Privacy Policy

1. Data we collect

Account data: your name, email address, password (stored only as a salted hash; we cannot read it), preferred language, plan and account status, and whether you verified your email.

Data you create in the app: message templates, your list of saved businesses with the status, notes and follow-up dates you add, when you marked a business as messaged, and your recent search terms.

Usage data: which tools you used and how many credits each action used, with timestamps and the search text, so we can apply plan limits and prevent abuse.

Security data: your IP address and the email address used in sign-in, password-reset and early-access attempts, kept briefly to block brute-force and spam; the browser type of each signed-in session; and one-time tokens for email verification and password reset (stored hashed, expiring within 48 hours).

Early-access list: if you join the waitlist on our website, your email address, language and the date.

Payment data: when paid plans are available, payments are handled by Stripe. We receive limited information such as your plan, billing country and payment status, but never your full card number.

Emails: if you write to us, the content of your message and your contact details.

2. Business data from Google Maps

Search results are fetched live from the Google Maps Platform when you search. On our servers we keep only Google’s place identifiers of businesses you save or message, together with your own notes and statuses. Business names, phone numbers and other details are kept only on your device (in your browser’s storage) so they don’t have to be fetched again. Google processes your searches under the Google Privacy Policy.

Business listings can contain personal data about business owners (for example a sole trader’s name or phone number). You decide whether to contact them, and you are responsible for doing so lawfully.

3. Why we use your data

• To provide the Service and your account (performance of our contract with you).

• To send service emails such as email verification, password reset and important account notices (contract).

• To keep the Service secure, enforce limits and prevent abuse (our legitimate interests).

• To understand usage costs and improve the Service (legitimate interests).

• To contact people on our early-access list about their invitation (consent, which you can withdraw at any time).

• To meet legal, tax and accounting obligations (legal obligation).

We do not use your data for advertising, we do not build advertising profiles, and we do not use automated decision-making that has legal effects on you.

4. Cookies and similar technologies

We use one strictly necessary cookie to keep you signed in to the app (it lasts up to 30 days). We also use your browser’s local storage for things like your language choice, screen preferences and the cached business details mentioned above. We do not use analytics, advertising or third-party tracking cookies, and our fonts are served from our own servers. Because of this, we don’t show a cookie consent banner.

5. Who we share data with

We use trusted service providers who process data for us under contracts that protect it:

• Cloudflare: hosting, security and our database (stored in Western Europe);

• Google (Google Maps Platform): business search results;

• Resend: sending service emails;

• Stripe: payments, once paid plans are available.

We may also disclose data if required by law, to protect rights and safety, or as part of a merger or acquisition (in which case this policy continues to apply). We do not sell or “share” personal data as those terms are defined under California law.

6. International transfers

We are a US company and some of our providers are based in the US. When data from the European Economic Area, the UK, Switzerland or Turkey is transferred abroad, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and equivalent mechanisms under Turkish law.

7. How long we keep data

We keep account data and the content you create for as long as your account is active. When you ask us to delete your account, we delete it within 30 days, apart from records we must keep by law (such as billing records). Security records such as sign-in attempts are kept only for a short time. Early-access emails are kept until you ask us to remove them or until we invite you. Backups are overwritten on a rolling basis.

8. Security

We use encryption in transit (HTTPS), hashed passwords and tokens, secure session cookies, rate limiting and access controls. No method is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

9. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, receive a copy in a portable format, restrict or object to certain uses, and withdraw consent. Residents of California have the right to know, delete and correct personal information and not to be discriminated against for exercising these rights. People in the EEA and the UK may also complain to their local data-protection authority.

To use your rights, email support@runraccoon.com from the address linked to your account. We reply within one month (45 days under California law) and may need to confirm your identity. You can change your name, language and in-app content yourself at any time.

10. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

11. Changes

We may update this policy. If the changes are significant, we will tell you by email or in the app before they apply. The date at the top shows the latest version.

12. Contact

Inception Media LLC, 212 N. 2nd St. STE 100, Richmond, KY 40475, USA. Email: support@runraccoon.com.