Data Processing Agreement
Last Updated: October 2026
This Data Processing Agreement (DPA) covers personal data that a business customer puts into Runable. The customer decides why the data is processed. Runable Inc. processes it only on the customer's instructions.
This page is the Cover Page. It brings in the Common Paper DPA Standard Terms Version 1.1 (the Standard Terms) by reference. Together they form the DPA. Capitalized words not defined here have the meaning given in the Standard Terms.
This DPA forms part of the Agreement, and the Agreement's governing law applies to it.
Cover Page
| Agreement | The Runable Terms of Service between Runable Inc. (Provider) and the Customer. |
| Approved Subprocessors | The list on the sub-processors page, as updated with notice. |
| Provider Security Contact | |
| Security Policy | Commercially reasonable efforts, plus the measures in Annex II. |
| Governing Member State | EEA transfers: Ireland. UK transfers: the UK Addendum applies. |
Annex I(A): List of Parties
| Data exporter | The Customer named in the Agreement, at the contact details on its Runable account. |
| Data exporter's role | Controller (Module Two). If the Customer processes the data for its own clients, Processor (Module Three). |
| Data importer | Runable Inc., 8 The Green, Dover, Delaware 19901, USA. Contact: support@runable.com. |
| Data importer's role | Processor. |
| Activities | Providing Runable to the Customer under the Agreement. |
Annex I(B): Description of Transfer and Processing Activities
| Service | Runable, an AI agent that chats, works with files, uses connected apps, records meetings, makes calls, and builds websites and apps. |
| Categories of Data Subjects | The Customer's users, and people whose details appear in the content they add, such as contacts, customers, and meeting participants. |
| Categories of Personal Data | Names, email addresses, and other contact details; account and usage data; and any personal data in messages, files, connected apps, meeting recordings, voice recordings, calls, and text messages. |
| Special Category Data | Not intended. The Customer may still upload it. It is protected by the measures in Annex II. |
| Frequency of Transfer | Continuous while the Customer uses Runable. |
| Nature and Purpose of Processing | Hosting, storage, and AI processing to deliver the Service the Customer asks for. On the free plan, Runable also shows ads, as described in the Privacy Policy. Paid plans do not show ads. |
| Duration of Processing | The term of the Agreement. Customer Personal Data is deleted within 30 days after the account is deleted. |
Annex I(C): Competent Supervisory Authority
| Supervisory authority | As set out in the Standard Terms. |
Annex II: Technical and Organizational Security Measures
| Encryption at rest | Data stored on Google Cloud is encrypted at rest by Google Cloud. |
| Encryption in transit | Traffic to Runable's websites and API uses TLS. |
| Connected-app tokens | Encrypted with AES-256 before they are stored. |
| Separation | Each user's files are stored under their own storage prefix. Code runs in isolated sandboxes. |
| Subprocessors | Each Approved Subprocessor is bound by data processing terms. |
| Deletion | When an account is deleted, its data is removed within 30 days, including stored files and the account's links with connected-app providers. |
Common Paper DPA Standard Terms Version 1.1 free to use under CC BY 4.0.
The Customer accepts this DPA by accepting the Agreement, or both parties may sign a copy. For a copy to sign, email support@runable.com.
