Privacy Policy

RunOps Inc, a Delaware corporation ("RunOps," "we," "us," or "our"), provides an inventory intelligence platform for specialty retail businesses. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to the RunOps web application at platform.runops.ai, the RunOps mobile application for iOS (the "mobile app"), the mobile API at api.runops.ai, the runops.ai marketing site, and any related services we operate.

If you have questions about this policy, contact us at [email protected].

1. Information We Collect

1.1 Account Information

When you sign in to RunOps, we collect your name, email address, profile picture, and Google account identifier through Google OAuth. If you sign in with an email and password instead, we collect your name and email address, and we store only a salted one-way hash of your password (bcrypt) — never the password itself. We use this information to create and authenticate your account.

RunOps accounts become active only after approval: you may request access, but an administrator must approve the request before you can sign in. If you use RunOps as an employee of a RunOps customer, your employer's administrator provisions your account and assigns your role and store access.

1.2 Organization and Business Information

When you set up your organization in RunOps, you provide information about your business, including your company name, store locations, store contact information, and team members you invite to the account. You also configure brand representative contact details (name, email, phone) for the vendors you work with.

1.3 Point of Sale and Inventory Data

If you connect a point of sale (POS) system to RunOps, we collect inventory data from that system on your behalf. This includes product information (SKUs, descriptions, sizes, prices), stock levels, sales transactions, purchase orders, and related operational data. The data we collect is determined by the credentials and configuration you provide.

1.4 Google Account Data (Gmail Send-As)

If you choose to connect your Google account for sending fill orders to your brand representatives, we request the https://www.googleapis.com/auth/gmail.send OAuth scope. This is the most narrow Gmail scope available and only allows RunOps to send email on your behalf. We store the OAuth refresh token Google provides so we can send email when you click "Send Orders" inside the RunOps application. Refresh tokens are encrypted at rest using AES-128 (Fernet) symmetric encryption.

RunOps does not read, list, search, modify, or delete any messages in your Gmail inbox. RunOps does not access drafts, labels, settings, contacts, or any other Gmail data. The gmail.send scope is used exclusively to send fill order emails that you explicitly approve through the RunOps application.

1.5 Usage and Log Data

We automatically collect technical information when you use RunOps, including IP address, browser type, device information, request timestamps, and application logs. This data is used to operate, secure, and improve the service. We may aggregate, anonymize, or de-identify usage and log data so that it no longer identifies you or any individual, and we may use and retain such data for any lawful business purpose, including analytics, benchmarking, and improving the service.

1.6 Time Clock and Location Data (Geofence Verification)

If your employer uses RunOps scheduling and time-clock features, each clock-in and clock-out event records the time, the store, the linked shift (if any), and — for audit purposes — the IP address and browser or app identifier of the device used.

Your employer can additionally enable location-verified clock-in for a store. When it is enabled and you clock in or out in the web application or the iOS app, you are asked for permission to share your location; if you grant it, a single location reading (latitude, longitude, and accuracy) is captured at that moment, compared against the store's location to verify presence, and stored with the time-clock event. We use this reading solely for clock-in verification — we do not track your location continuously and never collect location outside of a clock-in or clock-out you initiate. If you decline or your device cannot provide a reading, the event is simply flagged for your employer under a lenient store policy; under a strict store policy the clock-in may be rejected. See Section 3.3 for how the iOS app requests location.

1.7 The runops.ai Marketing Site

This section describes only the public marketing site at runops.ai — the pages you are reading now. It does not apply to the RunOps application, which is covered elsewhere in this policy.

We do not set cookies on this site, and we store nothing on your device. No cookies, no local storage, no session storage. That is a deliberate design choice, and it is why you are not asked to dismiss a cookie banner here. It also means we cannot recognize you when you return, and cannot follow you from one page of this site to the next — each page you open is counted as a separate, anonymous visit.

Product analytics (PostHog). So that we can tell which pages and which parts of them are useful, we record page views and clicks on links and buttons. Each event carries the page address (including any campaign parameters in the link you arrived through), the page that referred you, the visible text and position of what you clicked, your browser and operating system, screen size, and your IP address — which PostHog uses to derive an approximate city-level location and which we do not use to identify you. No profile is created for you, because we never link these events to a person. There is no session recording: we do not capture your screen, your mouse movements or your keystrokes.

Error diagnostics (Sentry). If a script on a page fails, a diagnostic report is sent so we can fix it. It contains the error and its stack trace, the page path with any query parameters removed, and your browser and operating system. Cookies, headers and page content are not included.

