Privacy Policy

Last updated September 9, 2026 · Runsheet is operated by SÔZ Studios Atelier, Laguna Beach, California · Questions: hello@runsheet.tech

In plain words: we collect what we need to run a directory, a review site and a production dashboard — your account details, what you put into the dashboard, reviews you write, and basic usage data. We do not sell personal information, we do not use your styles or tech packs to train AI, and reviewers’ email addresses are never shown to the business they reviewed. You can see, export or delete your data by emailing hello@runsheet.tech.

1. Who this covers

This policy applies to runsheet.tech, app.runsheet.tech, directory.runsheet.tech, our emails and the tools linked from them (the “Service”), operated by SÔZ Studios Atelier, Laguna Beach, California (“Runsheet”, “we”). It covers visitors, people who create accounts (brands, consultants and their teammates), businesses listed in the directory, reviewers, and people who post or answer briefs.

2. What we collect

You give us

Account details: name, email address, password (held by our login provider, Clerk — we never see it), company or brand name, role, and the teammates you invite.
Dashboard content: styles, photos and sketches, tech packs, measurements, costing and pricing, purchase orders, invoices, client and factory records, sampling rounds, files, tasks and notes. This may include names and contact details of your clients, factory contacts and buyers.
Reviews: your ratings, written review, display name, reviewer category and, privately, your email and any evidence of the engagement you choose to send us for verification.
Directory and listing information: business name, location, capabilities, MOQ, lead times, certifications, website, contact name, email and phone — from you when you claim or create a listing, or from public sources for unclaimed listings.
Briefs and introductions: what you are making, quantities, timelines, budgets and the contact details you want factories to use.
Payments: handled by Stripe. We receive your name, email, the plan purchased, the last four digits of the card and a Stripe customer ID — never the full card number.
Messages you send us by email, feedback forms or the sandbox’s one-question surveys.

Collected automatically

Usage and device data: pages viewed, actions taken in the Dashboard (which we log as an activity history your team can see — for example “Ed moved The Theo Blazer to Sampling”), IP address, browser and device type, referring page, and timestamps.
Cookies and local storage: a session cookie for login (Clerk), a cookie remembering which of your accounts you last opened, and browser storage for conveniences such as your theme, the last section you were in, dismissed nudges and unsent drafts. Our marketing site (Squarespace) sets its own analytics cookies, which you can manage through its cookie banner. We do not use advertising cookies or cross-site tracking.

3. How we use it

To provide the Service: run your dashboard, generate tech pack drafts from what you upload, send sampling rounds and line sheets to the people you choose, publish listings and reviews, connect briefs and introductions, and bill your plan.
To communicate: transactional email (verification codes, approvals, invoices, @mentions, a daily summary of what needs you), service announcements, and — if you signed up for them or created an account — occasional product updates. Every marketing email has an unsubscribe link or a reply-to-stop line, and we honour it.
To keep the Service safe and honest: verifying reviews, detecting fraud or abuse, enforcing our Terms, and keeping the directory accurate.
To improve the Service: aggregated, de-identified usage analysis. We do not use Your Content (styles, tech packs, files, client data) to train AI models, and we do not permit our AI provider to do so.
To comply with law and protect rights, including tax and accounting records.

4. Who we share it with

We do not sell personal information, and we have not sold or shared it for cross-context behavioural advertising in the preceding 12 months. We share data only:

With people you choose: teammates on your account; a factory you send a sampling round, approval or fit check to; a buyer you send a line sheet to; a consultant or brand you connect with through a brief or introduction. What they see is what you send.
Publicly, where the feature is public: directory listings, consultant and factory profiles, approved reviews (display name only — never the reviewer’s email), and factory responses.
With service providers who process data on our behalf under contract: Vercel (hosting, file storage, logs), Airtable (database), Clerk (authentication), Stripe (payments), Resend (email delivery), OpenAI (tech pack drafting — receives the photo, sketch and description you submit for a draft, and per its API terms does not train on it), Squarespace (marketing site and forms), Make (automation), and Google Workspace (our email). Each receives only what it needs.
For legal reasons: to comply with law, a court order or a valid government request; to enforce our Terms; or to protect the rights, safety or property of Runsheet, our users or the public.
In a business transfer: if Runsheet is acquired or merges, your data may transfer to the successor, who will be bound by this policy.

5. Reviews and the businesses reviewed

A reviewed business sees the review, your display name and reviewer category, and can post one public response. It never sees your email address or the evidence you sent us for verification. If a business disputes a review we may ask you for more detail, and we may share a summary of your evidence with the business only with your consent. We may keep verification evidence for as long as the review is published.

6. Directory listings for businesses

Business contact details in unclaimed listings come from public sources (company websites, industry directories, trade associations) and are used to display the listing, to route briefs and introductions, and occasionally to invite the business to claim its page. Business email addresses are not displayed publicly. To claim, correct or remove a listing, or to opt the business out of invitation emails, write to hello@runsheet.tech.

7. How long we keep it

Account and Dashboard content: while your account is open, and for 90 days after you close it (so you can change your mind), then deleted, except invoices and payment records kept for 7 years for tax and accounting.
Reviews: while published. If you delete your account, your reviews stay published under your display name unless you ask us to remove them.
Directory listings: while the business is listed.
Activity logs and server logs: up to 12 months.
Email and support correspondence: up to 3 years.

8. Your choices and rights

You can update most account details in the Dashboard. Email hello@runsheet.tech to: see the personal information we hold about you; get a copy of Your Content in a portable form; correct or delete it; close your account; or stop marketing emails. We respond within 30 days and will verify the request comes from the account holder.

California residents (CCPA/CPRA) have the right to know what personal information we collect, use and disclose; to request deletion or correction; to opt out of sale or sharing (we do neither); to limit use of sensitive personal information (we collect none beyond login credentials held by Clerk); and not to be discriminated against for exercising these rights. Send requests to hello@runsheet.tech; an authorised agent may submit on your behalf with written permission.

Residents of the UK, EEA and Switzerland: we process your data on the basis of contract (providing the Service), legitimate interests (running, securing and improving it; operating a directory and review site in the public interest), consent (marketing emails, cookies on the marketing site) and legal obligation. You have rights of access, rectification, erasure, restriction, portability and objection, and may complain to your supervisory authority. Data is processed in the United States; where required we rely on standard contractual clauses with our providers.

9. Security

Data is encrypted in transit (TLS) and at rest with our providers. Access to production systems is limited to the people who run Runsheet and protected by multi-factor authentication. Passwords are handled entirely by Clerk. Public links (sampling rounds, approvals, line sheets, claim links) use long random tokens that we can rotate on request. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the relevant authorities as the law requires.

10. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect information from children; if you believe we have, contact hello@runsheet.tech and we will delete it.

11. Do Not Track and global privacy controls

The app does not track you across other sites, so there is nothing to opt out of; we treat Global Privacy Control signals as a request to opt out of any sale or sharing, which we do not do.

12. Changes

We will post changes here with a new “last updated” date and, for material changes, email account holders at least 14 days before they take effect.

13. Contact

SÔZ Studios Atelier · Laguna Beach, California · hello@runsheet.tech