Last updated: 4 August 2026
Runway (the “operator”) is the data controller for the personal data described in this policy. This policy explains what data Runway processes, why, on what legal basis, how long it is kept, and what rights you have. It is provided in accordance with Regulation (EU) 2016/679 (the GDPR) and the Spanish Organic Law 3/2018 of 5 December (LOPDGDD). Contact: info@runwayboutique.es
- Account data (name, email, username, optional profile photo, hashed password): to create, manage and secure your account, and to let you log in. Required to create an account: name, email and username. Profile photo is optional. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); optional fields are processed with your consent (Art. 6(1)(a) GDPR). - Session data (IP address and browser/device user-agent recorded at login): to keep sessions secure and prevent abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). - Location (only if you grant permission): sent with your searches to show stores near you. Location is not stored on our servers. Legal basis: consent (Art. 6(1)(a) GDPR). - Click data (store, product, type of click, and source such as “?src=flyer”): to provide store owners with statistics about visits to their store. This data is not linked to your account. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). - Spotlight content (photos, captions, comments, likes, follows): to provide the social features of the service. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); photos you upload are processed with your consent (Art. 6(1)(a) GDPR). - Error and audit logs (trace ID, error message and technical details): to detect and fix errors and to keep the service secure. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). - Locale preference (cookie): to show the service in your language. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). - Shopping cart (stored in your browser's localStorage): to keep your cart between visits. This data stays on your device and is not sent to our servers.
Your data is stored on the servers that host Runway. We retain data by category: - Account and profile data: kept until you delete your account or request deletion. - Session data: kept until the session expires; expired sessions are removed. - Click data: kept while it is needed to provide store statistics, then deleted. - Error and audit logs: kept while they are needed for security and troubleshooting, then deleted. - Location: not stored. - Cart: kept in your browser until you clear it. Where no fixed period is set, data is deleted as soon as the purpose for which it was collected no longer exists.
We only share data with providers that help us run the service, under data-processing agreements: - Hosting provider: stores the database and serves the application. - Email service (SMTP): sends email verification and password-reset emails. - Map tile providers (Stadia Maps, OpenStreetMap): receive only standard map tile requests for the area you view; no personal data. - AI provider: used only if a store owner uses the “analyse” or “generate scrape rules” features, which send product data (not your personal data). We do not sell, rent or trade your personal data, and we do not share it with advertising networks or data brokers.
Some providers may process data in countries outside the European Economic Area. Where this happens, we rely on the appropriate safeguards required by the GDPR, such as the European Commission's Standard Contractual Clauses. You may ask for a copy of the relevant safeguards by contacting us.
Under the GDPR you have the right to: - access your personal data; - rectify inaccurate data; - erase your data (right to be forgotten); - restrict processing; - data portability; - object to processing; - withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. To exercise any of these rights, email info@runwayboutique.es. We will respond within one month. You also have the right to lodge a complaint with a supervisory authority, in Spain the Spanish Data Protection Agency (AEPD, www.aepd.es).
Under Spanish law (LOPDGDD, Art. 7), minors aged 14 or older may consent to the processing of their own personal data. If you are under 14, you may only use Runway with the consent of your parent or guardian.
We use a small number of cookies and browser storage, all necessary for the service to work: - Session cookie: keeps you logged in. - Locale cookie: remembers your language (valid for 1 year). - localStorage: stores your shopping cart and, optionally, an administrative access flag. We do not use advertising, tracking or social-media cookies.
We apply reasonable technical and organisational measures, including HTTPS encryption in transit, storage of passwords in hashed form, minimal data collection and restricted access to stored data. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.
We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you (Art. 22 GDPR).
We may update this policy from time to time. The current version is always available on this page, together with its date. Material changes will be highlighted.
For any question about this policy, or to exercise any of your rights, contact us at info@runwayboutique.es.