Your choices. If your browser sends a Do Not Track signal, analytics are disabled automatically — you do not have to do anything else. Blocking these two providers with an ad blocker or a privacy extension also works and does not affect the site.

What this site does not do. There are no advertising or marketing tags on runops.ai, no data brokers, and no cross-site tracking. Nothing collected here is used for advertising, and nothing collected here is sold or shared for behavioural advertising as defined by the CCPA/CPRA.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the RunOps platform
• Authenticate you and secure your account
• Process inventory data from your connected POS systems
• Generate AI-powered inventory recommendations, demand forecasts, and fill order suggestions
• Send fill order emails to brand representatives you have configured, when you explicitly request it through the application
• Provide employee scheduling and time-clock features — shifts, clock in/out, shift trades, and time-off requests — on behalf of your employer
• Verify presence at the store at clock-in/out, when your employer has enabled location-verified time clock for a store (see Section 1.6)
• Send transactional email about your account (welcome messages, access requests, security notifications)
• Respond to your support requests and feedback
• Detect, prevent, and respond to fraud, abuse, or technical issues
• Comply with legal obligations

3. The RunOps Mobile App (iOS)

The RunOps mobile app gives store teams access to the same tenant data as the web application — dashboards, inventory, schedules, and alerts. This section describes the data practices specific to the mobile app.

3.1 Signing In and Credentials on Your Device

You sign in to the mobile app with your organization-provisioned RunOps account, using either your email and password or Google Sign-In. After you sign in, the app stores its session tokens in the iOS Keychain — Apple's encrypted credential storage — never in plain files or app preferences. Signing out removes these tokens from the device. Mobile sessions expire automatically and require you to sign in again.

Sign-in security log. To protect your account, we record each sign-in attempt to the mobile app — whether it succeeds or fails. Each entry contains the account identifier used (your email address, plus your user ID on success), the IP address the request came from, an app installation identifier (described below), the app or browser user-agent, the date and time, and whether the attempt succeeded. We use this solely to secure accounts and investigate suspicious access — for example, to establish when and from where an account was used, or to detect repeated failed attempts against an account. It is never used for analytics, advertising, or tracking, and it is not shared with your employer as workplace data. Your password is never recorded. Entries are deleted automatically after 90 days (Section 6).

The app installation identifier is a random value the app generates the first time it runs and keeps in the iOS Keychain. It is not your device's hardware identifier and not the advertising identifier: it identifies this installation of the app only, so that sign-ins from different devices can be told apart in the security log. It is reset if you delete and reinstall the app.

3.2 Workplace Data Processed for Your Employer

If your employer uses RunOps scheduling and time-clock features, the mobile app processes workplace data on your employer's behalf: your shift schedule, clock-in and clock-out timestamps (with the audit metadata described in Section 1.6), shift trade postings, and time-off requests. Your employer controls this data and how it is used; RunOps processes it to provide the service. Questions about workplace data should generally be directed to your employer, though you can always contact us as described below.

3.3 Location at Clock-In

If your employer has enabled location-verified clock-in for a store (Section 1.6), the app asks for permission to use your location only at the moment you tap Clock In, takes a single reading to confirm you are at the store, and sends it with the clock-in event. iOS shows the system permission prompt the first time; you can allow or deny, and change it later in iOS Settings. The app never accesses your location in the background and never tracks your movements. If you deny permission or your store does not require location, clock-in still works (the reading is simply omitted).

3.4 Push Notifications

The app can send push notifications to alert you to new actionable items in your Inbox (for example, an inventory anomaly at your store). iOS asks for your permission first; you can turn notifications off inside the app (Profile) or in iOS Settings at any time. To deliver them, we register your device's Apple Push Notification service (APNs) token with our servers and store it only to send you notifications; it is not used for tracking and is removed when you sign out or turn notifications off.

3.5 Crash and Error Reports

So that we can find and fix problems in the app, RunOps sends automatic crash and error diagnostics to Sentry (Section 5.2). A report is created only when something goes wrong. It contains the error and its stack trace, the screen you were on, the app version and build, your device model and iOS version, and your internal RunOps account identifier — the last so we can tell whether a failure affected one person or everyone. Reports are scrubbed on your device before they are sent: credentials, session tokens, authorization headers, request bodies and query strings are removed, and you are identified by that internal identifier rather than by your name or email address. This data is used only for diagnostics; it is never used for advertising and never to track you across other apps or websites. You can turn crash reports off at any time in the app under Profile.

