Privacy Policy

1. Who we are

Red by run.cloud (Red) is operated by Small Scale Labs AB, Agavägen 19, 181 55, Lidingö, Sweden, which is the controller of the personal data described here. Contact: support@run.cloud. Where we process personal data only to perform a scan on your behalf, you are the controller and we act as your processor.

2. What we collect

Account details from your sign-in provider (such as your email address and name), the sites you submit, purchase and billing records, support messages, and technical data such as IP address, browser details, and security logs. Payment details are handled by our payment provider.

When you run a scan we store its trace and report: the requests made and responses received, the technologies and versions observed, findings, and, for the full scan, the AI agent’s steps. These can contain personal data or secrets that the target site returns.

3. Why we use it, and our legal bases

To provide Red: run the scans you request, deliver and support your reports, manage your account, and take payment (performance of a contract). To keep records required for accounting and tax (legal obligation). To secure the service, prevent abuse, and fix problems (our legitimate interest in running a safe, working service).

We may also turn scan traces into anonymised datasets, with credentials, secrets, and anything that identifies you or your site removed, and use them to train AI models or license or sell them to others (our legitimate interest in security research). We do neither today. We never sell or train on your personal data, identifiable traces, or findings, and never share data for advertising. You can object to this use at any time.

Without the account details needed to sign in, we cannot provide the service.

4. Who receives it

Service providers that run Red for us under data processing agreements: hosting, sign-in, payments, email, and AI inference providers, which receive scan content to perform the full scan. We also disclose information where the law requires it, or to a successor if the business is transferred. Reports are never made public by us.

Recipients of anonymised datasets receive no personal data. Some providers process data outside the EEA. Those transfers rely on an adequacy decision or the EU standard contractual clauses.

5. How long we keep it

Scan traces and reports are kept while your account is active so you can return to them (a new scan of the same site replaces your previous report of it), and deleted when you ask us to or close your account. Billing records are kept for as long as Swedish accounting law requires (currently seven years). Security logs are kept only as long as needed to investigate abuse. Backups roll over on their normal schedule. Anonymised data is no longer personal data and may be kept after that.

6. Your rights

You can ask for access to, correction, deletion, restriction, or a portable copy of your personal data, and object to processing based on our legitimate interests, including the anonymised datasets above, by emailing support@run.cloud. We do not make automated decisions about you with legal or similarly significant effects.

You can complain to Sweden’s data protection authority, Integritetsskyddsmyndigheten (IMY, imy.se), or the authority where you live.

7. Cookies, children, and changes

Red uses only the browser storage needed to keep you signed in; there is no tracking or advertising. Red is not intended for anyone under 18. We will update the date above when this policy changes and give notice of material changes.