Privacy Policy
How we collect, use, store and protect personal data, both on this website and on the Runflow platform.
This is a translation provided for convenience. Runflow’s binding Privacy Policy is the Portuguese version, and it is the one that prevails in the event of any divergence between the two texts.
Read the Portuguese version, which is governed by Brazilian law, including the LGPD, Brazil’s data protection law (Law 13.709/2018).
- 1. Data we collect
- 2. Lawful bases for processing
- 3. How we use the data
- 4. Use of Google API data
- 5. Data sharing
- 6. Storage and security
- 7. Data retention
- 8. Data subject rights
- 9. Data protection officer and contact channel
- 10. Cookies and measurement
- 11. International transfers
- 12. Changes to this Policy
- 13. Contact
AI BUILDER SOLUTIONS LTDA(“Runflow”, “we”), registered with the Brazilian corporate taxpayer registry (CNPJ/MF) under no. 62.142.564/0001-16, respects your privacy and is committed to protecting your personal data. This Policy describes how we process personal information on two fronts: on this website (runflow.ai) and on the Runflow platform (the “Platform”).
1. Data we collect
1.1. Data you provide on this website
When you fill in a form on the website, we collect only what the form itself asks for:
- Assessment request: first name, last name, email, WhatsApp, company, job title and company size.
- Free material (ebooks and guides): name, company, job title and work email.
- WhatsApp conversation: if you message us through the button on the website, we receive your phone number, your profile name and the messages exchanged with Felipe, our AI pre-sales agent, which records the conversation in our CRM.
We also record technical browsing data (IP address, device and browser type, pages visited) in order to operate the website securely.
1.2. Platform account data
When you create an account, we collect:
- Full name
- Email address
- Organization name
- Password (stored as a cryptographic hash)
1.3. Platform usage data
- Access logs (date, time, IP)
- Actions performed on the Platform (agent configuration, automation runs)
- Consumption metrics (executions, tokens used)
1.4. Third-party service data (connectors)
When the User voluntarily connects a third-party service to the Platform (such as Google, Microsoft, Slack or Meta), we may access data from that service solely to the extent necessary to run the automations the User has configured. Examples of the data accessed, according to the connector enabled:
| Service | Data accessed | Scope |
|---|---|---|
| Gmail | Email messages, labels, drafts | gmail.modify |
| Google Calendar | Events, calendars, availability | calendar |
| Google Drive | Files, folders, metadata | drive |
| Google Ads | Campaigns, performance reports | adwords |
| YouTube | Videos, playlists, channel | youtube.readonly, youtube.force-ssl |
| WhatsApp Business (Meta API) | Messages exchanged in the conversation, phone number and profile name of the person writing, delivery status | whatsapp_business_messaging, whatsapp_business_management |
| Instagram (direct messages) | Direct messages, identifier and username of the person writing, comments when the User enables replies to comments | instagram_business_basic, instagram_business_manage_messages, instagram_business_manage_comments |
Important: no third-party service is connected automatically. Connecting is always a voluntary and explicit action by the User, who may revoke it at any time.
2. Lawful bases for processing
All processing described in this Policy has a lawful basis under the LGPD (Law 13.709/2018):
| Processing | Lawful basis |
|---|---|
| Data submitted in an assessment or contact request | Preliminary procedures related to a contract, at the data subject’s request (art. 7, V) |
| Sending free material you requested | Consent (art. 7, I) |
| Subsequent commercial contact about Runflow products and services | Legitimate interest (art. 7, IX), with a right to object at any time |
| Account and execution data on the Platform | Performance of a contract (art. 7, V) |
| Access logs and security records | Compliance with a legal obligation (art. 7, II) and legitimate interest in security (art. 7, IX) |
Where the basis is consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal. Where it is legitimate interest, you may object to the processing through the channel in section 9.
3. How we use the data
We use the data collected to:
- Answer your request: get back to you, schedule the assessment conversation and send the material requested;
- Provide the service: run the automations and integrations configured by the User;
- Maintain the account: authentication, access management and technical support;
- Improve the product: aggregated and anonymized usage analysis;
- Communication: sending operational notifications and, where authorized, information about new features.
We do not use data from third-party services (Google, Microsoft and others) to:
- Display advertising
- Sell or share with data brokers
- Train artificial intelligence models
- Any purpose other than running the automations configured by the User themselves
4. Use of Google API data
In accordance with the Google API Services User Data Policy, including the Limited Use requirements:
4.1. Access to the User’s Google data is limited to the practices described in this Policy and necessary to provide the features requested by the User.
4.2. We do not transfer Google data to third parties, except where necessary to provide the service, as required by law, or with the User’s explicit consent.
4.3. We do not use Google data to serve advertising.
4.4. People may read Google data only with the User’s consent, for security purposes, to comply with applicable law, or for Runflow’s internal use when the data is aggregated and anonymized.
5. Data sharing
We do not sell, rent or trade your personal data. We may share data only in the following situations:
- Infrastructure providers: cloud hosting services (AWS) for operating the Platform, under contracts containing data protection clauses;
- Relationship management tools: the data submitted through the forms on this website is recorded in a CRM tool contracted by Runflow, which acts as a processor and handles the data solely under our instructions;
- Legal obligation: where required by law, court order or a regulatory authority;
- With consent: where you expressly authorize it.
