Privacy Policy

Who is responsible

The controller for the processing this policy describes is:

Data protection officer: datenschutz@ac-group.ai.

The full provider details are in the Impressum.

What this policy covers

This website (gorunner.io), the docs (docs.gorunner.io) and GoRunner Cloud (app.gorunner.io and api.gorunner.io). A self-hosted installation of GoRunner is run by whoever installed it; that operator is responsible for it, and it sends us nothing.

We have two roles:

• For your account, our website and our docs, we decide what happens to the data. We are the controller, and this policy describes it.
• For what your organization puts through GoRunner, your organization decides. That is its workflows, runs, connections, forms and the data that flows through them. Your organization is the controller, and we process the data on its behalf under our Data Processing Agreement. If a workflow processes data about you, ask the organization that runs it. The section “Data your organization puts through GoRunner” describes what we do with it.

Visiting gorunner.io and docs.gorunner.io

• What: your IP address, the time, the page asked for, the referring page and your browser’s user agent. Your browser sends these with every request.
• Why: to deliver the pages and protect them from attacks and overload.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a website that works and stays safe.
• Who: both sites are static files served by Cloudflare. We keep no visitor logs of our own and use no analytics. Cloudflare processes these details for us under its data processing agreement.

Your GoRunner account

• What: your email address; your name, if you give it; the organizations and workspaces you belong to and your role in each; invitations you send or receive; when you signed in and were last active; for each signed-in session, the IP address and browser it came from; your two-factor settings (the secret is stored encrypted, recovery codes hashed); the API tokens you create (stored hashed); and your settings.
• Why: to create your account, sign you in, keep it secure and provide the service.
• Legal basis: Art. 6(1)(b) GDPR (the contract). For session IP addresses and sign-in records, Art. 6(1)(f): our legitimate interest in protecting accounts from takeover and misuse.
• How long: while your account exists. A session lasts 30 days from its last use, and ends when you sign out. A sign-in link or code lasts 15 minutes.
• Closing your account (Settings › Delete your account) replaces your sign-in email address and your name with placeholders, ends every session, and revokes your API tokens and AI-app access. Organizations where you are the only member are deleted with everything in them. Audit records, which name you by email address, keep their own period (below).

You need an email address to have an account: signing in is a link or code sent to it. Without one we cannot give you an account.

Security and audit records

• What: sign-ins; changes to members, roles, tokens, single sign-on and connections; workflow edits; each use of a stored credential. Each record names the person (with their email address) or token, the time, and, for actions a person took, the IP address.
• Why: so your organization can see who did what (the audit log in the dashboard), and so we can investigate misuse and security incidents.
• Legal basis: Art. 6(1)(f) GDPR. The legitimate interests are your organization’s and ours: security and accountability.
• How long: 2 years, with IP addresses removed after 90 days. Records of a run, schedule or poll using a credential are kept for 90 days, except each connection’s most recent use.

Service emails

• What: your email address and the message: sign-in links and codes, and invitations (with the organization’s name, the inviter’s name and the role).
• Legal basis: Art. 6(1)(b) GDPR.
• Who: sent through Resend. We send no newsletters and no marketing email.

Writing to us

• What: when you email one of our @gorunner.io addresses, your address and what you write.
• Why: to answer you.
• Legal basis: Art. 6(1)(b) GDPR when it concerns a contract or the start of one; otherwise Art. 6(1)(f), our legitimate interest in answering the people who write to us.
• How long: until the matter is closed, then as long as commercial and tax law require us to keep business letters (6 years, § 257 HGB) or accounting records (10 years, § 147 AO).
• Who: our mailboxes are hosted by Google Workspace.

Keeping the service running

• What: logs, metrics and traces of what the servers do: the IDs of organizations, workspaces, workflows, runs and steps, workflow and step names, timings, the hosts a step called, and error messages. An error message can quote part of the data that caused it, an email address for example. Error reports from the dashboard carry the message and your browser’s family. Secrets are removed first; client IP addresses are not logged.
• Why: to find and fix faults and keep the service available.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a reliable service.
• Who and how long: the logs on our own servers are overwritten by size, normally within days. They are also sent to Grafana Cloud, which deletes them when the retention period of our account ends.

Keel and your AI provider

Keel, GoRunner’s assistant, works with the AI provider your organization connects, with your organization’s own account and key. GoRunner Cloud has no AI provider of its own.

• When someone in your organization uses Keel, GoRunner sends that provider the parts of a run Keel needs: the conversation, the workflows involved and, unless Privacy mode is on, the values and errors of the runs Keel looks at. Connection credentials and secret variables are never sent.
• Privacy mode (Settings › Keel) sends only step names and the shape of the data, never a run’s values.
• That provider’s own terms, under your organization’s contract with it, decide what it may do with the data, including whether it may train on it.
• GoRunner does not use customer data to train AI models.

