1. Who We Are
Runvax is operated by Runvax. We are based in Lagos, Nigeria. Contact: info@runvax.com.
2. What Data We Collect
- Account data: name, email address, hashed password, subscription plan.
- Profile data: business name, WhatsApp number, city, SMTP credentials (encrypted at rest), bank details you choose to store.
- Prospect data: businesses you save, notes, reminders, outreach history, pipeline stage.
- Outreach signals: when you send a business a message through Runvax, we record which business was contacted and when, so we can show all users how heavily a lead has already been contacted. See section 5.
- Usage data: AI feature usage counts, daily outreach logs, search history (industry/location only — no personal data of prospects).
- Payment data: transaction references and plan status via Paystack. We do not store card numbers.
3. How We Use Your Data
- To provide and operate the Service.
- To personalise AI-generated content with your profile (name, business, city, etc.).
- To send transactional emails (verification, password reset, email outreach you trigger).
- To enforce plan limits and process subscription payments via Paystack.
- To improve the Service (aggregate, anonymised analytics only).
4. Data Sharing
We do not sell your personal data. We share data only with:
- Paystack — to process payments.
- OpenAI — your prompts are sent to OpenAI to generate AI content. OpenAI's API data policy applies.
- Google Maps API — search queries (industry + location) are sent to Google to fetch business listings.
- Your SMTP provider — when you send emails through the platform, they pass through the SMTP server you configure.
5. Shared Outreach Data (Lead Saturation)
Runvax shows every user how many other Runvax users have already contacted a business, so you can judge whether a lead is worth pursuing. This works because all accounts contribute to it.
What is shared with other users:
- The public identifier of the business (its Google Places listing).
- A count of how many distinct users have messaged it.
- How recently the most recent message was sent.
What is never shared with other users:
- Your name, email address, business name or any other identifying detail.
- The content of your messages, your notes, or your pipeline.
- Which specific users make up a count. The figure is anonymous and cannot be traced back to individuals.
Contacting the same business more than once still counts as one user, and counts are only ever displayed in aggregate. This applies to all accounts on all plans — every user both contributes to and benefits from the same data. If you delete your account, your contributions are removed from these counts.
6. Data Retention
We retain your data for as long as your account is active. If you delete your account, your data is permanently deleted within 30 days. Payment records may be retained for 7 years for legal compliance.
7. Security
Passwords are hashed with bcrypt. SMTP passwords are stored encrypted. All traffic is encrypted via HTTPS/TLS. We use Hepsia cloud hosting (UK) with daily backups.
8. Your Rights
- Access: Request a copy of your data.
- Correction: Update your profile at any time in Settings.
- Deletion: Request account deletion via email.
- Portability: Export your prospects as CSV from the Pipeline page.
To exercise these rights, email info@runvax.com.
9. Cookies
We use a single session cookie (NextAuth) to keep you signed in. We do not use tracking or advertising cookies.
10. Changes to This Policy
We may update this policy. Significant changes will be notified via email. Continued use of the Service after changes constitutes acceptance.
