gross pay computed from approved hours when a person is paid by the hour, the hire date, hours worked when the owner uses the time clock (with every correction and its reason), and time off with its dates and an optional note. A note on an absence can touch on health, so it is never required. Unless the business or the person turns them off, Runday emails the owner and the location's manager each time off request or declared absence (name, dates, note), and the team member the decision on their request
• Usage data: login activity, feature usage, device and browser information
• For each device signed in to your account, its browser and the approximate city it is used from (from our network provider, never the IP address), shown only to you in your list of connected devices. A device unused for 30 days is signed out, and this goes with it
• To warn you of a sign-in from a new device, a fingerprint of each device already used (computed from the browser type, the kind of device and the city, unreadable as stored, never the IP address) and when it was last used. A sign-in from a device that is unknown or unused for 30 days sends you an email (the device, the approximate city, the time). Deleted 90 days after the device was last used, and with the account
• Problems you report from inside the app: your message, the page you sent it from, your email address and role, and your browser type, sent to Runday's founders by email
• If you choose to tell us, who told you about Runday
• If you opened your shop through a referral link, which shop or Runday partner sent you (remembered by the runday_ref cookie until your shop is created), and the date and amount of your first payment, so the referral can be honoured; if your shop refers others, the names of the shops that came through its link

From Partners, and people who apply to be one:

• Name, email address, language, what you are (a supplier, a school…), and, if you give them, your organisation and a link to your site or social account
• What you wrote about how you would talk about Runday
• Once accepted: your sign-in, the names of the shops that came through your link and where each stands, what you earned and were paid, the Interac email and name your payments go to, and your GST and QST numbers if you give them
• If you choose to be paid through Stripe: your Stripe account number and whether it can receive payments. Your identity and bank details are collected by Stripe itself, under its own agreement with you, and Runday never sees them. Stripe receives your email address and the amount of each payment from us

About End-Clients, entered by Business Users:

• Name and contact details (phone, email)
• Appointment history, services received, and purchase history
• Any notes a Business User chooses to record
• Notes on a client's haircut and, only with the client's agreement, a photo of it, stored privately in Canada and never shown publicly
• If the Business User asks for a deposit or a card on file at online booking: the client enters their card on Stripe's page, for the Business User's own Stripe account. Runday passes Stripe the client's name, email and phone, the service and the amount, and keeps only what happened to the deposit or the card (paid, refunded, charged). Runday never sees or keeps the card number

We do not collect End-Client information directly. It reaches us through the Business User, who is responsible for the accuracy and lawfulness of what they enter.

• Operating the platform: bookings, checkout, commission calculation, client records
• Emailing End-Clients about their own appointments (a confirmation, a change or cancellation notice, a reminder), in the name of a Business User that has turned these emails on, each with a link to stop them that takes effect at once
• Authentication and customer support
• Improving the product, using aggregated or de-identified data where possible
• Billing and payment processing
• Running referrals: giving a referring shop its free month, and reviewing partner applications, showing partners their referrals and paying them
• Legal compliance and fraud prevention
• Marketing to Business Users only, with consent, as described in section 8

We do not sell personal information, and we do not use End-Client data for our own marketing.

We collect, use, and disclose personal information with knowledge and consent, except where the law permits or requires otherwise. Consent may be express, such as when a Business User signs up and accepts this policy, or implied, such as a client giving their phone number so a shop can remind them about an appointment.

Business Users are responsible for making sure their own clients know their information is stored in a system like Runday.

• Privacy Officer. Olivier Morin holds the highest authority over the protection of personal information and acts as Privacy Officer, reachable at [email protected]. Requests sent to that address reach them directly.
• Privacy impact assessments. Law 25 requires an assessment before personal information is communicated outside Québec. Our database is in Montreal, inside Québec, but our application server is in Toronto and several providers we rely on are outside Canada entirely (see section 6), so this still applies to us. We completed that assessment, and its conclusions were settled on October 3, 2026: what leaves Québec is adequately protected, given how little is sent and how it is protected. Each shop using Runday adopts a version prepared for it, published as the privacy assessment. It has not yet been reviewed by a lawyer; it will be before Runday opens to shops.
• Consent standard. Consent must be clear, free, and informed, and given for specific purposes. We do not bundle it with unrelated terms.
• Automated decision-making. Runday does not make automated decisions producing legal or similarly significant effects. If that changes, we will say so and offer a route to human review.
• Portability. Québec residents may request their computerised personal information in a structured, commonly used format.
• Breach notification. Any incident presenting a risk of serious injury will be reported to the Commission d'accès à l'information and to affected individuals, within the timelines Law 25 sets.