Data your organization puts through GoRunner

This is your organization’s workflows, run inputs and outputs, form submissions, files, connections and their credentials, and the data read from or written to the apps your workflows connect. A webhook run keeps the request it received, including the sender’s IP address. We process all of it on your organization’s behalf, only to run and show its workflows, under the Data Processing Agreement.

• Where: Amazon Web Services, Frankfurt (eu-central-1): our database and object storage.
• Encryption: credentials, secret variables, AI keys and the step outputs of held runs are encrypted with a key of your organization’s own (AES-256-GCM). Everything is encrypted at rest by AWS.
• How long: runs are deleted automatically 90 days after they finish; each workflow keeps its newest finished run per environment. Deleting a run, a workflow or an organization deletes its data at once. Deleted run data stays in our storage’s previous versions for 7 days, and in our backups for 7 days, before it is gone.
• Who sees it: the people in your organization who have access. GoRunner staff do not read this data, except with your permission, to fix a problem you report, for security or abuse investigations, or when the law requires it. Each staff visit to your organization is recorded in your audit log.

Data from apps you connect

When you connect an app (Google, Slack, a database or any other), GoRunner stores the connection’s credentials encrypted. Your workflows then read from and write to that app exactly as their steps say, when they run or when you test a step. GoRunner reads nothing from a connected app on its own. What it reads is part of your organization’s run data and is deleted with it.

Google user data

When you connect a Google account with GoRunner’s own Google sign-in (“Connect with Google”), Google shows you the access GoRunner asks for before you agree.

• We use the data only to run the steps you configure and show you their results. We do not use it for advertising and we do not sell it. GoRunner staff do not read it, except with your permission, to fix a problem you report, for security or abuse investigations, or when the law requires it.
• We do not use Google user data to develop, improve or train generalised AI or machine-learning models.
• If someone in your organization asks Keel about a run that contains Google data, that data goes to the AI provider your organization connected, as described under “Keel and your AI provider”. Privacy mode keeps it from being sent.
• You can disconnect at any time, in GoRunner (Connections) or in your Google account’s security settings.

GoRunner’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who receives data

We use a few service providers, each under a data processing agreement: Amazon Web Services (hosting, in Frankfurt), Cloudflare (DNS and delivery of our websites), Resend (service emails), Grafana Labs (monitoring) and Google (our mailboxes, and the Google sign-in when you connect Google). The full list, with what each receives and where, is on the sub-processors page.

Other recipients: the AI provider your organization connects; the apps your workflows send data to (your organization chooses both); and authorities, where the law requires us to disclose data. We do not sell personal data.

Transfers outside the EU: Cloudflare, Resend, Grafana Labs and Google are US companies or have US parents. Transfers to them rest on the EU-US Data Privacy Framework (Art. 45 GDPR), for each that is certified under it, and on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) as well. Ask privacy@gorunner.io for a copy of the clauses.

Cookies and storage in your browser

gorunner.io

This website sets no cookies and loads no third-party scripts, fonts or trackers. Your browser’s local storage keeps at most two choices: your light or dark theme, if you pick one, under the key “theme”, and that you closed the cookie note, under the key “cookie-note”, so it stays closed. Neither is sent to us.

docs.gorunner.io

The docs set no cookies. Local storage keeps your reading choices only: theme, edition, platform, line wrapping, open sections and tabs, and the last few pages you opened.

app.gorunner.io

• gr_session keeps you signed in, for 30 days from your last visit.
• Short-lived cookies (at most 15 minutes) make sure a single sign-on or a connected app’s sign-in returns to the browser that started it.
• sidebar_state remembers whether the sidebar is open, for 7 days.
• Local and session storage keep interface choices, such as the theme and panel sizes, and, while you sign in, the email address you are signing in with, in that tab only.

Each of these is strictly necessary for something you asked for, so none needs consent (§ 25(2) no. 2 TDDDG). The dashboard loads no analytics, trackers or third-party scripts.

No automated decisions

We make no decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Art. 22 GDPR).

Your rights

You have the right to:

• access your data (Art. 15 GDPR);
• have it corrected (Art. 16) or erased (Art. 17);
• restrict its processing (Art. 18);
• receive it in a portable format (Art. 20).

Write to privacy@gorunner.io. We answer within one month. For data your organization puts through GoRunner, the organization is the controller: ask it first, and we help it answer you.

Your right to object

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time, on grounds relating to your particular situation (Art. 21 GDPR). We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. Write to privacy@gorunner.io.

Your right to complain

You may complain to a data protection supervisory authority (Art. 77 GDPR), in particular where you live or work, or where you think the law was broken. The authority responsible for us is:

Changes

When the way we process data changes, we update this page and its date. If a change affects your account, we tell you by email before it takes effect.