Privacy Policy

Rutakshi Technologies Private Limited

Effective date: 21 September 2026

Applies to RUNO websites applications software APIs browser extensions and related services

Agreement to This Privacy Policy

By downloading, installing, registering for, accessing or using RUNO, you confirm that you have read and understood this Privacy Policy and agree to the collection, use, storage, disclosure and other processing of personal data as described in it. If you do not agree with this Policy, do not download, install, register for, access or use RUNO, and uninstall the application from your device.

If you download, install or use RUNO on behalf of a company or other organisation, you confirm that you are authorised to accept this Policy for that organisation and its authorised users. The organisation remains responsible for the personal data it places in RUNO and for giving required notices and obtaining required permissions from its employees, customers, prospects and other contacts.

Agreement to this Policy does not replace a separate consent where applicable law requires a specific, informed and affirmative choice. RUNO may therefore request additional consent for optional device permissions, location, marketing, call recording or another feature. You may refuse or withdraw an optional consent, although the affected feature may then be unavailable.

This Policy explains how Rutakshi Technologies Private Limited, operating under the brand RUNO (RUNO, we, us or our), processes personal data and describes the choices and rights available to individuals.

RUNO provides business-to-business CRM, calling, messaging, analytics and integration services. For personal data uploaded or generated by a customer, the customer generally decides why and how the data is processed, and RUNO processes it under the customer's instructions. RUNO separately determines the purposes of processing for account administration, website operations, security, billing, support, product improvement and its own business communications.

This Policy should be read with the applicable terms and conditions, order form, subscription agreement, Data Processing Agreement and product-specific notices. Where those documents provide more specific terms for Customer Data, the more specific terms apply to that processing.

1. Scope

This Policy applies to personal data processed through or in connection with:

• RUNO websites, mobile and web applications, software, APIs and customer portals.
• Cloud telephony and cloud or mobile number enabled services.
• SIM Based Call Management CRM.
• Call recording, Transcription, AI Call Analytics and related features.
• WhatsApp Business Platform functionality and authorised WhatsApp message tracking extensions.
• Gmail and Google integrations.
• Sales, Support, Events, Demonstrations, Trials, Surveys and other communications with RUNO.

This Policy does not replace the privacy notices of RUNO customers or independent third parties such as telecom operators, Google, Meta, WhatsApp, device manufacturers, app stores or other services that a user chooses to connect.

2. Our Roles

2.1 RUNO as Data Fiduciary or Controller

RUNO acts as a Data Fiduciary under applicable Indian law, or as a controller under other applicable data-protection law, when it determines the purposes and means of processing. This generally includes processing for website use, account creation, billing, security, customer support, service administration, legal compliance, and RUNO's own sales and marketing activities.

2.2 RUNO as Data Processor

RUNO acts as a processor or service provider when it processes Customer Data on behalf of a customer. In that role, the customer is responsible for providing required notices, identifying an appropriate legal basis, obtaining necessary permissions or consents, responding to rights requests, and giving RUNO lawful instructions. RUNO processes Customer Data in accordance with the customer's documented instructions, the applicable agreement and law.

If your data was entered into RUNO by a customer, employer or other organisation, direct your request to that organisation first. We will assist the organisation as required by the applicable agreement and law.

3. Personal Data We Collect

The personal data we collect depends on the RUNO service, the user's role, device permissions, customer configuration and connected services.

4. Sources of Personal Data

We collect personal data from the following sources:

• Directly from users, customer administrators, authorised users and people who contact RUNO.
• From a customer's systems, files, CRM, telecom resources, devices and authorised users.
• Automatically from websites, apps, devices and service usage.
• From connected platforms and providers when a user authorises an integration, including Google, Gmail, Meta, WhatsApp, telecom providers and other customer-selected services.
• From channel partners, resellers, service providers, public business sources and event organisers, where permitted by law.

5. How We Use Personal Data

RUNO uses personal data for the following purposes, as applicable to the service and our role:

• Provide, configure, operate and support the services.
• Create accounts, authenticate users, administer permissions and manage customer relationships.
• Place, receive, route, log, record, transcribe and analyse calls when enabled.
• Synchronise authorised CRM, WhatsApp and Gmail information and display communication timelines.
• Generate call summaries, classifications, sentiment, scores and other analytics.
• Process subscriptions, invoices, taxes, usage charges and related records.
• Perform KYC, subscriber verification, fraud prevention, abuse detection and regulatory checks where required.
• Secure the services, investigate incidents, enforce access controls and maintain audit logs.
• Monitor performance, diagnose errors, maintain compatibility and improve service reliability and functionality.
• Respond to support requests, provide training and communicate service or policy changes.
• Send product, event or marketing communications where permitted, and honour communication preferences.
• Comply with law, court orders, regulatory requests and enforceable agreements; and
• Establish, exercise or defend legal claims and complete corporate transactions.

We may aggregate or de-identify information so that it no longer identifies an individual. We may use that information for analytics, service improvement, security and business reporting, subject to applicable law and contractual commitments.

