Your information.
Handled with care.

1. Who is responsible and when this notice applies

K2022711569 (SOUTH AFRICA), registration number 2022/711569/07, trading as RunWithIT, is responsible for personal information used for this website, account administration, direct enquiries, service security and our own governance. Our address is 970 Waxberry Avenue, Weltevreden Park, Gauteng, 1709, South Africa.

When an organisation gives its personnel access or instructs us to process its content, that organisation may be the responsible party or controller and RunWithIT may act as its operator or processor. The relevant service and data-processing agreement then also applies. Separately operated products and external sites have their own privacy notices.

2. Information we collect

Account information includes username, email address, optional display name, access grants, verification state, sign-in and security events, and a securely hashed password. Enquiry information includes the name, email, company, area of interest and message you submit. Technical information may include IP address, device or browser information, request time, service and security logs, error details and identifiers needed to prevent misuse.

AI-service content may include prompts, chat instructions, uploaded images, video and audio, recordings and transcripts, synthetic voice scripts, documents, research questions, code, project titles and settings, generated output, content reports, review decisions and feedback. A file can contain personal information about people other than the account holder. You must have a lawful basis and give any required notice before supplying it.

3. Why we use information

Depending on the context and applicable law, we use information to:

• create and secure accounts, verify email, administer access and recover accounts;
• perform a service agreement or take requested steps before entering one;
• send content to the selected model, return output, store private projects where the feature requires it, and provide downloads;
• moderate unsafe or unlawful inputs and outputs, investigate incidents and enforce our Terms of Use;
• respond to enquiries, support users, measure reliability and troubleshoot errors;
• maintain asset rights, quality, audit, evaluation, human-review and AI-literacy evidence; and
• comply with law, protect rights and establish, exercise or defend legal claims.

The legal ground may be performance of a contract, compliance with a legal duty, consent where specifically requested, or a legitimate interest that is not overridden by your rights, such as securing the service, responding to a business enquiry and keeping accountable operational records. We do not use acceptance of the Terms as blanket consent for marketing, sensitive-data processing or model training.

4. AI models, modalities and human oversight

ConneX AI supports chat and writing, image generation and editing, audio transcription, synthetic voiceover, document and research assistance, coding assistance, and text-to-video, image-to-video, video editing and video extension. The prompt, relevant conversation context, selected source content and technical settings are sent only to the provider configured for that request. The output may be stored in the feature workspace, downloaded by the user or discarded after delivery, depending on the feature described below.

Current providers may include Microsoft Azure hosting and storage, Azure Communication Services for service email, Azure Foundry and Azure AI services for text, code, image, transcription and voice processing, and Google AI services for certain video processing. Providers act under their applicable service terms and our contractual configuration. Models and providers can change; material changes will be reflected in this notice or the relevant service agreement.

RunWithIT does not intentionally use private member prompts, uploads or outputs to train a general-purpose model and this notice does not authorise a provider to do so. Enterprise provider terms and configured data controls govern provider use and any temporary safety or abuse-monitoring retention. A future model-improvement programme using customer content would require a separate, prominent notice, an appropriate lawful basis and any required opt-in or agreement.

Audio and video may contain several people's speech, likeness, movements or surroundings. Before recording, transcribing, editing or generating a voice or likeness, the user must give required notices and have a lawful basis and rights. Ordinary voiceover is synthetic speech; cloning or imitating an identifiable real person is not permitted without explicit authority. Where voice, face or other biometric information is used to identify a person, additional legal and security controls may apply.

Inputs and outputs may be checked by automated RunWithIT or provider safety systems for abuse, harmful content, policy evasion and security threats. A request can be blocked or flagged for authorised human review. Safety screening reduces risk but does not certify that an output is accurate, lawful or appropriate.

AI outputs are probabilistic and are not used by RunWithIT to make solely automated decisions that produce legal or similarly significant effects about a person. Users must review output. Reports, incidents and sensitive operations can be escalated for meaningful human review. If we introduce significant automated decision-making, we will provide the information and choices required by applicable law before it is used.

