Privacy policy
Last updated
This policy explains what personal data ClickRuntime collects, why, who receives it, how long we keep it, and the choices you have. It applies to the ClickRuntime website (clickruntime.com), the signed-in app, and the ClickRuntime connector for AI assistants such as ChatGPT and Claude.
ClickRuntime is operated by Imarti Creations Private Limited, a company registered in Delhi, India ("we", "us"). Contact: hello@clickruntime.com.
Summary#
- We collect what we need to run your automations: your account email, your workspace, the automations you create, and records of their runs.
- We don't receive or store your conversations with your AI assistant. We only receive the tool requests your assistant sends us, such as a draft automation or a request to list runs.
- Secrets (API keys) you save are encrypted, write-only, and never sent to the AI assistant.
- We don't sell personal data and don't use it for advertising.
- You can delete your account and data yourself at any time in Settings, or ask us by email.
1. Data we collect#
Account data#
- Email address and an internal account identifier.
- Sign-in method. If you sign in with Google, Google's sign-in is handled by Firebase Authentication (a Google service). Google and Firebase process your Google profile (such as name, email and profile photo) to sign you in; ClickRuntime stores your email address, a Firebase user identifier and which sign-in method you used. If you sign in with an email link, the link is sent by Firebase; ClickRuntime does not store a password for you.
- Email verification status.
Workspace and team data#
- Workspace name, the members of the workspace, their email addresses and roles (owner, admin, write, read).
- Invite links you create.
- An activity record of workspace changes such as members joining, role changes, name changes and plan changes.
Automation data#
- Automations: name, plain-language summary, status, schedule and timezone, and setup requirements.
- Scripts: the code of each automation and its previous versions, and who created each version.
- Secrets: values you save, such as API keys. These are encrypted with AES-256-GCM before storage, can't be read back through the application or API, and are only decrypted for the run of the automation that uses them. We keep the last four characters to help you recognise a key.
- Connections: when you connect an account such as Slack or Google, we store the access token (and for Google the refresh token) encrypted, plus account details such as the connected workspace name or Google account email, the account identifier and the granted permissions. Tokens are only used when your automations call that service.
- Notifications: when an automation sends you an email (
notify.email_me) or a Slack message (notify.slack), we keep a record of the recipient, subject, time and delivery status to enforce limits and help you debug. - Run records: status, timing, attempt number, whether the run counted toward your plan, the result, error messages and logs. The runner masks the values of your secrets in logs, results and errors before they're stored.
- Remembered state: values your scripts choose to save between runs.
- Incoming events: when a service sends a request to an automation's trigger link, we store the request body (up to 1 MB), its headers and the time it arrived so you can inspect it and debug. Sensitive headers (such as authorization, cookies and signatures) are masked before the event is stored.
What these contain depends on what you automate. Please don't build automations that collect sensitive data: our terms prohibit collecting health, government ID or payment card data.
AI assistant data#
- When you connect ClickRuntime to an AI assistant (such as ChatGPT, Claude, Claude Code or Cursor), we keep a record of the authorization: the assistant's client identifier and name, the workspace you chose, the permissions granted, and hashed access and refresh tokens with their expiry.
- When the assistant calls ClickRuntime's tools, we receive the inputs it sends (for example the automation name, summary, schedule and script) and return outputs (for example run status). We process these to provide the service, and they become part of your automation data above.
- We do not receive or store your conversation transcripts. Each assistant receives only the outputs of the ClickRuntime tools it calls, such as automation summaries, setup status and run results. It never receives your saved secrets or connection tokens.
- Your conversations are handled by the company that provides your assistant under its own privacy policy, not this one: for example OpenAI for ChatGPT, and Anthropic for Claude and Claude Code.
Billing data#
- If you subscribe, payment is handled by Stripe. We store your Stripe customer and subscription identifiers, plan, status and billing period. We never see or store your full card number.
Website usage data#
- Cookies and similar storage: see Cookies for the full list.
- Analytics: we use Google Analytics and PostHog to understand how the website is used (pages visited, device and browser type, approximate location derived from IP address, and in the signed-in app your account identifier and email). PostHog may also record sessions (clicks, scrolling and page changes) to help us find usability problems; every form field, including secret values, is masked and never recorded.
- Product analytics: our servers send PostHog a record of key steps in using ClickRuntime (connecting an assistant, saving a draft, finishing setup, turning an automation on, and whether its runs succeed or fail) with your account and workspace identifiers, which assistant was used, the kind of automation, and how you first found us. These records never include scripts, secrets, events, run output or logs. We use them to find where people get stuck and fix it.
