Privacy Policy

This Privacy Policy (the “Privacy Policy”) describes how Limrun Inc. (together with its affiliates, “Limrun,” “we,” “our,” or “us”) collects, uses, discloses, and otherwise processes information when you visit our website (the “Site”), use our cloud-based software development and testing platform, software tools, documentation, and related products and services, or otherwise interact with us (collectively, the “Services”). This Privacy Policy is incorporated by reference into our Terms of Service, available at https://limrun.com/terms (the “Terms of Service”). Capitalized terms not defined in this Privacy Policy have the meanings given in the Terms of Service. By using the Services, you acknowledge that you have read and understood this Privacy Policy. The Services are intended for users who are at least 18 years old.

What We Mean by Personal Information

For purposes of this Privacy Policy, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual. “Personal Information” also includes “personal data” and similar terms as defined under applicable data protection laws.

Information We Collect

Information You Provide To Us

When you use the Services or otherwise interact with us, we collect information that you provide directly. For example, we collect information when you create or administer an Account, authenticate through a supported identity provider or enterprise single sign-on system, subscribe to a paid plan, use the Services, upload Customer Content, subscribe to marketing communications, request support, request a demonstration, or otherwise communicate with us. You may choose not to provide requested information, but doing so may limit your ability to access or use some or all of the Services.

The information you provide directly may include the following information, which may constitute Personal Information alone or in combination with other information:

• Account, profile, and authentication information, including your email address, optional display name, organization identifier, and the identifier and basic profile information received from a supported identity provider. Limrun does not receive passwords from third-party identity providers;
• Business contact and support information, including your name, company, title, email address, inquiry, support communications, and any other information you choose to provide;
• Marketing information, including your email address and communication preferences when you subscribe to a newsletter, waitlist, or other product updates. You may unsubscribe by following the instructions in the applicable communication;
• Subscription, transaction, and billing information, including your selected plan, service usage, billing status, invoice details, and payment history. Payment card details are provided directly to Stripe and are not stored by Limrun;
• Customer Content, including source code, application builds, files, instructions, and, at your request, screenshots, screen recordings, device logs, and other session artifacts. Customer Content may contain Personal Information determined and provided by the applicable customer; and
• Any other information you choose to provide to us.

If you contact us, we may retain a record of the correspondence and our response.

Automatically Collected Information

We also collect certain technical and usage information automatically through application programming interfaces, software development kits, cookies, tags, and similar technologies. Alone or in combination with other information, this information may constitute Personal Information and may include:

• Device and technical data, including Internet Protocol address, browser type, device type, operating system, language, tool or software version, timestamps, and similar technical identifiers;
• Service and usage data, including pages viewed, interactions with the Site and Services, referring pages, commands or features used, duration and frequency of use, subscription plan, application-build and device-session activity, error information, and other operational events;
• Cookie, analytics, and advertising data, including cookie and similar identifiers, pre-signup Site activity that may be associated with a resulting Account, advertisement interactions, and conversion data; and
• Information collected through cookies and similar technologies, as described in the “How We Use Cookies and Other Technologies” section below.

Our analytics providers help us understand use of the Site, the Services, and our software tools. Our advertising partners, including Google Ads, X Ads, and Reddit Ads, may collect browser, device, cookie, advertisement-interaction, and conversion information through tags on the marketing Site, subject to applicable law and your available choices.

Customer Content Processed for Customers

Our customers may submit Customer Content to the Services, and Limrun generally processes that Customer Content on the customer’s behalf to provide the Services. The applicable customer determines what Customer Content is submitted and the purposes for which it is processed. If your Personal Information is contained in Customer Content submitted by a Limrun customer, you should direct requests concerning that information to the customer in the first instance. We will assist our customers with such requests as required by applicable law and our agreements with them.

Information from Third-Party Services

If you authenticate through Google, GitHub, Microsoft, or a customer-configured enterprise single sign-on provider, we receive basic profile and authentication information made available by that provider, such as your identifier, email address, and name. Stripe provides us with payment status, billing, and transaction information relating to your subscription. Analytics and advertising partners may provide us with analytics, attribution, and conversion information. The information those third parties collect and process is also subject to their own privacy policies.

How We Use Cookies and Other Technologies

We and our service providers use cookies and similar technologies on the Site and in connection with the Services. These technologies support authentication and security, remember preferences, help us understand how the Site and Services are used, associate pre-signup visits with resulting Accounts, and measure and improve advertising performance. Some cookies are required for the Site or Services to function; other cookies are used subject to applicable law and your available choices.

The following describes the categories of cookies we use and the choices available to you:

We and our service providers may also use pixel tags, web beacons, tags, or similar technologies in the Services and in HTML-formatted communications to measure engagement, understand Site and Service usage, measure the effectiveness of marketing campaigns, and compile usage and response statistics. Advertising platforms may use tags on the marketing Site for conversion measurement and, where permitted, targeted advertising.

