1. Overview
Rundoo, Inc. (“the Company,” “we,” “us,” or “our”) runs gorundoo.com (the “Marketing Site”) and offers the Rundoo point-of-sale and back-office platform for independent hardware and supply stores (the “POS Service”). This Privacy Policy explains the information the Company collects, its uses, and your available choices. It covers information gathered through the Marketing Site, direct communications with us, and the POS Service.
The Company is located at 702 Marshall Street, Suite 300, Redwood City, CA 94063. Contact: [email protected].
This Policy separates the Company’s two data settings: information gathered from visitors and prospective customers through the Marketing Site, and information handled through the POS Service for subscribing hardware and supply store operators (“Merchants”).
2. Information Collected
2.1 Marketing Site Visitors
When you visit gorundoo.com, we collect:
- Details you voluntarily provide, such as name, email address, phone number, and store name, through a demo request, contact form, or updates subscription;
- Optional business details, including store type, number of locations, and current POS system;
- The messages you submit to us;
- Automatically gathered technical data: IP address, approximate city or region, browser, operating system, device class, pages viewed, referring URLs, time on page, and cookie identifiers (see Section 5).
2.2 Rundoo POS Service Data
When a Merchant uses Rundoo POS, the Company handles information for that Merchant, including:
- Sales records, including items, quantities, unit types (each, linear foot, board foot, weight), prices, and totals;
- Customer and contractor details entered by Merchant staff, including names and contact details used for house-account billing and special-order tracking;
- Contractor house-account balances, invoices, and payment status;
- Payment information: the Company handles card transactions through POS checkout using technical controls consistent with PCI-DSS standards. After authorization, the Company does not retain full primary account numbers; tokenized references support later reconciliation.
- Inventory data: stock levels, yard and counter locations, purchase orders, and supplier cost inputs used by the AI pricing engine;
- Store settings, including register assignments, pricing rules, and staff user accounts.
Each Merchant primarily controls its customers’ data in the POS Service. The Company handles that data as the Merchant’s service provider, following the Merchant’s instructions to operate and improve that Merchant’s POS Service. Without the Merchant’s explicit written agreement, the Company does not use Merchant transaction data to train AI models or conduct analytics across customers.
2.3 Children’s Data
The Marketing Site and POS Service serve business operators and are not intended for anyone under 18. We do not knowingly collect children’s personal information. If you believe a child sent us information, email [email protected] and we will delete it.
3. Information Uses
For Marketing Site information, the Company uses it to:
- Answer demo requests, questions, and other inquiries;
- Run, maintain, and enhance the Marketing Site;
- Send service notices and, where required with consent, marketing messages about Rundoo;
- Identify, examine, and stop fraud or misuse;
- Meet legal duties.
For POS Service data, the Company uses Merchant data solely to:
- Provide POS checkout, inventory management, AI pricing engine, and house-account functions to the subscribing Merchant;
- Support and onboard the Merchant;
- Preserve data accuracy, find errors, and improve POS Service reliability;
- Meet legal duties, including answering lawful authority requests.
We do not sell personal information for monetary value. If state law regards certain advertising arrangements as a “sale” or “share,” Section 9 provides California-specific disclosures.
4. Information Sharing
We share personal information only with:
- Providers serving us, including hosting, email delivery, payment tokenization, and anonymized analytics providers, under contracts limiting data use;
- Authorities when law or court order requires it, or to protect the Company, Merchants, the public, or their rights, safety, or property;
- A successor after a merger, acquisition, or asset sale, subject to this Policy.
We do not sell personal information to third parties or provide Merchant transaction data to other Merchants or advertising networks.
5. Cookies and Tracking
The Marketing Site uses cookies and similar tools to operate, retain preferences, and measure aggregate use. The Rundoo POS application uses session cookies needed for authentication and checkout state, and POS Service operation. Details and choices appear in our Cookie Policy.
6. Data Retention
Marketing Site contact and demo-request records remain for 36 months after last contact, then are deleted unless a subscription began. Inactive marketing contacts are removed after 24 months. Server access logs remain for 90 days, then are aggregated and anonymized.
POS transaction and inventory data remains throughout the Merchant’s active subscription and up to 12 months after termination to support exports. Merchants may request earlier deletion in writing at [email protected]. Certain billing and contract records remain as required by applicable tax and accounting law.
7. Security
The Company maintains administrative, technical, and physical safeguards intended to protect personal information. Safeguards include TLS encryption for data in transit, restricted databases with role-based access controls, and payment-card controls consistent with PCI-DSS standards. The Company does not claim PCI-DSS certification. Each Merchant and its payment processor remain responsible for card-processing PCI compliance obligations. No system is completely secure, and absolute protection from every threat cannot be guaranteed.
8. General Rights
Depending on where you live, you may have access, correction, deletion, and certain processing-limitation rights. Marketing Site visitors may request them at [email protected]. Requests concerning Merchant-side customer data should first go to the Merchant, its controller; the Company will assist the Merchant with fulfillment. We respond within the period applicable law requires.
9. California Residents (CCPA / CPRA)
The California Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”) grant California residents specific rights concerning their personal information. This section adds to the rest of this Policy.
9.1 Categories Collected
During the past 12 months, we collected these Cal. Civ. Code §1798.140 categories: identifiers, including name, email, IP address, and account credentials; commercial information, including service inquiries, demo requests, and subscription records; financial information, including payment card data and POS Service house-account records, which are sensitive personal information as described below; internet activity, including gorundoo.com browsing; and inferences from this information for service improvement. Through POS Service operations, the Company also handles Merchant operators’ financial account information, including card details and contractor balances. Under Cal. Civ. Code §1798.140(ae), payment card information and financial account access data are sensitive personal information.
9.2 Sources, Purposes, Disclosure
We receive Marketing Site information from you and automated site tools. Merchant operators and staff provide POS Service information during ordinary retail operations. We use it to operate and improve the Service, communicate, and satisfy legal duties. We disclose it only to contracted service providers and authorities when legally required.
9.3 Your CCPA / CPRA Rights
- Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
- Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
- Right to Correct: request correction of inaccurate personal information.
- Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
- Right to Limit Use of Sensitive PI: payment card information and financial account data processed through the POS Service are used solely for the checkout and reconciliation functions the Merchant has contracted for. This sensitive personal information is not used for advertising, cross-context profiling, or any purpose beyond operating the POS Service.
- Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.
9.4 How to Exercise
Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.
9.5 Authorized Agents
You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.
9.6 "Shine the Light"
California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.
9.7 Do Not Track and Global Privacy Control
Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Marketing Site. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.
10. Policy Changes
This Policy may change periodically. Material revisions will carry a new “Last updated” date and, when appropriate, a Marketing Site notice or direct communication to Merchants.
11. Contact
Send questions, requests, or complaints to:
Rundoo, Inc.702 Marshall Street, Suite 300
Redwood City, CA 94063
Email: [email protected]
Phone: +1 (650) 551-0178