- Error monitoring: we use Sentry to diagnose crashes; error reports can include technical details of the request and browser.
- Security records: we store the IP address an account was created from, the IP address that sent each incoming event, and for each run the outbound connections your script made (destination host, IP address and port, counts and times, and the IP address the run used). We use these only to rate-limit, detect abuse and answer abuse reports. Other IP addresses are processed to deliver the service and are not stored in our database.
2. Why we use it#
| Purpose | Data | Legal basis (where applicable) |
|---|---|---|
| Create and secure your account, sign you in | Account data, session cookie | Performing our contract with you |
| Store and run your automations, deliver email and Slack messages they send | Automation data, connections, secrets | Performing our contract |
| Let an AI assistant you connect act for you | Authorization records, tool inputs and outputs | Performing our contract; your consent when you connect |
| Show run history, help you debug | Run records, incoming events, logs | Performing our contract |
| Bill you and enforce plan limits | Billing data, run counts | Performing our contract; legal obligations (tax and accounting) |
| Send service emails (welcome, verification, sign-in, run failure and account notices) and the emails your automations send you | Email address, automation name, run details, the subject and text your script sets | Performing our contract |
| Keep the service safe, prevent abuse, investigate misuse | All of the above as needed | Legitimate interests |
| Fix errors | Error data | Legitimate interests |
| Understand how the website is used, session replay | Analytics and replay data | Your consent where the law requires it (for example in the EU, EEA and UK); otherwise legitimate interests |
| Find where people get stuck setting up automations, and improve the product | Product analytics records | Legitimate interests |
Our staff may read your scripts to prevent abuse. When an automation is turned on or its script changes, a notice goes to our internal team chat (Slack) with the automation name, workspace, owner email, plan and the packages it declares, so staff can review the code in ClickRuntime. The notice doesn't contain the code.
We don't use your scripts, secrets, events or run data to train AI models, and we don't sell personal data or share it for advertising.
3. Who receives it#
We share personal data only with service providers that help us run ClickRuntime, under contracts that limit their use of it, or when the law requires.
| Recipient | What for |
|---|---|
| Amazon Web Services (AWS) | Hosting, database, file storage, running automations (Lambda), queues (SQS), schedules (EventBridge), and sending email through Amazon SES: run failure emails and the emails your automations send you with notify.email_me |
| Google (Firebase Authentication) | Sign-in with Google and email links |
| Google (Gmail, Sheets, Calendar), when you connect Google | Your automations read and write the Google data they're written to use. We request these permissions: openid and email (to identify the connected account), gmail.send (send email as you; it can't read your mailbox), spreadsheets (read and edit your Google Sheets) and calendar.events (view and edit events on your calendars). You can disconnect in the app or revoke access in your Google Account at any time. Our use of data from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. |
| Stripe | Payments and subscriptions |
| Slack | Delivering messages your automations send with notify.slack or the Slack API, when you connect Slack; also our internal team chat, which receives the script review notices described in section 2 (no code) |
| The AI assistants you connect (for example OpenAI's ChatGPT, Anthropic's Claude and Claude Code, or Cursor) | Tool outputs your assistant requests, such as automation summaries and run results, are returned to it. Nothing else is sent to it |
| Sentry | Error monitoring |
| Google Analytics, PostHog | Website analytics and, with PostHog, session replay (only with consent where required; see Cookies); PostHog also receives our server-side product analytics records |
| Services your automations call | Your scripts send data to the services you tell them to contact. Those services' own terms and policies apply. |
| Authorities | When required by law, or to protect rights, safety and the service |
If we're involved in a merger or acquisition, data may transfer to the new owner under this policy.
4. How long we keep it#
| Data | Retention |
|---|---|
| Account, workspace and membership data | While your account is active. Deleting your account in Settings removes it immediately; requests by email are completed within 30 days |
| Automations, scripts and versions, remembered state | Until you delete the automation or your account |
| Secrets and connection tokens | Until you delete them, disconnect, or delete your account |
| Run logs | 90 days, then deleted |
| Run records (status, timing, result and errors, without logs) | Kept for your run history and plan counts, and deleted when you delete the automation or your account |
| Notification records | Deleted with the automation or your account |
| Incoming events | 30 days, then deleted |
| Security records (signup IP address, incoming event IP addresses, run connection records) | 90 days, then deleted. Run connection records are kept for those 90 days even if you delete the automation or your account, so abuse reported later can still be traced |
| Abuse cases (what was found and the script involved) | As long as needed to prevent the same abuse, after a workspace is blocked |
| AI assistant authorization records | Access tokens expire after 1 hour and refresh tokens after 30 days; records are revoked when you disconnect and deleted with your account |
| Billing records | As long as required by tax and accounting law (generally 8 years in India) |
| Backups | Overwritten on a rolling basis, typically within 35 days |
5. Your choices and rights#
You can:
- See and change your data in the signed-in app: automations, runs, secrets, connections, members and billing.
