Privacy Policy

Small Scale Labs AB (“Run Cloud,” “we,” “us,” or “our”) provides cloud infrastructure for developers and AI agents: Linux sandboxes, iOS simulators and Android emulators, and cloud builds. We are established in Sweden, at Agavägen 19, 181 55, Lidingö, Sweden.

This Privacy Policy explains how we collect, use, share, and otherwise process personal data from users of run.cloud, our dashboard, our CLI and SDKs, and the related services (together, the “Services”). It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (FADP), and applicable U.S. federal and state privacy laws.

By using the Services you acknowledge this policy. If you need a data processing agreement for your own compliance review, write to us and we will put one in place.

Three kinds of data are described in this policy, and they are treated differently.

• Personal Data means information relating to an identified or identifiable person, such as your name, email address, IP address, device information, authentication credentials, and usage records.
• Customer Data means everything inside your sandboxes: your code, files, disk contents, snapshots, installed packages, and anything you or your agents put there. We process Customer Data on your behalf, to run the machine you asked us to run.
• Service Data means data about how the Services are operated, secured, metered, and supported, such as resource usage, billing meters, security telemetry, and diagnostic records.

Your sandbox contents belong to you. No one at Run Cloud reads the code, files, or disk contents of your sandboxes except to resolve a support request you have raised, to investigate suspected abuse or a security incident, or where we are legally compelled to do so.

We do not use your code, files, or prompts to train models, and we do not sell them, share them for advertising, or hand them to anyone for their own purposes.

Your interactive sessions are not recorded. When you attach a shell or run a command, the input and output stream directly between you and your sandbox. We record that a session opened and closed, and how long it ran, so we can meter and debug the platform. We do not record the keystrokes you type or the output you receive.

Two honest exceptions, so that the commitment above means what it says. First, automated systems necessarily touch Customer Data to run the product at all, by creating and storing snapshots, moving disk images, and measuring resource usage for billing. That is machine processing, not people reading your code. Second, each sandbox writes a console log, the machine's own boot and diagnostic output. We keep it for a short period after the sandbox stops so that you can debug a crash after the fact, and it is available to you through the logs API.

If an operation fails, limited technical details of the failing call, which can include the command that was run, are sent to our internal alerting so an engineer can respond. Environment variable values are deliberately excluded from those alerts.

We collect the following categories of information.

• Account information. Your email address and name. If you sign in with a third-party identity provider, we also receive your profile picture and an identifier from that provider. You can change your display name at any time.
• Sign-in and session information. Session records including your IP address and browser or client user agent, so we can keep you signed in, show you your active sessions, and detect suspicious access.
• Credentials. API keys and CLI credentials. API keys are stored only as a cryptographic hash, so we cannot recover the original value and will never show it to you twice. We keep the key's label, its first characters so you can recognise it, and when it was last used.
• Organisation information. Organisation and team names, membership and roles, and the email addresses of people you invite.
• Billing information. Plan, usage totals, credit balance, invoices, and billing address. Card details are collected and stored by our payment processor. They never reach our servers.
• Sandbox and resource metadata. Sandbox and box identifiers, names you choose, assigned hostnames and any custom domains you connect, SSH public keys and their fingerprints, container image names, CPU and memory sizing, region, lifecycle state, and per-second metering records.
• Uploaded assets. Files you upload, such as application builds. We store the original filename, size, and type, along with any simulator session recordings you choose to create.
• Secrets you store with us. Values you save as sandbox secrets are encrypted before they are written and are write-only: no API route returns a stored secret value, and we do not read them.
• Support and correspondence. Messages you send us and the context you attach to them.
• Customer Data. The contents of your sandboxes, as described in Your sandbox contents.

We use the information we collect to:

• Create and run the sandboxes, simulators, and builds you ask for.
• Authenticate you and keep your account and organisation secure.
• Meter resource usage, calculate charges, and process payments.
• Detect, investigate, and prevent abuse, fraud, and security incidents.
• Diagnose failures and keep the platform reliable.
• Respond to your support requests.
• Send service messages such as billing notices, security alerts, and material changes to the Services.
• Meet our legal, tax, and accounting obligations.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract. To provide the Services you signed up for, run your workloads, and bill you for them.
• Legitimate interests. To secure the platform, prevent abuse and fraud, diagnose failures, and improve the Services, where those interests are not overridden by your rights.
• Legal obligation. To meet accounting, tax, and other statutory requirements.
• Consent. Where we ask for it, such as optional marketing email. You can withdraw consent at any time.

There is no AI model in the Run Cloud request path. Running a sandbox, executing a command, taking a snapshot, or streaming a simulator does not send your code or your commands to any AI provider.

Some sandbox images ship with coding-agent CLIs preinstalled. When you use one, it talks to whichever model provider you configure, using your own API key, from inside your own sandbox. That traffic is between you and that provider, under their terms and their privacy policy. We are not a party to it and we do not intercept it.

We do not use Customer Data to train models, ours or anyone else's.

We do not sell your data. We share it only in the circumstances below, and only to the extent needed.

• Service providers. We rely on a small set of vendors to operate the platform. Each is engaged under a written data processing agreement meeting the requirements of Article 28 GDPR, which obliges them to act only on our instructions, to apply appropriate technical and organisational security measures, and to engage their own sub-processors only under equivalent terms. They fall into these categories: cloud infrastructure and hosting; object storage; payment processing; transactional email delivery; and operational monitoring and alerting.
• Identity providers you choose. If you sign in through a third-party provider, that provider processes the sign-in under its own privacy policy.
• Your organisation. If you join an organisation, its administrators can see your membership, role, and the resources you create within it.
• Legal and safety. Where we are legally required to, or where it is necessary to investigate abuse or protect the rights and safety of our users. Where we are permitted to notify you of a legally compelled disclosure, we will.
• Business transfers. In a merger, acquisition, or sale of assets, subject to this policy continuing to apply to the transferred data.