6. Legal Bases

We process personal data only where a lawful basis is available. Depending on the jurisdiction and context, the basis may include consent; processing necessary to perform a contract or take steps requested before a contract; compliance with a legal obligation; protection of rights and security; legitimate interests that are not overridden by an individual's rights; or another use authorised by applicable law.

Under India's Digital Personal Data Protection Act 2023, where applicable and in force, processing is based on consent or on a permitted legitimate use. Under the EU GDPR or UK GDPR, where applicable, RUNO identifies the relevant basis under those laws. Where processing relies on consent, the individual may withdraw it using the method described at collection, available product settings, or the contact details in this Policy. Withdrawal does not affect processing already carried out lawfully and may prevent the affected feature from working.

7. Product Specific Processing

7.1 SIM Based Call Management and Cloud Telephony

When enabled by a customer, RUNO processes call logs, phone numbers, timestamps, duration, dispositions, recordings and related device, SIM or telecom metadata. The service may use permissions for call logs, microphone, storage, contacts and notifications. Customers must ensure that SIMs and telecom resources are lawfully registered and that employees and communication participants receive required notices and provide required permissions or consents.

7.2 Call Recording Transcription and AI Analytics

RUNO may record, store, transcribe and analyse calls when the customer enables those functions. AI features may create summaries, sentiment, classifications, scores, keyword detections and quality assessments. These outputs are probabilistic and may be incomplete or inaccurate. Customers are responsible for reviewing material outputs and must not use the features for unlawful discrimination or prohibited solely automated decisions. RUNO does not use Customer Data to train a general-purpose model unless this is expressly agreed with the customer and supported by an appropriate legal basis.

7.3 WhatsApp Business Platform

When a customer uses WhatsApp Business functionality, RUNO processes recipient details, message content, templates, delivery information, opt-in or opt-out records and related metadata to provide the service. Meta and WhatsApp process information under their own terms and privacy notices. Customers determine the recipients, content, frequency and purpose of their messages and are responsible for required opt-ins and opt-outs.

7.4 WhatsApp Message Tracking Extension

An authorised browser extension may capture, synchronise or associate selected WhatsApp communications with a RUNO CRM record. The extension accesses only the permissions and data needed for its disclosed functionality, subject to the user's configuration and platform requirements. Customers and users must connect only accounts, devices and communications they are authorised to access and must not use the extension for unauthorised surveillance or interception.

7.5 Gmail and Google Integration

A user who connects a Google account authorises RUNO through Google's OAuth process to use the permissions displayed during authorisation. RUNO may request gmail.readonly and gmail.send, or other scopes shown to the user, where needed for the selected feature. RUNO stores email metadata such as subject, date, sender and recipient to display CRM interaction timelines. Email body content and attachments are fetched on demand and are not stored in RUNO's database, unless a different customer configuration or written agreement expressly states otherwise.

RUNO's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. RUNO does not sell, license or disclose Google user data for advertising, marketing or data-broker purposes. A user may revoke access through available RUNO settings or Google Account permissions; the connected feature may then stop working.

8. Cookies and Similar Technologies

RUNO websites and applications may use cookies, software development kits, local storage, pixels and similar technologies to maintain sessions, remember preferences, secure the services, understand usage and measure communications. Where required, we request consent before using non-essential technologies. Browser or device settings can block or remove these technologies, but some features may not work correctly. More specific information may be provided in a cookie notice or consent interface.

9. How We Disclose Personal Data

RUNO may disclose personal data to the following recipients when reasonably necessary for the purposes described in this Policy:

• The relevant customer, customer administrators and authorised users.
• Cloud hosting, communications, telecom, payment, analytics, security, support and other service providers acting under contract.
• Google, Meta, WhatsApp, telecom operators, device or platform providers and other third parties selected or authorised by a customer or user.
• Professional advisers, auditors, insurers, certification bodies and financing providers subject to appropriate confidentiality obligations.
• Government, regulatory, judicial and law-enforcement authorities where disclosure is required or permitted by law.
• A buyer, investor, lender or successor in connection with a merger, financing, reorganisation or sale, subject to appropriate safeguards; and
• Other recipients at the individual's direction or with consent.

RUNO does not sell personal data. We require service providers that process personal data for us to use it only for authorised purposes and to apply appropriate confidentiality and security protections.

10. International Transfers and Hosting

RUNO uses regional hosting based on the customer's primary business or service location. Customer data for customers located in India is hosted in India; Customer Data for customers located in the European Economic Area is hosted in the EEA; and Customer Data for customers located in the United Kingdom is hosted in the United Kingdom, unless the customer agrees otherwise in writing.

Production data, databases, call recordings, application data, backups and replicas are maintained within the applicable hosting region. Authorised RUNO personnel in India may have limited remote access where necessary for support, maintenance, security, legal or contractual obligations. Such access is restricted by role and business need and protected through authentication, access controls, logging and confidentiality obligations.

