Last updated
GDPR
The GDPR is a law, not a badge. This page says how Runearc fits into it, which documents back that up, and what you can do yourself.
Contents (8)
Who is responsible for what
| Data | Our role | What governs it |
|---|---|---|
| Mail in your inboxes: content, attachments, headers, your correspondents' addresses | Processor. You are the controller and we process it on your instructions. | The data processing agreement |
| Your account: email, workspace members, sign in, billing, workspace audit log | Controller. | The privacy policy |
The data processing agreement
Our DPA covers GDPR Article 28: instructions, confidentiality, security measures, subprocessors, deletion, audits and help with breaches. It includes the EU Standard Contractual Clauses and a UK addendum. It is part of our terms, so it applies to every customer without a separate signature. If your legal team needs a signed copy, ask for one at privacy@runearc.com.
Where data is stored
Customer data is stored in Beauharnois, Quebec, Canada, on a virtual server at OVHcloud. Canada has an EU adequacy decision for commercial organisations. The other subprocessors, such as Vercel for the dashboard front end and Amazon SES for outbound delivery, are named with their purpose and location on the subprocessors page. The public website uses Vercel Web Analytics when hosted on Vercel and self-hosted Umami when configured. The dashboard and API have no visitor analytics. We do not use advertising scripts.
Transfers
Where data goes to a subprocessor outside the EU and UK, we rely on the Standard Contractual Clauses in that subprocessor's own agreement, as the subprocessors page lists, and on the clauses in our DPA between you and us. The privacy policy explains the transfer basis in full.
Requests from the people in your mail
If someone who wrote to an address hosted on Runearc asks to see or erase their data, they should contact the owner of that address, who is the controller. We will help the owner answer. In the dashboard you can search and delete messages and inboxes, and export your workspace. Every user can also export their own account data and delete their account in Settings, Data & privacy. Requests that reach us go to privacy@runearc.com.
What you control
- How long mail is kept. Keep it until you delete it, or set automatic deletion after 30, 90, 180, 365 or 730 days in Settings, Data & privacy.
- Export and delete. The workspace owner can export everything and delete the workspace, which removes its rows and stored files at once.
- The audit log. Kept for 400 days by default; the owner can choose 90, 180, 400 or 730 days.
- Backups. Deleted data leaves backups when they expire, after 14 days of retention (up to 21 days for the point in time archive).
Breaches
We tell affected customers without undue delay and within 48 hours of becoming aware of a personal data breach that affects their data, so you have time to meet your own 72 hour duty to the supervisory authority. Our security page lists the controls we run.
What we do not have
- An EU or UK representative. Runearc has not appointed one; you can contact us directly at privacy@runearc.com, and you keep the right to complain to your data protection authority.
- An EU data region. Data is stored in Canada.
- A data protection officer. Runearc is run by one person, who answers privacy requests.