RunwiseOS Privacy Policy

1. Our role (who is responsible for your data)

RunwiseOS is a field-service management tool used by trades businesses. Our role depends on whose data it is:

• Your account data — when you sign up and use RunwiseOS, we are the data controller for information about you and your business.
• Your customers' data — when you add your own clients, sites, jobs, quotes and invoices, that information belongs to your business. For that data we act as a data processor, handling it on your instructions. Your business is the controller and is responsible for having a lawful basis to hold it.

2. Information we collect

Account & profile: name, email, phone number, job role, organisation details; login credentials (passwords stored hashed, never in plain text); profile photo if you add one.

Business data you enter: customer and site details (names, addresses, emails, phones); quotes, jobs, job sheets, invoices, purchase orders and references; site photos and notes; CIS/subcontractor and payment records.

Communications: in-app team chat messages; emails and documents sent from the Service.

Technical data: device/browser type, IP address, basic server log data, used to keep the Service secure and running.

We do not use advertising or analytics tracking, and we do not collect or store full payment card numbers — card payments are processed by our payment provider (see section 5).

Device permissions and data

With your permission, the RunwiseOS app may access the following on your device:

• Contacts — so you can quickly add customers from your phone's contacts. Any contact details you choose to import are stored in your RunwiseOS account.
• Calendar — to sync your job schedule with your device calendar. Related scheduling information is stored in your RunwiseOS account.
• Location — to show nearby job sites and centre maps. Your location is used on your device only and is not stored on our servers.

You can grant or revoke these permissions at any time in your device settings.

3. How we use your information

To provide, secure and maintain the Service; take and record payments and subscriptions; respond to support requests; keep the Service safe and prevent misuse; and meet legal and accounting obligations.

4. Our legal bases (UK GDPR)

Contract (to provide the Service); legitimate interests (to secure, maintain and run the Service and our business); legal obligation (tax, accounting and other legal duties); and consent (where we specifically ask for it — you can withdraw it any time).

5. Who we share data with

We do not sell your personal data or share it for advertising. We share data only with service providers who help us run RunwiseOS, under contract and only as needed: Stripe (payment processing), Supabase (secure database hosting and authentication), Resend (sending transactional emails on your behalf). We may also disclose data where required by law, or to protect our rights, users or the public.

6. International transfers

We host data with providers located in the UK and/or the European Economic Area (EEA). Some providers — for example Stripe, which processes payments — may process data outside the UK. Where that happens, we rely on appropriate safeguards, such as UK-approved Standard Contractual Clauses or an adequacy decision, to protect your data.

7. How long we keep it

We keep your personal data while your account is active. After you close your account, we delete or anonymise your personal data within 90 days, except for records we are legally required to keep — in particular invoicing, payment and CIS/tax records, which we retain for 6 years to meet UK tax and accounting obligations, after which they are deleted or anonymised.

8. How we protect your data

All data is encrypted in transit (HTTPS/TLS); access is restricted by role-based permissions and authentication; and we apply reasonable technical and organisational measures to guard against unauthorised access, loss or misuse.

9. Your rights

Under UK data protection law you can: access the data we hold about you; correct inaccurate data; ask us to delete your data; object to or restrict certain processing; request a portable copy; and withdraw consent where processing is based on consent. To exercise any of these, email support@runwiseos.com. If your request is about data your contractor entered about you as their customer, we may direct you to that business, as they control that data. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

10. Deleting your account and data

You can ask us to delete your account and personal data at any time, either through the in-app "Delete account" option or by emailing support@runwiseos.com. We action deletion requests promptly. Where records must be retained for legal reasons (see section 7), we restrict and anonymise them instead of deleting them immediately.

11. Children

RunwiseOS is a business tool intended for use by adults (18+). It is not directed at children, and we do not knowingly collect data from children.

12. Cookies and similar technologies

The web app uses only essential cookies and local storage needed to sign you in and keep the Service working. We do not use advertising or non-essential tracking cookies, so no cookie-consent banner is required.

13. Changes to this policy

We may update this policy from time to time. We'll post the new version here and update the "Last updated" date above. Significant changes will be notified through the Service.

14. Contact us

RunwiseOS Ltd (SC895421). Email: support@runwiseos.com