Legal
Privacy policy
Last updated
Rune is a service for running maturity assessments, provided by Select Red Ltd, a company registered in England and Wales (company number 17009148), registered office Lian, Dark Lane, Camelford, Cornwall PL32 9UQ. In this policy, "we" and "us" mean Select Red Ltd.
This policy explains how we handle personal data on runehq.co.uk and in the Rune app at app.runehq.co.uk. If you have a question, email info@runehq.co.uk.
Who is responsible for your data
How we handle personal data depends on whose data it is.
- Our customers' accounts. For the people who sign up to Rune and the organisations they work for, we are the controller: we decide how and why that data is used.
- The content our customers put into Rune. When a customer runs an assessment, the questionnaire answers, team and process names, blockers and similar content belong to that customer. The customer is the controller and we are their processor: we handle that data only on their instructions, to provide Rune to them. If you answered a questionnaire, the organisation that sent you the link is responsible for your answers, and you should contact them first.
- Visitors to our website. For the cookie-free visit counts described below, we are the controller.
What we collect
If you have a Rune account
- Your name, email address and a securely hashed version of your password. We never store your password itself.
- Your workspace name, your plan, and your sign-in history (when you last signed in).
- Billing details. Payments are handled by Stripe. We never see or store your card number. We keep a reference to your Stripe customer and subscription, your plan, and when it renews.
- Branding you upload, such as logos and colours.
- Messages you send us, for example by email.
Content our customers put into Rune
- Names of engagements, clients, teams and business processes, and optionally the name of each one's lead.
- Blockers: what is in the way, and optionally an owner's name, email address, due date and notes.
- Respondent links: each link can carry a name or role the customer types in, such as "Process owner". Rune does not ask for or store respondents' email addresses; customers send the links themselves from their own email or chat.
- Questionnaire answers and any optional comments.
Rune is designed so that individual answers are never shown to anyone. Customers see each team's combined score, and only once at least three people have answered; the spread between the lowest and highest answer appears only once five have.
Visitors to runehq.co.uk and the app
We count visits without cookies and without storing anything on your device. For each page view we record the page, the day, and the website that referred you (for example linkedin.com). To count unique visitors, we combine your IP address and browser details with a value that changes every day, and keep only a one-way code made from them, so you cannot be identified or followed from one day to the next. Browsers that send a "do not track" or "global privacy control" signal are not counted at all.
Our hosting provider also keeps standard server logs, including IP addresses, to keep the service secure and working. These are kept for a limited period and then deleted in the normal course of the hosting service.
Cookies and similar storage
Rune uses a single cookie, rune_session, which keeps you signed in to the app. It is strictly necessary and is removed when you sign out or after 8 hours.
The app also stores two small items in your browser: whether you have hidden the "Get started" checklist, and, for questionnaires embedded on a website, a code that lets you continue your answers after a page reload. Neither is used to track you.
The marketing website sets no cookies.
Why we use your data, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing your account and the Rune service | Contract |
| Taking payment and managing subscriptions | Contract |
| Service emails: welcome, password reset, trial reminders | Contract and legitimate interests |
| Keeping Rune secure, preventing abuse, fixing faults | Legitimate interests |
| Counting visits to improve the website and app | Legitimate interests |
| Keeping accounting and tax records | Legal obligation |
We do not sell personal data, we do not use it for advertising, and we do not use our customers' content to train AI models.
Who we share data with
We use a small number of suppliers ("sub-processors") to run Rune:
| Supplier | What they do | Where |
|---|---|---|
| Clook Internet (sub6 Limited) | Hosts the website, the app, its database and the email we send | United Kingdom |
| Stripe | Takes card payments and manages subscriptions | United Kingdom, European Union and United States |
Stripe may transfer data to the United States. Where data leaves the UK, it is protected by the safeguards UK law requires, such as the UK International Data Transfer Addendum.
If a customer connects an engagement to their own Jira or Azure DevOps, Rune sends the blockers they choose to send (title, team, capability, owner, due date and notes) to that tool, on their instruction. That tool is the customer's own, under their agreement with its provider.
We may also share data if the law requires it, or with professional advisers under a duty of confidentiality.
How long we keep data
- Active accounts: for as long as the account exists.
- After a trial ends or a subscription is cancelled: we keep the workspace so you can come back to it, for 12 months, after which it is deleted.
- Deleting a workspace: the owner can delete a workspace and everything in it at any time, under Settings → Delete workspace. This takes effect immediately in the live service. Copies in the hosting provider's backups are overwritten in their normal backup cycle.
- Billing records: kept for six years, as UK tax law requires.
- Visit counts: kept for up to 400 days.
- Password reset links: expire after one hour.
Your rights
Under UK data protection law you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable form. To use any of these rights, email info@runehq.co.uk. We will respond within one month.
If your data is in Rune because an organisation asked you to answer a questionnaire, please contact that organisation first: they control those answers. We will help them respond to you.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.
Changes to this policy
If we make significant changes, we will update the date at the top of this page and tell account holders by email.
Questions about this page: info@runehq.co.uk. See also Privacy · Terms · Security and data.