Privacy policy
Last updated November 15, 2026
Runvault is an AI agent with its own computer and access to the tools you connect. This policy explains what we collect when you visit runvault.ai or use the app at app.runvault.ai, what we do with it, who else handles it, and the choices you have. Runvault is run by Biba Technologies LLC. In this policy, "Runvault", "we" and "us" mean Biba Technologies LLC.
The short version
- We collect what you give us (your Google sign-in details, your chats, files and connectors) and what we need to run the service and bill for it.
- Your chats and files are stored on Cloudflare and sent to OpenAI so the agent can answer. We don't sell your data, use it for advertising, or train AI models on it.
- In the EU, the EEA, the UK and Switzerland, the analytics cookie stays off until you accept it. Elsewhere it's on unless you turn it off. Either way, you can change it at any time in Cookie settings.
- You can ask for a copy of your data, or for us to delete it, at any time: info@runvault.ai.
What we collect
Your account. When you sign in with Google, Google gives us your name, email address, profile picture and Google account ID. We also keep your time zone, what you choose in the welcome steps, and your plan.
What you put into Runvault. Your chats with the agent, including the files you attach and everything the agent writes back. Also the files in your workspace, the agent's memory, your skills and schedules, and the connectors you add, including their sign-in tokens and API keys.
What the agent does. Every tool the agent uses is recorded in your audit log, with what it sent and what came back. So are the changes you make to your settings.
Usage and billing. The credits you use, the tokens each AI model call takes, how long your sandbox runs, and how much storage you use. If you upgrade, Stripe takes your payment. We keep your Stripe customer ID and subscription status, but never your full card number.
Feedback. A thumbs up or down on an agent reply, and any comment you add to it.
Product analytics. The pages you visit on runvault.ai and in the app, the links and buttons you click (the app hides their text), and events like signing up, starting a run or adding a connector. Analytics never include your chat text, prompts, files or keys. See Cookies and analytics.
Technical data. Our servers log requests and errors, including your IP address and browser details, to keep the service working and secure.
How we use it
- To run Runvault: sign you in, run the agent, keep your files and run your schedules.
- To bill you and apply your plan's limits.
- To fix problems and keep the service safe, including stopping abuse.
- To understand how people use Runvault, and make it better.
- To write to you about your account, and to answer you when you write to us. We send one welcome email when you sign up, and each time a scheduled task runs we email you its result. You can turn that off for any task, from the link in the email or the task's settings.
People at Runvault can access your chats and files. We look at them to fix a problem, to understand how Runvault is used so we can improve it, to look into abuse or a security issue, or when the law requires it.
Who else handles your data
These companies handle data for us, under their own terms:
- Cloudflare hosts runvault.ai and the app, runs the agent and its sandbox, stores your account, chats, files and logs, and sends our emails.
- OpenAI provides the AI model. To produce each reply, we send OpenAI your messages and attachments, the agent's memory and skills, and the results of the agent's tools. Under OpenAI's API terms, it doesn't use this data to train its models.
- Stripe handles payments and invoices.
- PostHog provides our product analytics.
- Google provides sign-in, and the fonts on runvault.ai and in the app. When your browser loads them, Google sees your IP address.
Connectors you add. When the agent uses a connector, it sends that service what the task needs, and that service's own privacy policy applies. The agent's sandbox can also reach websites and APIs on the internet when a task calls for it.
We may also share data when the law requires it, to protect people or the service, or as part of a merger or sale of the company. If that happens, this policy still applies to your data.
Cookies and analytics
| Name | Where | What it's for | How long |
|---|---|---|---|
session | api.runvault.ai | Keeps you signed in. Needed for the app to work. | 7 days |
__ph_opt_in_out_… | runvault.ai and the app | Remembers your answer to the cookie banner. | 1 year |
ph_…_posthog and similar ph_ entries | runvault.ai and the app | Analytics. Recognizes your browser between visits, and in the app links your visits to your account. In the EU, the EEA, the UK and Switzerland, only after you click Accept. Elsewhere, until you turn it off. | 1 year |
| Theme, sidebar width, dismissed notices | The app (stored in your browser) | Remembers how you like the app to look. Stays on your device. | Until you clear it |
In the EU, the EEA, the UK and Switzerland, we ask before using the analytics cookie. Before you answer, and after you decline, PostHog runs without cookies. Nothing is stored in your browser, and visits are counted with a code made from your IP address and browser that changes every day.
Everywhere else, the analytics cookie is on from your first visit and we don't show a banner. If you turn it off in Cookie settings, we delete it and your browser stops sending analytics.
Each site works out which country you're in from your IP address, through Cloudflare, when the page loads. If it can't tell, it asks. PostHog also uses your IP address to estimate your city and country.
Our servers also record account events in PostHog, such as signing up, finishing a run, adding a connector or changing plans, together with your name and email. These don't use cookies, and they're recorded whatever you answer.
You can change your choice at any time with "Cookie settings" at the bottom of runvault.ai, or from your profile in the app. Google's sign-in and Stripe's checkout can set their own cookies, which their own policies cover. We don't use advertising cookies, and we don't record your screen.
How long we keep it
- Your account, chats, files, connectors, schedules and audit log stay for as long as your account is open. Deleting a chat, a file or a connector removes it.
- When you ask us to close your account, we delete its data, including your analytics profile, within 30 days. Copies in our backups are gone within 30 more days.
- Server logs are kept for about a week.
- We keep billing records for as long as tax and accounting law requires.
Your choices and rights
- See and correct your data. Most of it is in the app: your chats, the Files page, Settings and your audit log. For anything else, or a full copy of your data, email us.
- Delete it. Delete chats, files and connectors in the app. To close your account and delete everything, email info@runvault.ai from your account's address.
- Analytics. Turn the analytics cookie off, or back on, in Cookie settings.
If you're in the EU, the UK or somewhere with similar laws, you can also object to or restrict how we use your data, withdraw your consent at any time, and complain to your local data protection authority. We answer every request within 30 days.
Under the GDPR, we rely on these legal bases: providing the service you signed up for (contract); keeping it safe, fixing problems, improving it and counting visits without cookies (legitimate interests); the analytics cookie (your consent); and keeping billing records (legal obligation).
If you're in California: we don't sell or share your personal information, as the CCPA defines those terms.
Where your data is processed
Runvault and the companies above are based in the United States, so your data is processed there and wherever those companies operate. When data moves from the EU or the UK, we rely on those companies' data protection agreements, which include the EU's standard contractual clauses.
Security
Connector tokens and API keys are stored encrypted, and the agent never sees your API keys. Each account's files and sandbox are kept separate, and every connection uses HTTPS. No system is perfectly secure, so if you find a problem, please tell us at info@runvault.ai.
Children
Runvault isn't for children. You must be at least 16 to use it, and we don't knowingly collect data from anyone younger.
Changes to this policy
When we change this policy, we update the date at the top. If a change is significant, we'll tell you in the app or by email before it takes effect.
Contact
Biba Technologies LLC is responsible for your data. Write to us at info@runvault.ai, or by mail:
Biba Technologies LLC971 US Highway 202 N #4907
Branchburg, NJ 08876
United States