3.6 Product Analytics

So that we can see which features are actually used and what needs improving, the app records a small, fixed set of product events to PostHog and to Amplitude (Section 5.2) — for example that you signed in, clocked in, submitted a time-off request, opened your Inbox or opened a notification. Each event carries your internal RunOps account identifier, the app version and the screen involved. The app also records which screens you open, by the screen's name (for example Schedule or Approvals) and never by the record shown on it: not which store, shift, product or request. It does not record what you type: not your time-off reason, not search terms, not message content. There is no session recording anywhere, and nothing captures your taps, your keystrokes or the network requests the app makes. Beyond the named events, Amplitude additionally records when an app session begins and ends and when you bring the app to the foreground or send it to the background — timings only, with no detail of what you did in between. The information your employer sees is aggregate product usage, not a log of your individual working day. You can turn product analytics off at any time in the app under Profile, and doing so also stops any events queued on your device.

3.7 What the Mobile App Does Not Do

• The app does not access your camera, microphone, contacts, photos, or health data. Location is used only at clock-in as described in Section 3.3.
• The only device identifier the app uses is the random installation identifier it generates itself for the sign-in security log (Section 3.1). It does not read your device's hardware or advertising identifier.
• The app communicates with RunOps servers (api.runops.ai) and, for notifications, Apple's APNs. It also connects to Sentry, to send a crash or error report (Section 3.5), and to PostHog and Amplitude, to send a product event (Section 3.6). The only other third party it connects to is Google, and only if you choose Google Sign-In. All connections use TLS encryption.

3.8 Data Collected by the Mobile App

The mobile app collects the same categories described in Section 1 — account information (name, email address, account identifiers) and usage/log data (IP address, request timestamps, application logs) — linked to your account and used solely to provide and secure the service. In addition, it records a sign-in security log entry each time you sign in or a sign-in fails, containing your account identifier, IP address, app installation identifier, user-agent and timestamp (Section 3.1). When you enable them it also collects a one-time location reading at clock-in (Section 3.3) and your device's push notification token (Section 3.4). Unless you turn them off, it sends crash and error diagnostics containing your device model, iOS version, app version and the stack trace of the failure (Section 3.5), and product events recording which features you used (Section 3.6). It collects nothing else from your device.

4. Google API Services User Data Policy

Specifically, RunOps:

• Uses data accessed through Google APIs only to provide the user-facing fill order sending feature inside the RunOps application
• Does not transfer Google user data to third parties except as necessary to provide the service, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users
• Does not use Google user data for advertising, including retargeting, personalized advertising, or interest-based advertising
• Does not allow humans to read Google user data unless we have your explicit consent for specific messages, it is necessary for security purposes such as investigating abuse, to comply with applicable law, or for internal operations after the data has been aggregated and anonymized

5. How We Share Information

We do not sell your personal information. We share information only in the following circumstances:

5.1 Brand Representatives You Configure

When you click "Send Orders" in RunOps, we send the fill order emails (including any spreadsheet attachments you have approved) to the brand representative email addresses you have entered into the application. You control who receives these emails by configuring the brand representative list. You are responsible for ensuring you have appropriate authorization to communicate with the recipients you configure.

5.2 Service Providers

We use a small number of third-party service providers to operate RunOps. They process information only on our behalf and are bound by contractual confidentiality obligations:

• Google LLC · OAuth authentication and Gmail API for sending fill orders
• Railway · Application hosting and PostgreSQL database hosting
• Resend · Transactional email delivery (welcome emails, access requests, account notifications)
• DeepSeek · Large language model API used for inventory recommendation reasoning. Inventory data is sent to DeepSeek for analysis when you run a Wizdom recommendation method. Personally identifiable information is not sent.
• PostHog · Product analytics for the mobile app and for the runops.ai marketing site. From the mobile app it receives the named product events described in Section 3.6 — which feature was used or which screen was opened, when, the app version and your internal account identifier. From the marketing site it receives the anonymous page views and clicks described in Section 1.7, which are not linked to any account. It does not receive text you enter, and we do not enable session recording on either surface. This data is used to improve the product; it is never used for advertising and never to track you across other apps or websites. PostHog processes this data in the United States.
• Amplitude · Product analytics for the mobile app. It receives the same named product events described in Section 3.6 — which feature was used or which screen was opened, when, the app version and your internal account identifier — together with session start/end and app foreground/background timings. It does not receive text you enter, and session replay is not enabled. The app is configured not to send your device's advertising identifier, and not to send your IP address for analytics purposes. This data is used to improve the product; it is never used for advertising and never to track you across other apps or websites. Amplitude processes this data in the United States.
• Sentry · Error and performance monitoring for our API, for the mobile app and for the runops.ai marketing site. Diagnostic reports (error type, stack trace, screen or request path, timing, app version and — for the mobile app — device model and iOS version) are sent when something fails, so we can find and fix it. Credentials, session tokens, cookies, request bodies and query strings are stripped before the report leaves your device, your browser or our servers, and this data is not used for analytics or advertising. Sentry processes this data in the United States.