- Delete individual automations (with their runs and events), secrets, connections and remembered state at any time in the app.
- Disconnect an assistant under Settings → AI assistants. This revokes ClickRuntime's tokens for that assistant immediately.
- Delete your account yourself under Settings, by typing your account email to confirm. Workspaces where you are the only owner or only member are deleted with all their automations, secrets, connections and assistant authorizations, and any paid subscription is cancelled. In workspaces that continue with other members, what you created is handed over to them. If you can't sign in, email hello@clickruntime.com from your account's email address instead; we'll confirm the request and complete it within 30 days.
- Get a copy of your personal data, or ask us to correct it, by emailing us.
- Object to or restrict some processing, and withdraw consent where we rely on it, including for analytics cookies through "Cookie settings" in the site footer or on this page.
Depending on where you live (for example under India's Digital Personal Data Protection Act, 2023, or the EU/UK GDPR) you may have additional rights, including complaining to your data protection authority. We'll respond to requests within 30 days.
6. Cookies#
We use a small number of necessary cookies and browser storage entries that the site can't work without. Analytics and session replay are optional. If you're in the EU, the EEA, the UK or Switzerland, or we can't tell where you are, they stay off until you choose "Accept all" or turn them on under "Customize". Elsewhere they're on by default, and you can switch them off. Either way you can change your choice at any time with "Cookie settings" in the site footer or on this page. Withdrawing consent stops Google Analytics and PostHog and removes their cookies from this site.
| Name | Type | Provider | Purpose | Category | Duration |
|---|---|---|---|---|---|
cr_session | Cookie (HTTP-only) | ClickRuntime | Keeps you signed in | Necessary | 14 days |
cr_consent | Cookie | ClickRuntime | Remembers your cookie choice (version, time, categories) | Necessary | 12 months |
cr_region | Cookie | ClickRuntime | Whether consent is needed before analytics, from your country (not stored by us) | Necessary | 1 day |
cr_invite_token | Local storage | ClickRuntime | Holds a workspace invite while you sign in | Necessary | Until sign-in completes |
cr_oauth_return | Session storage | ClickRuntime | Returns you to the right page after sign-in | Necessary | Until the tab closes |
firebase:authUser:*, firebaseLocalStorageDb | Local storage, IndexedDB | Google (Firebase) | Completes sign-in | Necessary | Until you sign out |
_ga, _ga_* | Cookie | Google Analytics | Distinguishes visitors and sessions | Analytics | Up to 2 years |
cr_ft | Cookie | ClickRuntime | Remembers how you first found us (campaign tags, the referring site's domain and the first page you opened), saved to your account if you sign up | Analytics | 90 days |
ph_*_posthog | Cookie and local storage | PostHog | Distinguishes visitors and sessions, holds analytics settings | Analytics | Up to 1 year |
ph_*_window_id, ph_*_primary_window_exists | Session storage | PostHog | Links a session replay to the browser tab | Session replay | Until the tab closes |
Sentry error monitoring doesn't set cookies or use browser storage, and we don't use Sentry session replay.
7. International transfers#
We're based in India and our infrastructure runs on AWS, which may store and process data in the United States and other countries. Our service providers may also process data outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.
8. Security#
Secrets and connection tokens are encrypted at rest. Traffic is encrypted in transit with HTTPS. Each automation runs in an isolated function with only its own secrets, and secret values are masked in logs. Access to production systems is limited to people who need it. No system is perfectly secure; if we learn of a breach affecting your data, we'll notify you and the authorities as the law requires.
9. Children#
ClickRuntime isn't intended for children under 13. You must be at least 13, or older if the law where you live sets a higher minimum age, to use it. If you're under 18 (or the age of majority where you live), you may use ClickRuntime only with the permission of a parent or guardian. We don't knowingly collect data from children under 13; if you believe a child has given us data, contact us and we'll delete it.
10. Changes#
If we change this policy we'll update the date above, and for significant changes we'll notify account holders by email or in the app before they take effect.
11. Contact#
Imarti Creations Private Limited, Delhi, India. Email hello@clickruntime.com. This address also reaches our grievance officer for the purposes of Indian law.