Privacy Policy

Runday ("we", "us", "our") provides a business management platform used by service businesses such as barbershops and salons ("Business Users") to manage bookings, checkout, staff commissions, and client records.

It applies to two groups of people whose personal information we may process:

• Business Users — the businesses and staff who sign up for Runday directly.
• End-Clients — the customers of those businesses, whose information a Business User enters into Runday while running their business.

We act as a service provider for End-Client data. The Business User controls that relationship and is responsible for obtaining any consent needed from their own clients. We act as the organisation responsible for the information Business Users give us directly, such as account and billing details.

From Business Users:

• Name, email address, phone number
• Business name, address, and business type
• Billing information, processed by Stripe — we never store card numbers ourselves
• Staff records, including commission rates and pay-period earnings
• Usage data: login activity, feature usage, device and browser information

About End-Clients, entered by Business Users:

• Name and contact details (phone, email)
• Appointment history, services received, and purchase history
• Any notes a Business User chooses to record

We do not collect End-Client information directly. It reaches us through the Business User, who is responsible for the accuracy and lawfulness of what they enter.

• Operating the platform: bookings, checkout, commission calculation, client records
• Authentication and customer support
• Improving the product, using aggregated or de-identified data where possible
• Billing and payment processing
• Legal compliance and fraud prevention
• Marketing to Business Users only, with consent, as described in section 8

We do not sell personal information, and we do not use End-Client data for our own marketing.

We collect, use, and disclose personal information with knowledge and consent, except where the law permits or requires otherwise. Consent may be express, such as when a Business User signs up and accepts this policy, or implied, such as a client giving their phone number so a shop can remind them about an appointment.

Business Users are responsible for making sure their own clients know their information is stored in a system like Runday.

• Privacy Officer. Runday's founder holds the highest authority over the protection of personal information and acts as Privacy Officer, reachable at [email protected]. Requests sent to that address reach them directly.
• Privacy impact assessments. Law 25 requires an assessment before personal information is communicated outside Québec. Our database is in the United States (see section 6), so this applies to us. We have not completed that assessment yet. We are recording it here rather than leaving it unsaid, and we are resolving it either by completing the assessment or by moving the database to a Canadian region.
• Consent standard. Consent must be clear, free, and informed, and given for specific purposes. We do not bundle it with unrelated terms.
• Automated decision-making. Runday does not make automated decisions producing legal or similarly significant effects. If that changes, we will say so and offer a route to human review.
• Portability. Québec residents may request their computerised personal information in a structured, commonly used format.
• Breach notification. Any incident presenting a risk of serious injury will be reported to the Commission d'accès à l'information and to affected individuals, within the timelines Law 25 sets.

Runday's database is hosted in Canada. Some information still leaves Canada through other providers Runday relies on. Being clear about this matters more than it being convenient:

• Our database, which holds account, client, appointment and commission records, is hosted by Supabase on Amazon Web Services in Montreal, Canada (region ca-central-1).
• The application server for rundays.ca is hosted by Contabo in France — outside Canada.
• Payment processing is handled by Stripe, and website analytics by Google Analytics, both of which process data outside Canada.

While information is outside Canada it is subject to the laws of the country it sits in, including lawful access requests by foreign authorities. We remain accountable for it under PIPEDA regardless of where it is held.

Disclosing this transfer is itself a PIPEDA requirement, and this section is that disclosure. Law 25 additionally requires a privacy impact assessment before personal information leaves Québec, and we have not completed one. We are resolving this either by completing the assessment or by moving the database to a Canadian region, and we will update this page when it is done.

Security measures currently in place:

• All traffic encrypted in transit over HTTPS/TLS; data encrypted at rest by our hosting providers
• Database-level row security, so a Business User's records are technically unreachable from another business's account rather than merely hidden in the interface
• Passwords are hashed by our authentication provider and never stored in readable form
• Staff accounts created by an owner must set their own password before first use
• Rate limiting on public endpoints, and file-type validation on uploads

No system is perfectly secure, and we do not claim otherwise.

We keep personal information only as long as needed for the purposes it was collected for, or as the law requires — for example tax and accounting records. Business Users may request deletion of their account and its data, subject to those obligations.

In practice:

• While your account is open — we keep your business records so you can use your own history: past appointments, sales and commission records.
• After you delete your account — your data is removed from our active systems immediately, apart from records we are legally required to keep. Backups age out on their own cycle within 30 days.
• Waitlist signups — kept until you ask us to remove you, or until we stop running the waitlist.
• Records we must keep by law — financial and tax records are retained for the period Canadian tax law requires, currently six years.

Where we send marketing email or SMS to Business Users, we will:

• Obtain express consent first, where required
• Identify ourselves clearly in every message
• Include a working unsubscribe link
• Action unsubscribe requests within 10 business days

This does not apply to End-Clients. Booking-related messages reach them from the business they visit, not from Runday.

Subject to legal exceptions, you may:

• Access the personal information we hold about you
• Ask us to correct anything inaccurate
• Withdraw consent, subject to legal and contractual limits
• Ask us to delete your information
• Request a portable copy, if you are in Québec
• Complain to the Office of the Privacy Commissioner of Canada, or if you are in Québec, the Commission d'accès à l'information

If you are an End-Client — a customer of a business that uses Runday — please contact that business first. They control your record. We will help them respond.

Otherwise, write to [email protected].

If personal information is breached in a way that creates a real risk of significant harm, we will notify the affected individuals and the appropriate regulator — the Office of the Privacy Commissioner of Canada, and the Commission d'accès à l'information for Québec residents — without unreasonable delay.

To be written: EU and UK — GDPR legal bases, data subject rights, international transfer mechanism.

Until that content exists, the Canadian terms above are the ones we operate under, and nothing here reduces rights you may have under your local law.

• Runday, operated from Québec, Canada
• Privacy Officer and general privacy enquiries: [email protected]
• Runday is run by its two founders and is not yet a registered company, so there is no registered entity name or business address to give you. Both will be added here once it is registered. Email reaches us in the meantime and we answer within 30 days.

See also our Cookie Policy, Confidentiality Policy, and Terms of Service.