Runway procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ audit our internal processes for compliance with legal and contractual requirements or our internal policies;” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “Please note that certain information may be exempt from such requests under applicable law. For example, we may retain certain information for legal compliance and to secure the Service. We may need certain information to provide the Service to you; if you ask us to delete it, you may no longer be able to use the Service.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Delete your account. You can choose to delete your account by following the instructions here .” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “we will retain face scans and voiceprints for no longer than the earlier of the date the initial purpose for collecting the data is satisfied or within three years of your last interaction with us.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We will retain your information for only as long as necessary to provide the Service and for the other legitimate business purposes set out in this Policy such as safety, security, compliance, and dispute resolution. In determining how long to retain information, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we process the information, applicable legal requirements, and our legitimate interests. For example, we will retain face scans and voiceprints for no longer than the earlier of the date the initial purpose for collecting the data is satisfied or within three years of your last interaction with us.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Please see the Data retention section below.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We are headquartered in the United States and may use vendors or service providers that operate in other countries. By using the Service, or providing us with any information, you consent to the collection, processing, maintenance, and transfer of such information in and to the United States and other applicable countries in which the privacy laws may not be as comprehensive as, or equivalent to, those in the country where you reside and/or are a citizen.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Affiliates. We may disclose information about you to our affiliates for the purposes identified in this Privacy Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Inferences drawn from non-sensitive information we collect Vendors Affiliates Entities for legal and safety purposes As consistent with your consent Provide the Service Communicate with you Analyze and improve the Service Marketing Legal and safety Business transfers As authorized by you” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Business transferees. We may disclose information about you in the context of actual or prospective business transactions ( e.g., investments in Runway, financing of Runway, public stock offerings, or the sale, transfer or merger of all or part of our business, assets or shares), for example, we may need to disclose certain information about you to prospective counterparties and their advisers. We may also disclose information about you to an acquirer, successor, or assignee of Runway as part of any merger, acquisition, sale of assets, or similar transaction, and/or in the event of an insolvency, bankruptcy, or receivership in which information about you is transferred to one or more unaffiliated parties as one of our business assets.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas, investigations or requests from government authorities;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Vendors. Other parties like Amazon Web Services that provide, secure, promote, and improve our services.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Advertising and analytics partners. We may disclose information about you to our advertising and analytics partners to help us better understand your use of the Service, customize the Service, and provide you with advertising that we think will be of interest to you. Some analytics providers we partner with may provide specific opt-out mechanisms. For example, you may opt out of having Google Analytics use your information for analytics by installing the Google Analytics Opt-out Browser Add-on .” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Data we collect from others. We may collect information about you or others through our affiliates or through non-affiliated parties. For example, we may offer features that help users invite their friends or contacts to use the Service, and we may collect contact details about these invitees so we can deliver their invitations. Please do not refer someone to us or share their contact details with us unless you have their permission to do so.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims);” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may collect information about you or others through our affiliates or through non-affiliated parties.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ California’s Shine the Light Law (CA Civil Code § 1798.83) allows residents with which a business has an established business relationship to request a list of the third parties to which the business has disclosed certain “personal information” (as specifically defined by the Shine the Light law) during the preceding year where the business knows or reasonably should know that the third parties used the personal information for the third parties’ own "direct marketing purposes,” defined by the Shine the Light law as the use of personal information to solicit or induce a purchase, rental, lease, or exchange of products, goods, property, or services directly to individuals by means of the mail, telephone, or electronic mail for their personal, family, or household purposes. However, the business is not required to provide this information where the business adopts and discloses, in its privacy policy, a policy of not disclosing “personal information” to third parties for their “direct marketing purposes” 1) unless the resident first affirmatively agrees or 2) if the resident has exercised an option that prevents that information from being disclosed. Runway maintains such a policy and thus is not required to provide this information. Runway does not engage in any disclosures in which it knows or reasonably should know that the third parties use the personal information for their own direct marketing purposes as defined by Shine the Light. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may disclose information about you to certain other parties, as described below, to provide, build, protect, improve, and promote our products and as required by law.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Category of Personal and/or Sensitive Personal Information Categories of Other Parties to Whom We Disclose Purposes of Use Identifiers and other contact information (e.g. name, email address, or social network account and profile data)” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | Paid | medium | “Payment processors. Any payment card information you use to make a purchase on the Service is collected and processed directly by our payment processors, such as Stripe. Stripe may use your payment data in accordance with its privacy policy, https://stripe.com/privacy .” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.