Where an international transfer requires a legal mechanism, RUNO uses an applicable mechanism and supplementary safeguards. These may include the European Commission's Standard Contractual Clauses for EEA transfers and the UK International Data Transfer Agreement or UK Addendum for UK transfers. Some customer-selected or essential service providers may process data in other countries under appropriate contractual and security protections. Indian transfers remain subject to any restriction notified under applicable law.

11. Retention and Deletion

RUNO retains personal data only for as long as necessary for the purposes described in this Policy, to provide the services, meet contractual commitments, comply with law, resolve disputes and protect legal rights. Retention periods depend on the data category, customer configuration, subscription plan, contract and legal requirements.

• Customer Data is retained for the subscription term and the deletion or return period stated in the applicable agreement or customer configuration.
• Call recordings and related analytics are retained according to the applicable plan, customer setting or written agreement.
• RUNO account and business records may be kept for up to one year after account termination where needed for the purposes described above, unless a longer period is required or permitted by law.

For EEA or UK Customer Data, deletion or anonymisation may occur within one month after termination where contractually agreed or requested by the relevant controller, unless retention is required or permitted by law.

Protected backups are isolated from ordinary use and deleted or overwritten according to the applicable backup schedule. When retention is no longer necessary, we delete or anonymise the data or, where immediate deletion is not technically feasible, securely isolate it until deletion is possible.

12. Security

RUNO maintains administrative, technical and organisational safeguards designed to protect personal data against unauthorised access, alteration, disclosure, loss and destruction. Measures may include encryption in transit and at rest, role-based access, authentication, logging, vulnerability management, secure development practices, backups, incident response, employee confidentiality and vendor risk controls.

RUNO maintains an information-security programme aligned with the applicable scope of its ISO IEC 27001 certification and SOC 2 Type II assessment. No system or transmission method is completely secure. Customers and users must protect credentials, devices and SIMs, configure permissions appropriately, disable former users promptly and notify RUNO of suspected compromise.

13. Personal Data Breaches

RUNO maintains procedures to identify, contain, investigate and remediate personal data breaches. Where RUNO acts as a processor, we notify the relevant customer or controller without undue delay after becoming aware of a breach affecting Customer Data. Where RUNO is responsible for notice, we notify affected individuals and competent authorities as required by applicable law. Under the EU GDPR or UK GDPR, a reportable breach is notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours after the controller becomes aware of it.

14. Individual Rights and Choices

Depending on location, role and applicable law, an individual may have the right to:

• Obtain information about personal data and processing activities
• Request access to personal data.
• Request correction, completion or updating of inaccurate or incomplete data.
• Request deletion or erasure where the data is no longer required or another legal condition is met.
• Withdraw consent where processing is based on consent.
• Object to or request restriction of certain processing.
• Receive certain data in a portable format where applicable.
• Opt out of direct marketing communications.
• Use an available grievance redressal mechanism and complain to a competent authority; and
• Nominate another individual to exercise rights in the event of death or incapacity where Indian law provides that right.

To make a request, use available account settings or contact the privacy team using Section 19. We may verify identity and authority before acting. Rights may be limited by law, the rights of others, legal privilege, security requirements or RUNO's role as a processor. If RUNO processes the data only for a customer, we may refer the request to that customer.

Marketing messages include an unsubscribe or preference method where required. Service, security, billing and transactional messages may still be sent when necessary.

15. Children

RUNO is a business service intended for organisations and authorised adult users. We do not knowingly offer the services directly to children or knowingly use children's personal data for tracking, behavioural monitoring or targeted advertising. If a customer has a lawful use case involving a child, the customer must notify RUNO in advance and ensure that processing is legally permitted, including obtaining verifiable parental or guardian consent where required. If we learn that personal data of a child was collected without a valid basis, we will take reasonable steps to restrict and delete it.

16. Third Party Services

The services may contain links to or interoperate with independent third parties. Their privacy practices are governed by their own notices and agreements. RUNO does not control changes to third-party APIs, permissions, policies or processing. Users should review the privacy information presented by each connected service before authorising access.

17. Compliance and Legal Requests

RUNO may preserve records, restrict access or disclose information where reasonably necessary to comply with applicable law, a valid governmental request, court order, regulatory direction, telecom-provider requirement or other lawful process. We may also process information to investigate fraud, spam, cyber incidents, telecom abuse or other suspected unlawful activity and to establish, exercise or defend legal claims.

18. Changes to This Policy

We may update this Policy to reflect changes in law, products, integrations, security practices or business operations. We will publish the revised Policy with an updated effective date and provide additional notice of material changes where required. If consent is legally required for a new purpose, we will request it before processing for that purpose.

19. Contact and Grievance Redressal

Questions, rights requests and privacy grievances may be sent to:

We address privacy grievances within the period required by applicable law. Where Indian law requires, use RUNO's grievance process before approaching the Data Protection Board of India. Individuals in the EEA or United Kingdom may also complain to the competent supervisory authority.