5. Sharing and international processing

Information is accessible only to authorised RunWithIT personnel, the organisation that manages your account where applicable, and contracted providers that need it for hosting, storage, communications, AI processing, security, support or professional advice. We may also disclose information where required by law or reasonably necessary to protect rights and safety. We do not sell personal information or publish private prompts and account details.

Providers may process information outside South Africa or the country where you are located. Before a cross-border transfer, we assess the recipient, contract and safeguards required by POPIA and, where applicable, the GDPR or other law. Depending on the transfer, safeguards may include contractual data-protection terms, approved transfer clauses, access controls, encryption and a transfer-risk assessment. Contact us for information about the safeguards relevant to your service.

6. How long information is kept

• Accounts and permissions: while the account is active and afterwards only as needed for security, dispute, audit and legal obligations.
• Enquiries and commercial records: while we respond and then for the period reasonably required for business, tax, contractual or legal records.
• Transient AI tools: chat, image, transcription, voice, document and coding content is processed to fulfil the request and is not intentionally added to a public library. Provider-side copies and abuse-monitoring records follow the configured provider contract and retention controls.
• Video Studio: source uploads are ordinarily removed after the configured source-retention period (currently seven days after processing finishes). Prompts, project settings, generated video, job status and limited provider identifiers may remain in the private project workspace until the project is deleted, another valid retention action applies, or the service agreement ends.
• ConneX Library: published assets and their rights, quality, version and audit records are kept while available and afterwards while reasonably needed to prove provenance, licence and administrative decisions.
• Governance and security evidence: incident, report, evaluation, human-review, model-change, literacy and security records are retained according to the applicable compliance, limitation and contractual schedule.

Deletion from an active workspace may not immediately remove encrypted backups or a minimal audit record. Such copies are isolated from ordinary use and expire under the applicable backup or legal-retention schedule. We may retain information for longer where law, a dispute, a preservation duty or the protection of rights requires it, and will not keep it merely because it might be useful someday.

7. Security and incidents

We use proportionate organisational and technical controls, including role-based access, private storage, transport encryption, credential hashing, request protection, logging and supplier controls. No online service is risk-free. If a security compromise affects personal information, we investigate, contain and notify the Information Regulator, responsible party and affected people where required by law.

8. Your rights

Subject to applicable law and the role in which we hold the information, you may request confirmation and access, correction, deletion, restriction, objection, portability, withdrawal of consent, or review of an automated decision. POPIA also permits objections and complaints to South Africa's Information Regulator. If the GDPR applies, you may complain to the supervisory authority where you live, work or believe an infringement occurred. Rights are not absolute; we will explain a lawful refusal or limitation.

You can update your display name or password in the dashboard. For another request, email support@runwithit.io with the subject “Privacy request”. Tell us enough to locate the information without sending a password or unnecessary identity document. We may take proportionate steps to verify identity and authority. If an organisation controls your account or content, we may refer the request to it.

9. Children and sensitive information

The general RunWithIT member service is intended for adults and business users. Do not upload children's personal information, biometric information, health information or another special category unless the feature expressly permits it and the responsible party has a documented lawful basis, required consent or authorisation, appropriate safeguards and any necessary impact assessment. AI video providers may reject media depicting children under their safety rules.

10. Cookies and external services

Essential cookies maintain a signed-in session and protect forms against unauthorised requests. They are required for account features. The website does not currently use advertising or analytics cookies. If this changes, we will update the notice and request a choice where required. Links to Pet ConneX and other external services lead to their own privacy notices; a RunWithIT account does not automatically create another product account.

11. Questions, complaints and changes

Contact the RunWithIT Information Officer or privacy team at support@runwithit.io, or write to 970 Waxberry Avenue, Weltevreden Park, Gauteng, 1709, South Africa. You may also contact the South African Information Regulator through its official channels. We will publish the date and version of changes and provide additional notice where a material change requires it.

Document reference RWIT-PRIVACY-2026-02 · Version 2.0.