Privacy Policy · Runbook

1. Who is responsible

metikular GmbH, Alte Hedingerstrasse 25a, 8910 Affoltern am Albis, Switzerland, is responsible for the processing described here (controller under the Swiss Federal Act on Data Protection, revDSG/nFADP, and, where applicable, the EU General Data Protection Regulation, GDPR). Contact for all privacy questions: hello@metastic.ch.

For the content your organization stores in Runbook (checklists, runs, names and emails of colleagues), your organization decides what is processed and why; for that content we act as its processor and use it only to provide the service.

2. What we process

Account data: your email address, the organizations you belong to and your role, your notification setting, sign-in times.
Content: templates, runs, checked items, assignments, due dates, schedules, webhook settings and the audit trail (who did what, and when).
Billing data: for paid plans, Stripe processes name, billing address, VAT ID and payment details. We receive and store only the Stripe customer and subscription IDs, the plan and the subscription status. We never see full card numbers.
Technical data: IP address, time, requested path and status code in server logs, kept for at most 30 days for security and debugging. We do not log query strings or email contents.
Feedback: messages you send with the feedback button, with your email (if you give it) and the page you were on.

3. Why (purposes and legal bases)

We process this data to provide and secure the service, to bill paid plans, to send the emails you need (sign-in links, invitations, notifications you chose, billing notices) and to answer your messages. Legal bases under the GDPR: performance of the contract (Art. 6(1)(b)), legal obligations such as bookkeeping (Art. 6(1)(c)), and our legitimate interest in a secure, working service (Art. 6(1)(f)). We do not sell data, we do not show ads and we do not profile you.

4. Cookies and tracking

Runbook uses two technically necessary cookies: a session cookie that keeps you signed in, and a security cookie against cross-site request forgery. The dark mode choice is stored in your browser's local storage.

When you arrive through a link that names its source (for example ?ref=hn or utm_source, utm_medium and utm_campaign parameters from a newsletter), we keep these values and the page you landed on in a first-party cookie (rb_src) for up to 30 days. If you sign up, they are stored with your account and organization so that we can count which channels bring new customers, then the cookie is deleted. The cookie contains no identifier, is not shared with anyone and is only read by Runbook (legitimate interest, Art. 6(1)(f) GDPR). There are no analytics, tracking or advertising cookies, and no third-party scripts.

5. Processors and where data is stored

Hetzner Online GmbH, Germany: servers and backups, in data centres in Germany (EU).
Stripe Payments Europe Ltd., Ireland (with Stripe, Inc., USA): payment processing for paid plans. Transfers to the USA are covered by the EU-US and Swiss-US Data Privacy Framework and standard contractual clauses.
Our mail server (mail.metikular.ch, operated by us in Europe): delivery of all emails.
Slack, Microsoft or other webhook receivers, only if your organization configures them: run titles, item texts and names are sent to the URL you enter.

Switzerland recognises the EU/EEA as providing adequate data protection.

6. How long we keep data

Account and content: as long as your account or organization exists. When you delete them (in the app), they are deleted immediately and disappear from backups within 30 days.
Sign-in links: 15 minutes (records deleted after one day). Sessions: 30 days.
Sent notifications: 30 days; failed deliveries: 90 days.
Billing records: 10 years, as required by Swiss bookkeeping law (Art. 958f CO).
Server logs: at most 30 days.

7. Your rights

You have the right to access your data, to correct it, to have it deleted, to receive it in a portable format, to restrict or object to processing, and to withdraw consent. Many of these you can exercise yourself: owners can download a JSON export of an organization (Settings → Your data), and anyone can delete their account (Your account). For anything else, write to hello@metastic.ch; we answer within 30 days. You may also complain to a supervisory authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC/EDÖB), or the authority of your EU country of residence.

8. Security

All traffic is encrypted (HTTPS with HSTS). Sign-in uses one-time links instead of passwords; tokens and sessions are stored only as hashes. Data of different organizations is strictly separated. Servers are kept up to date and backed up daily.

9. Changes

We update this policy when the service changes. The version date is shown at the top; material changes are announced by email.