5.3 Legal Requirements

We may disclose information if required by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of RunOps, our users, or the public.

5.4 Business Transfers

If RunOps is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control.

6. Data Retention

We retain different types of information for different periods:

• Account information · retained while your account is active and for a reasonable period after deletion to comply with legal obligations
• Business and inventory data · retained according to the retention policy you configure for your tenant (defaults: 365 days for inventory statistics and audit logs, 90 days for system logs)
• Google OAuth refresh tokens · retained until you disconnect your Google account in RunOps, delete your account, or revoke RunOps's access from your Google account settings
• Mobile session tokens · stored in your device's Keychain until you sign out of the mobile app or the session expires; server-side sessions are removed on sign-out or expiry
• Push notification device token · retained only while notifications are enabled; removed when you sign out, turn notifications off, or Apple reports the token as no longer valid
• Sign-in security log · each mobile sign-in attempt (account identifier, IP address, app installation identifier, user-agent, timestamp, outcome — see Section 3.1) is retained for 90 days and then deleted automatically
• Product analytics events · product events sent to PostHog and Amplitude from the mobile app (Section 3.6) and anonymous page views and clicks sent from the marketing site (Section 1.7) are retained for 12 months and then deleted automatically
• Crash and error reports · diagnostic reports sent to Sentry from the mobile app (Section 3.5), from our API, and from the marketing site (Section 1.7) are retained for 90 days and then deleted automatically
• Application logs · retained for up to 90 days for operational and security purposes

You can request deletion of your account and all associated data at any time by contacting us at [email protected]. We will delete your data within 30 days of receiving a verified request, except where retention is required for legal compliance.

7. Data Security

We implement reasonable technical and organizational measures to protect your information, including:

• Encryption in transit using TLS 1.2 or higher for all connections to RunOps
• Encryption at rest for sensitive credentials (Google OAuth refresh tokens are encrypted using Fernet symmetric encryption with a key stored in environment variables, not in the database)
• Logical tenant isolation enforced at the application and database layers, so each customer's data is partitioned from every other customer's data
• Role-based access control for users within each tenant
• Audit logging of state-changing operations
• Regular review of dependencies for known vulnerabilities

No security measure is perfect. If you become aware of a security issue affecting RunOps, please contact us at [email protected].

8. Your Rights and Choices

8.1 Revoking Google Access

You can revoke RunOps's access to your Google account at any time by visiting myaccount.google.com/permissions and removing RunOps from the list of connected apps. You can also disconnect your Google account from within the RunOps application under Settings. Once revoked, RunOps will no longer be able to send email on your behalf, and your stored refresh token will become invalid.

8.2 Access, Correction, and Deletion

You may request access to the information we hold about you, request corrections, or request deletion of your account and associated data. To make a request, contact us at [email protected]. We will respond within a reasonable time and may need to verify your identity before acting on your request. Account deletion requests are honored within 30 days, as described in Section 6.

8.3 Employee Accounts

If your account was provisioned by your employer, your employer administers it — including deactivating it when you leave. You may still contact us directly with any privacy request; where your employer controls the data, we will coordinate with them or refer your request to them, and we will tell you if we do.

8.4 Data Portability

You can export your inventory data, order history, and other tenant data from the RunOps application at any time.

9. International Data Transfers

RunOps and its service providers are located in the United States. If you access RunOps from outside the United States, your information will be transferred to and processed in the United States. By using RunOps, you consent to this transfer.

10. Children's Privacy

RunOps is a business-to-business product and is not directed to children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the RunOps application before the changes take effect. The "Effective" date at the top of this page indicates when the latest version became effective. Your continued use of RunOps after the effective date constitutes acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your information, contact us at:

RunOps Inc
1632 Lost Creek Dr
Columbia, SC 29212
United States
Phone: (803) 397-3612
Email: [email protected]