Privacy Policy
Effective
This policy explains what personal data runsonwhat collects when you use runsonwhat.com, why we collect it, who helps us process it, and what you can do about it. It covers you as a visitor or account holder.
The company information the site shows (which tools a company uses) is a separate topic, covered on Data & removal.
1. Who we are
runsonwhat is run by [Legal entity name], [Address] (“runsonwhat”, “we”, “us”). We are the controller of the personal data described here. You can reach us about anything in this policy at hello@runsonwhat.com.
2. What we collect, and why
Your account
Sign-in uses Google only, through our authentication provider Supabase. When you sign in, Google shares your name, email address, Google account id and, if you have one, a link to your profile picture. Supabase stores these with the time you signed up and last signed in. For security, Supabase also keeps short-lived logs of sign-in events, which include your IP address. We never see or store your Google password.
We use this to create your account, keep you signed in, unlock full company lists, and stop abuse of the service. Legal basis: performance of our contract with you (the Terms), GDPR Art. 6(1)(b), and our legitimate interest in keeping the service secure, Art. 6(1)(f).
Domains you look up
When you type a domain into Look up a site, our server scans that domain’s public records live. To do that, the domain name (not your identity) is sent to DNS resolvers and to public certificate-search services: crt.sh, CertSpotter, HackerTarget and RapidDNS. The result is cached in server memory for about 30 minutes so repeat lookups are instant, then discarded. Lookups are not linked to your account. Please enter company domains only, not personal information. Legal basis: providing the service you asked for, Art. 6(1)(b) and (f).
The waitlist
If you join a waitlist, your email address (and anything else you type into the form) is delivered to our inbox through the form service Web3Forms. We use it only to tell you when access opens. Legal basis: your consent, Art. 6(1)(a), which you can withdraw any time by emailing us.
Emails you send us
If you write to hello@runsonwhat.com, we keep your message and address so we can reply and keep a record of the request. Legal basis: our legitimate interest in answering you, Art. 6(1)(f).
Analytics
On the live site we use Google Analytics 4 (property G-G4RRXMT34F) to understand which pages are used. It records pages viewed, the referring site, approximate location (city or country), device and browser type, and sets the cookies listed below. Google states that GA4 does not log or store IP addresses. We don’t use Analytics data for advertising. The visitor count shown on the homepage is an aggregate number from Analytics with no personal data. Analytics loads only after you agree in the cookie banner. Legal basis: your consent, Art. 6(1)(a), which you can withdraw at any time with “Cookie settings” in the footer, see Cookies.
Server logs and logos
Our host, Vercel, processes technical request data (IP address, browser user agent, the URL requested, time) to deliver the site and protect it from abuse, and keeps these logs for a short period. Tool logos on the site are loaded from Google’s favicon service, so your browser sends a request to Google when logos are shown. Legal basis: legitimate interest in running a working, secure site, Art. 6(1)(f).
What we don’t do
- We don’t sell your personal data, and we don’t share it for cross-context behavioral advertising.
- We don’t run ad trackers or retargeting pixels.
- We don’t use your data for automated decisions that have legal or similarly significant effects on you.
4. Who processes your data for us
We use these service providers. Each one processes data only to provide its service to us.
- Vercel hosts the website and keeps request logs.
- Supabase runs sign-in and stores account records.
- Google provides Google sign-in, Google Analytics and the favicon service used for logos.
- Web3Forms delivers waitlist sign-ups to our inbox.
- Namecheap (Private Email) hosts our mailbox, hello@runsonwhat.com.
- Railway hosts our company database and crawler. It doesn’t hold your account data.
To build the company data we also use public data services that never receive personal data about you, such as Merklemap (certificate data) and the certificate-search services named above. See Data & removal for the full list.
We may also disclose data when the law requires it, to protect our rights or users’ safety, or to a successor if runsonwhat is sold or merged, in which case this policy would still apply to your data.
5. International transfers
Our providers are based in, or process data in, the United States and other countries outside the UK and European Economic Area. Where data leaves the UK or EEA, we rely on the safeguards in those providers’ data processing terms, such as the European Commission’s Standard Contractual Clauses (and the UK addendum) or the EU–US Data Privacy Framework where a provider is certified. You can ask us for more detail.
6. How long we keep it
- Account: while your account exists. When you ask us to delete it, we delete it within 30 days.
- Lookups: about 30 minutes in server memory, less if the server restarts.
- Waitlist: until access opens and we’ve told you, or until you ask us to remove you.
- Emails to us: as long as we need to handle your request and keep a record of it.
- Analytics: event-level data for the retention period set in Google Analytics, at most 14 months.
- Server and sign-in logs: for the short periods our providers use for security and debugging.
7. Your rights
Depending on where you live, you have some or all of these rights over your personal data:
- to access it and get a copy, in a portable format where that applies;
- to correct it if it’s wrong;
- to have it deleted;
- to restrict how we use it, or object to uses based on legitimate interest (including analytics);
- to withdraw consent you gave, such as for the waitlist, without affecting what happened before;
- if you’re in California: to know what we collect and why, to delete and correct it, to opt out of sale or sharing (we do neither), and not to be treated differently for using these rights.
To use any of them, email hello@runsonwhat.com from the address on your account if you have one, so we can confirm it’s you. We answer within one month (45 days under California law), and tell you if we need longer. You may also complain to your local data protection authority, for example the one in your EU country or the UK’s ICO, though we’d like the chance to sort it out first.
8. Deleting your account
Email hello@runsonwhat.com from the address you sign in with and ask us to delete your account. We remove your account record from Supabase within 30 days and confirm by email. Signing out alone doesn’t delete anything.
You can also remove runsonwhat’s access from your Google Account under third-party connections. That stops future sign-ins but doesn’t delete the account we hold, so email us as well.
9. Children
runsonwhat is a business research tool and isn’t meant for anyone under 16. We don’t knowingly collect personal data from children. If you think a child has signed up, email us and we’ll delete the account.
10. Security
The site is served only over HTTPS, account data sits with an established authentication provider, and access to our systems is limited to the people who run runsonwhat. No system is perfectly secure, and we don’t hold any security certifications. If we learn of a breach that affects your personal data, we’ll tell you and the authorities as the law requires.
11. Changes to this policy
If we change this policy, we’ll update the effective date above. For significant changes we’ll also put a notice on the site, and email account holders before the change takes effect.
12. Contact
Questions or requests: hello@runsonwhat.com. Postal address: [Legal entity name], [Address].