6. Storage and security
6.1. Data is stored in cloud infrastructure with:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Role-based access control (RBAC)
- Continuous security monitoring
- Regular backups and geographic redundancy
- Third-party credentials stored with dedicated symmetric encryption
6.2. Access credentials for third-party services (OAuth tokens) are stored encrypted and isolated per tenant (organization).
7. Data retention
| Type of data | Retention period |
|---|---|
| Data submitted through website forms | Up to 24 months after the last contact, or until you request deletion |
| Platform account data | While the account is active + 6 months after deletion |
| Execution logs | 90 days |
| Third-party credentials | Until the User revokes the connection |
| Third-party service data | Processed in real time; we do not store a permanent copy |
After an account is deleted or a connector revoked, the associated data and tokens are removed within a maximum of 30 days.
8. Data subject rights
In accordance with the LGPD (Law 13.709/2018) and the GDPR, you have the right to:
- Confirmation and access: to know whether we process your data and what it is;
- Correction: to correct incomplete, inaccurate or out-of-date data;
- Anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
- Portability: to receive your data in a structured format;
- Deletion of data processed on the basis of consent;
- Information about who we share your data with;
- Withdrawal of consent at any time;
- Objection to processing based on legitimate interest;
- Disconnecting services: revoking access to any third-party service directly on the Platform.
To exercise any of these rights, write to privacidade@runflow.ai. We respond within 15 days. You may also lodge a complaint with the Brazilian data protection authority (ANPD).
9. Data protection officer and contact channel
The contact channel for Runflow’s Data Protection Officer (in the LGPD, the “encarregado”) is the email address privacidade@runflow.ai. Use this channel to exercise the rights in section 8, to object to processing, to withdraw consent or to clarify any question about this Policy.
10. Cookies and measurement
10.1. Strictly necessary cookies
These are always present, because the website does not work without them:
- Keeping your session working as you browse
- Securing requests
- Storing your choice about measurement, so that we do not ask again on every visit
We do not sell browsing data to third parties, under any circumstances.
10.2. Audience measurement
To understand which pages help the people who visit the website, we may use Google Analytics 4, which writes its own cookies in your browser and records page views and actions such as starting and submitting a form. We never record the content of what you type.
We also use tracking from HubSpot, our CRM, which writes its own cookie to recognize that the pages seen before a form and the submission of that form belong to the same visit. That is what lets us know which path brought you to us. Unlike Google Analytics, it has no deactivated loading mode: for that reason the script is only included in the page after you accept, and no HubSpot cookie is created before that.
We also use Microsoft Clarity, which records how the pages are used (clicks, scrolling and cursor movement) to build heatmaps and replays of visits. Form fields are masked: what you type is not recorded. Unlike the other tools in this section, Clarity works before you accept, without writing cookies: each page viewed is handled in isolation, without linking one page to another. If you accept, it starts using its own cookies to recognize the pages of a single visit, and a Microsoft cookie (MUID) shared with other Microsoft services; if you decline after having accepted, the Clarity cookies are deleted. The data is processed by Microsoft and may be stored outside Brazil (section 11).
Measurement with cookies is only activated if you accept in the notice shown on your first visit. Until then, and also if you decline, consent remains denied by default (Google Consent Mode) and no measurement cookie is created. Declining limits nothing on the website.
Current status: audience measurement is available on this website and depends on your acceptance.
To review your choice, clear this website’s data in your browser: the notice appears again on your next visit. You may also contact our Data Protection Officer, in section 9.
10.3. Advertising and remarketing
We use tags from advertising platforms to measure the results of our campaigns and to show Runflow ads to people who have already visited the website. These tags write cookies shared with the corresponding advertising platform.
Like measurement, they only load after you accept: until you accept, or if you decline, the scripts are not included in the page and no advertising cookie is created. Accepting in the notice covers both measurement and advertising, and the notice says so in those words.
10.4. Cookies on the Platform
On the Platform, cookies are restricted to what is necessary: keeping the session authenticated and ensuring security (CSRF tokens). There is no audience measurement or advertising inside the Platform.
11. International transfers of data
Data may be stored and processed on servers located outside Brazil, both in the Platform’s infrastructure (AWS, São Paulo region and/or the United States) and in the relationship management tools used to respond to the forms on this website and in the website usage measurement tool (Microsoft Clarity). We ensure that any international transfer meets the data protection requirements of the LGPD and the GDPR, including standard contractual clauses where applicable.
12. Changes to this Policy
We may update this Policy from time to time. We will notify you of significant changes by email or through a notice on the Platform. The date of the last update is always shown at the top of this document.
13. Contact
For questions about privacy and data protection: privacidade@runflow.ai
For general questions or technical support: suporte@runflow.ai
AI Builder Solutions LTDA · CNPJ 62.142.564/0001-16
R. Cel. José Eusébio, 95, sala 13, Higienópolis, São Paulo - SP, CEP 01239-030, Brazil