Runday's database is hosted in Canada. Some information still leaves Canada through other providers Runday relies on. Being clear about this matters more than it being convenient:

• Our database, which holds account, client, appointment and commission records, is hosted in Montreal, Canada.
• The application server for rundays.ca is hosted in Toronto, Canada. That is inside Canada but outside Québec, which matters for Law 25 even though it does not for PIPEDA.
• Payment processing is handled by Stripe, website analytics by a third-party analytics provider, email by Resend, and application error reports by Sentry, all of which process data outside Canada. The full list is in the Data Processing Agreement.

While information is outside Canada it is subject to the laws of the country it sits in, including lawful access requests by foreign authorities. We remain accountable for it under PIPEDA regardless of where it is held.

Disclosing this transfer is itself a PIPEDA requirement, and this section is that disclosure. Law 25 additionally requires a privacy impact assessment before personal information leaves Québec. Ours is done (see section 5), and each shop adopts the version published as the privacy assessment, which lists every destination above and what it receives.

Security measures currently in place:

• All traffic encrypted in transit over HTTPS/TLS; data encrypted at rest by our hosting providers
• Database-level row security, so a Business User's records are technically unreachable from another business's account rather than merely hidden in the interface
• Passwords are hashed by our authentication provider and never stored in readable form
• Staff accounts created by an owner must set their own password before first use
• Rate limiting on public endpoints, and file-type validation on uploads

No system is perfectly secure, and we do not claim otherwise.

We keep personal information only as long as needed for the purposes it was collected for, or as the law requires, for example tax and accounting records. Business Users may request deletion of their account and its data, subject to those obligations.

In practice:

• While your account is open: we keep your business records so you can use your own history: past appointments, sales and commission records.
• After you delete your account: your data is removed from our active systems immediately, including your appointment, sales and commission records. Backups age out on their own cycle within 30 days. Your business records are yours, and Canadian tax law requires you to keep them for six years, so export them before you delete your account. We cannot recover them afterwards.
• Waitlist signups: kept until you ask us to remove you, or until we stop running the waitlist.
• Problems you report from inside the app: kept one year, then deleted, or sooner if you delete your account.
• Referrals: who sent your shop is deleted with your account unless a reward was already earned from your first payment; then the reward stays, without your shop's name.
• Partner applications and partners: a declined application is deleted after 90 days. A partner who leaves keeps their sign-in to see their payments; what they wrote in their application is deleted, and their payment records are kept six years after the end of the year each payment was made, as tax law requires. After that, their whole record is deleted automatically: payments, referrals, link and sign-in (unless that sign-in is also a shop's or a team member's).
• Records we must keep by law: our own accounting records, meaning what you paid us, are retained for the period Canadian tax law requires, currently six years. This does not include your salon's own sales: Runday never processes your clients' payments, so those are your records to keep, not ours.

Where we send marketing email or SMS to Business Users, we will:

• Obtain express consent first, where required
• Identify ourselves clearly in every message
• Include a working unsubscribe link
• Action unsubscribe requests within 10 business days

This does not apply to End-Clients. Booking-related messages reach them from the business they visit, not from Runday.

Subject to legal exceptions, you may:

• Access the personal information we hold about you
• Ask us to correct anything inaccurate
• Withdraw consent, subject to legal and contractual limits
• Ask us to delete your information
• Request a portable copy, if you are in Québec
• Complain to the Office of the Privacy Commissioner of Canada, or if you are in Québec, the Commission d'accès à l'information

If you are an End-Client (a customer of a business that uses Runday), please contact that business first. They control your record. We will help them respond.

Otherwise, write to [email protected].

If personal information is breached in a way that creates a real risk of significant harm, we will notify the affected individuals and the appropriate regulator, the Office of the Privacy Commissioner of Canada, and the Commission d'accès à l'information for Québec residents, without unreasonable delay.

To be written: EU and UK, covering GDPR legal bases, data subject rights, international transfer mechanism.

Until that content exists, the Canadian terms above are the ones we operate under, and nothing here reduces rights you may have under your local law.

• Runday, operated from Québec, Canada
• Privacy Officer and general privacy enquiries: [email protected]
• Runday is operated by Olivier Morin, an individual based in Québec, Canada, so there is no registered entity name or business address to give you. Email reaches that address directly and we answer within 30 days.

See also our Cookie Policy, Confidentiality Policy, and Terms of Service.