We publish the categories rather than the individual vendors. Customers who need the specific list, for a vendor review or a data protection assessment, can request it from [email protected].

Your sandboxes and simulators run on hardware in the European Union. Sandbox compute, memory, and disk are hosted in EU data centres, currently in Finland and Germany, operated by hosting providers we engage under Article 28 data processing agreements. The iOS simulators and Android emulators run on our own hardware in Sweden. Snapshots and container images are held in encrypted object storage.

Some data is processed in the United States. That covers account, organisation, and billing records, operational telemetry, and the assets you upload, such as application builds and simulator recordings. So while your sandboxes themselves run in Europe, a transfer outside the EEA does take place for those categories, and you should assume any file you upload to us is stored in the United States.

Where personal data is transferred out of the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on:

• EU Standard Contractual Clauses (Module 2, Controller-to-Processor) under Commission Decision 2021/914.
• The UK International Data Transfer Addendum (version B1.0, issued under s.119A of the Data Protection Act 2018).
• The Swiss Addendum adapting those clauses to the revised FADP, naming the FDPIC as competent authority.

These are backed by technical measures: encryption in transit and at rest, access controls, and contractual restrictions on every provider we use.

run.cloud runs no analytics, no advertising trackers, and no third-party scripts. There is nothing to consent to, which is why you will not find a cookie banner here.

The cookies we do set are strictly necessary, which is the category that does not require consent. There are two kinds.

When you reach a running box through one of our preview subdomains, we set a cookie holding a short-lived access ticket. It expires after eight hours and is marked HttpOnly, Secure, and SameSite=Lax. It exists purely to check that you are allowed through to your own sandbox, and it is stripped from the request before it reaches the sandbox itself.

Signing in sets session and sign-in state cookies on our authentication domain. If you sign in through a third-party identity provider, one of these carries the state needed to complete that exchange safely. They keep you signed in and protect the sign-in flow from being tampered with, and nothing else.

The dashboard keeps your session token in your browser's local storage rather than in a cookie, and sends it explicitly with each API call. Signing out removes it.

We protect the Services with the following measures, among others:

• Hardware-level isolation. Every sandbox is a separate virtual machine with its own kernel, isolated by the processor's virtualisation features rather than by shared-kernel containers.
• Encryption. Traffic to and between our services is encrypted in transit. Account, organisation, and billing records in our managed database, and snapshots and images in object storage, are encrypted at rest.
• Credential handling. API keys, CLI codes, and one-time sign-in codes are stored as hashes, never in a recoverable form. Secrets you store are encrypted with a key held in a managed key management service and are write-only through the API.
• Access control. Internal access to production is restricted to the people who need it, and privileged operations are logged.
• Tenant separation. Every request is authorised against the organisation that owns the resource. Stored snapshot data is content-addressed and deduplicated for efficiency, so identical blocks may be stored once and referenced by more than one snapshot; access to any snapshot remains restricted to the organisation that owns it.

No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please write to [email protected].

We keep personal data for as long as necessary to provide the Services and to fulfil the purposes described in this policy, after which it is deleted or anonymised. How long that is depends on the category:

• Account and organisation records are kept while your account is open.
• Billing and invoice records are kept for as long as accounting and tax law requires, which is longer than the life of your account.
• Sandboxes and their snapshots follow the lifecycle you configure. Sandboxes are paused when idle and eventually destroyed along with their parked state; snapshots you create explicitly are kept until you delete them. The current timers are documented in our documentation.
• Console and diagnostic logs are kept for a short period so that a crashed sandbox can still be debugged, then deleted.
• Operational and security logs are kept for a limited period appropriate to investigating incidents.

Backups are retained on their own cycle, so data can persist in a backup for a period after it has been deleted from the live system. When you close your account we delete or anonymise your personal data, except where we must keep it to meet a legal obligation or to resolve a dispute.

Depending on where you live, you have some or all of the following rights over your personal data:

• Access. To know what we hold about you and get a copy.
• Rectification. To correct data that is wrong or incomplete.
• Erasure. To have your data deleted.
• Restriction and objection. To limit or object to processing based on our legitimate interests.
• Portability. To receive your data in a machine-readable format.
• Withdraw consent. Where processing is based on consent.
• Non-discrimination. We will not degrade your service for exercising these rights.

You can update your name and manage your API keys, organisations, and resources directly in the dashboard. For anything else, write to [email protected]. We respond within the period the applicable law requires (one month under the GDPR, 45 days under U.S. state privacy laws), and may need to verify your identity first.

We do not use your data for automated decision-making that produces legal or similarly significant effects.

If you are in the EEA and are not satisfied with our response, you can complain to your local supervisory authority. Ours is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). UK residents may complain to the ICO, and Swiss residents to the FDPIC.

The Services are built for developers and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to [email protected] and we will delete it.

We may update this policy as the Services change. When we do, we update the date at the top of this page. If a change materially affects how we handle your personal data, we will give you notice, by email or through the Services, before it takes effect.

For any question about this policy, or to exercise your rights, contact us at [email protected].

Small Scale Labs AB
Agavägen 19, 181 55, Lidingö, Sweden