Privacy policy
Last updated: 12 April 2026
1. Data controller
The controller of your personal data is Runican. You can contact us through the contact form on this website for anything related to privacy.
2. Data we collect
- Registration data: first name, surname, email address and country when you create an account.
- Usage data: contracts created, templates viewed, actions taken on the platform.
- Technical data: IP address, browser type, pages visited and session duration.
- Payment data: handled directly by Stripe; Runican does not store card details.
- Handwritten signature and identity document: only when a contract is signed manually. They are kept alongside the contract as evidence of acceptance.
Automatic metadata removal (GDPR data minimisation): identity documents and handwritten signatures are processed automatically before storage to strip technical metadata (GPS location, device model, exact capture timestamps). Only the visible image is kept.
3. Purposes and legal basis
- Providing the service (performance of a contract): managing your account, processing payments and giving you access to the features.
- Improving the service (legitimate interest): anonymous usage analysis to improve the user experience.
- Communications (consent): sending news or updates if you expressly authorise it.
- Legal obligations (compliance): retention of billing data as required by tax law.
4. Data retention
We keep your data for as long as your account is active. If you ask us to delete it, we handle the request within the one-month period set by the GDPR, and we erase your data except for billing records, which tax law requires us to keep for five years.
How it works, plainly: you can delete your account yourself from Account → Security. Before you confirm we show you what will be deleted and what will not, with your real numbers. Deletion is not immediate: it is scheduled 30 days ahead, and during that period you can cancel it with a single click by signing back in. Once the period is over it runs on its own and is final.
There is one case we cannot delete automatically: if you are the owner of an organisation, you must first transfer it or delete it, because deleting it would affect other people’s data. The application tells you so when you try. If you would rather not use the button, or yours is that case, write to us through the contact form and we will do it within the same period.
5. Recipients
Your data is shared only with service providers necessary for Runican to work: Supabase (database and authentication, Ireland), Vercel (hosting; served from Europe and executed in the United States — standard contractual clauses), Stripe (payments, USA — standard contractual clauses), PostHog (product analytics, United States — standard contractual clauses), Sentry (error diagnostics, Germany) and Resend (email delivery, Ireland).
Product analytics runs without persistent identifiers: it writes no cookies and no local storage on your device, and it cannot recognise you across visits if you are not signed in.
6. Your rights
You can exercise the following rights through the contact form on this website:
- Access: obtain a copy of your personal data.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion of your account and data.
- Portability: receive your data in a structured format.
- Objection: object to processing based on legitimate interest.
You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
7. Cookies
We only use technical cookies that are necessary for the service to work (session and language). Analytics uses no cookies. The full inventory is at runican.com/legal/cookies. You can configure cookies from your browser.