Use of Collected Information

We use Personal Information to: (i) provide, operate, and maintain the Services; (ii) create, authenticate, and administer Accounts and customer organizations; (iii) process subscriptions, usage-based charges, and billing; (iv) compile code, operate simulators and cloud devices, and generate requested session artifacts; (v) provide customer support and respond to communications; (vi) analyze and improve the Site, Services, and software tools; (vii) secure the Services and detect, investigate, and prevent fraud, abuse, and security incidents; (viii) send transactional messages, service announcements, and security and billing notices; (ix) send newsletters and information about products and features, subject to applicable law and your choices; (x) measure marketing attribution and advertising performance; (xi) enforce our agreements and protect our rights and the rights of others; and (xii) comply with legal obligations and legal process.

We use automatically collected information to operate and secure the Services, troubleshoot and monitor performance, understand use of the Site and Services, improve our products, associate marketing-Site activity with resulting Accounts, and measure advertising and conversion performance. Our command-line tool may send command-usage events, tool version, operating system, an anonymous installation identifier, and the applicable customer-organization identifier to our analytics endpoint. This telemetry does not include Customer Content, credentials, or file contents, and an opt-out mechanism is available.

Legal Bases for Processing in the EEA, United Kingdom, and Switzerland

Where applicable data protection law requires a legal basis, we process Personal Information as necessary to perform a contract with you or take steps at your request; to comply with legal obligations; with your consent, including where required for marketing communications or non-essential cookies; and for our legitimate interests, including operating, securing, supporting, and improving the Services, communicating with customers and prospects, and protecting our rights, provided those interests are not overridden by your rights and interests. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Third Parties We Share Personal Information With

We may disclose Personal Information to the following categories of recipients for the purposes described in this Privacy Policy:

• Cloud infrastructure, hosting, and data-storage providers that host the Services, our databases, Customer Content, backups, logs, and related infrastructure in the European Union, the United States, Singapore, and other service regions. Our current subprocessor list is available at limrun.com/subprocessors;
• Service providers that support authentication, product and website analytics, email delivery, customer support, internal productivity and operations, security, and payment processing. These providers process only the categories of information reasonably necessary to provide their services. Stripe, for example, processes customer names, email addresses, payment details, and billing records;
• Advertising and measurement partners, including Google Ads, X Ads, and Reddit Ads, which may receive identifiers, Internet or network activity, advertisement-interaction, and conversion information through tags on the marketing Site, subject to applicable law and your available choices;
• Government authorities, law enforcement, courts, regulators, and other third parties when we believe disclosure is required by law or reasonably necessary to protect the rights, property, safety, or security of Limrun, our users, our customers, or others; and
• Professional advisers, potential transaction counterparties, and a successor or acquirer in connection with a financing, merger, acquisition, reorganization, sale of assets, bankruptcy, or similar corporate transaction, subject to appropriate confidentiality protections where applicable.

Links to Other Websites

The Site and Services may contain links to third-party websites and services, and the Services use third-party identity providers and Stripe-hosted payment pages. Limrun does not control those third-party services. Their collection, use, and disclosure of information are governed by their own privacy policies and terms, which we encourage you to review. Third parties may place their own cookies or similar technologies on your browser or device when you interact with their services.

Security

We use administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, use, alteration, and disclosure. Depending on the relevant system and data, these measures include encryption in transit; encryption at rest by our cloud-storage providers; short-lived, revocable credentials; least-privilege access controls; administrative interfaces that are not exposed to the public internet; tenant isolation; centralized secrets management; multi-factor authentication for critical systems; managed, encrypted employee devices; automated vulnerability and dependency scanning; and employee security-awareness training. No security measure is perfect, and we cannot guarantee absolute security.

Do Not Track Signals and Similar Mechanisms

Some browsers transmit “Do Not Track” (“DNT”) signals, and some browsers or browser extensions transmit opt-out preference signals, such as Global Privacy Control (“GPC”). We respond to both DNT and GPC signals by preventing analytics and advertising tags from loading when either signal is detected.

Managing Your Privacy

You may view your profile and edit your display name through the Services. Your Account email address is tied to your sign-in identity and may not be editable through the Services. You may delete uploaded application builds through the Services. To request access to, correction of, or deletion of Personal Information, or deletion of your Account, contact us at contact@limrun.com. Account deletion and broader erasure requests are handled manually and remain subject to applicable legal, billing, audit, security, and retention requirements. You may unsubscribe from marketing emails using the unsubscribe instructions in those emails.

Privacy Rights for EEA, United Kingdom, and Swiss Residents

If you are located in the European Economic Area, the United Kingdom, or Switzerland, applicable law may give you rights to access, correct, erase, or obtain a copy of Personal Information; restrict or object to certain processing; withdraw consent where processing is based on consent; and lodge a complaint with a competent data protection authority. To exercise a right, contact us at contact@limrun.com. We will review and respond to requests in accordance with applicable law and may need to verify your identity. If we process Personal Information on behalf of a Limrun customer, we may direct your request to that customer.

California Residents

This section applies to California residents to the extent Limrun is subject to the California Consumer Privacy Act, as amended (the “CCPA”). It supplements the other disclosures in this Privacy Policy. We do not disclose Personal Information to third parties for their own direct-marketing purposes in a manner that would require disclosure under California’s “Shine the Light” law.

Subject to applicable exceptions, California residents may have rights to know and access Personal Information, delete Personal Information, correct inaccurate Personal Information, opt out of the sale or sharing of Personal Information, and receive equal service and pricing when exercising privacy rights.

Requests to Know or Access

You may request that we disclose:

• The categories of Personal Information we have collected about you;
• The categories of Personal Information about you that we have disclosed for a business purpose, sold, or shared;
• The categories of sources from which we have collected Personal Information about you;
• The business or commercial purposes for collecting, using, disclosing, selling, or sharing Personal Information;
• The categories of Personal Information sold or shared, if any, and the categories of third parties to which each category was sold or shared; and
• The specific pieces of Personal Information collected.

You may submit a request to know or access by emailing contact@limrun.com. We will provide our response electronically unless another method is required or reasonably requested.

Limrun does not sell Personal Information for money. We may disclose identifiers and Internet or other electronic-network activity to advertising partners, including Google Ads, X Ads, and Reddit Ads, for advertising measurement and cross-context behavioral advertising. To the extent this activity constitutes “sharing” under the CCPA and the CCPA applies to Limrun, you may opt out by enabling a DNT signal or a supported opt-out preference signal, such as GPC. We do not knowingly sell or share Personal Information of individuals under 16 years old.

Requests to Delete

You may request that we delete Personal Information we have collected about you by emailing contact@limrun.com. We will process a verified request subject to exceptions permitted by applicable law.

Requests to Correct

You may request correction of inaccurate Personal Information by emailing contact@limrun.com. We will process a verified request in accordance with applicable law.

Right to Opt Out of Sale or Sharing

To the extent the CCPA applies to Limrun, you may opt out of the sale or sharing of Personal Information through your cookie settings, by enabling a DNT signal, or by using a supported opt-out preference signal, such as GPC. Limrun does not sell Personal Information for money. The categories of Personal Information that may be shared for cross-context behavioral advertising are identifiers and Internet or other electronic-network activity information.

Authorized Agents

You may designate an authorized agent to submit a California privacy request on your behalf. We may require evidence that you authorized the agent and may require you to verify your identity directly with us, unless the agent has authority under applicable law that does not require separate verification.

Methods for Submitting Consumer Requests and Our Response

You may submit requests to know, access, delete, or correct Personal Information through:

• Visiting limrun.com/privacy; or
• Email at contact@limrun.com.

Upon receipt of a request, we may ask for additional information to verify your identity. We will use any additional information only for verification and request-processing purposes.

We will acknowledge and respond to requests within the time required by applicable law. Depending on the request, we may verify your identity through access to the applicable Account, an email sent to the address associated with the Account, or by matching information you provide against information in our records. If we need additional time, we will notify you as permitted by applicable law.

Any disclosure we provide will cover the period required by applicable law. If we cannot comply with all or part of a request, our response will explain the basis for that decision.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

The Right to Non-Discrimination

You have the right not to be discriminated against for the exercise of your California privacy rights described above. Unless permitted by the CCPA, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

International Transfers of Personal Information

Limrun is based in the United States and operates service infrastructure in the European Union, the United States, and Singapore. Account and service records are primarily hosted in the European Union with replicas in Limrun’s service regions; Customer Content is stored with cloud-storage providers; operational logs and metrics are maintained on infrastructure in the European Union; and analytics providers may process data in the United States. As a result, Personal Information may be transferred to, stored in, and accessed from countries other than the country where it was collected. Where applicable law requires a transfer mechanism, we rely on appropriate safeguards, such as adequacy decisions or standard contractual clauses.

Data Retention

We retain Personal Information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain security, process billing, satisfy audit requirements, resolve disputes, and comply with law. Account, billing, and usage history may be retained for billing and audit purposes. Device-session artifacts expire automatically after a limited period. Uploaded application builds generally remain until the customer deletes them or they are deleted under our normal retention practices. Operational logs and metrics are generally retained for approximately one month, and backups are generally retained for approximately 30 days. Stripe and other service providers retain information in accordance with their own retention practices. We may retain information for longer where required or permitted by law or where reasonably necessary to establish, exercise, or defend legal claims.

Changes to the Privacy Policy

We may update this Privacy Policy as our practices, the Services, or applicable requirements change. The effective date at the top indicates when this Privacy Policy was last updated. We will provide notice of material changes as required by applicable law, which may include notice by email or through the Services. We encourage you to review this Privacy Policy periodically. Questions may be submitted to contact@limrun.com.

Contacting Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at contact@limrun.com or by mail at Limrun Inc., 76 South Park Street, San Francisco, CA 94107.