Privacy Policy
v2026-08-22
This policy explains what Spinrun does with personal data. It covers the marketing site, the application, and the gateway your agents call.
For data you send through the gateway, you are the controller and we are your processor: you decide what your agents do, and we carry it out. For your own account and billing details, we are the controller.
01Who we are
Spinrun is operated by BirdAI S.R.L., a company registered in Romania. It is the controller for account, billing and website data, and the processor for everything your agents send through the gateway.
- Legal name — BirdAI S.R.L.
- Registered office — Str. Dinicu Golescu nr. 7, Sector 1, București, Romania
- Privacy contact — legal@spinrun.ai
02Controller and processor
We are the controller for the data we need in order to run the business: your account, your workspace, your plan, the invoices, the security and abuse signals, and the support conversation.
We are your processor for everything else — the arguments your agents send, the responses they get back, the artifacts they write, and anything you put into Brain. You decide what happens to that data; we act on your instructions, which are the configuration you set and the calls your agents make. Providing notice to the people whose data that is, and having a lawful basis for it, remains yours.
03What we collect
Six kinds of data, for six different reasons.
Account data
Your name, email address, workspace name, role and plan. Needed to give you an account, put you in a workspace, and bill it.
Connection credentials
The OAuth tokens or API keys you grant when you connect an application, the scopes they carry, and when they were last used. Needed for an agent to act on your behalf. Held in an encrypted vault, never in configuration files or environment variables.
Content your agents send
The arguments of each call, a preview of each response, the artifacts agents write, and anything you add to Brain. This is your data. We hold it to run the Service and to let you see what happened.
Activity and security data
A record of each gateway call: which tool ran, the action, the outcome, how long it took. Alongside it, the ordinary operational record — IP address, user agent, timestamps, rate-limit and abuse signals, errors. Needed so you can see what your agents did, debug it when they get it wrong, and so we can keep the Service standing up.
Billing data
Plan, billing contact and invoices. We do not run self-serve checkout and do not take card payments, so no card number ever reaches us — there is nothing to store and nothing to leak.
Usage data
How the site and the product are used, in two separate halves that never meet.
On the marketing pages, and only if you accept the cookie banner, PostHog records which pages are opened, what is clicked, and a replay of the page as you saw it with every input field masked. Refusing costs you nothing and changes nothing about what you can read.
Inside the product, we record a short list of milestone events on our own servers — today, a workspace being created and a connection being added — against your account identifier. No script runs in your browser for this, nothing is stored on your device, and the events never carry what your agents read or wrote. If the list grows, it grows in the same direction: what happened, never what was in it.
04What we do not do
We do not sell personal data. We do not use your content or your connected application data to train machine-learning models, and we do not permit the providers we use to do so either.
We run no advertising technology: no tracking pixel, no retargeting tag, nothing that follows you off this site or builds a profile of you to sell. There is no error-reporting vendor watching your session, and no third-party script of any kind runs inside the product.
The one measurement tool we do run is PostHog, on the marketing pages, and it does not load until you have accepted it. If you refuse, nothing is requested from it and nothing about your visit is measured.
We do not read your connected applications for any purpose other than carrying out the calls your agents make.
05Why we are allowed to
Under the GDPR every purpose needs a lawful basis. Ours are:
- Contract — creating and running your account, executing the calls your agents make, holding your connections, metering credits, and answering support.
- Legitimate interests — keeping the Service secure and available, investigating abuse, debugging failures, understanding which parts of the product are used from the server-side events described above, and keeping the business records a company has to keep — weighed each time against the rights of the people whose data it is. You can object to any of it at the address below.
- Consent — analytics cookies on the marketing site, and nothing else. It is asked for before anything loads, never assumed from continued browsing, and withdrawing it is one click from the footer of any page.
- Legal obligation — tax and accounting records, and responding to a lawful request from an authority.
- Your instructions — everything we process as your processor, where the basis for the underlying data is yours to establish rather than ours.
06AI processing
Two parts of the Service send data to a model. The playground sends your conversation and the tool results it receives. Brain sends the documents you ingest, in order to turn them into embeddings that make search work.
Both go to Google's Gemini models, and both reach them only through the Vercel AI Gateway — we hold no model-provider keys of our own. The gateway is the single route, which means there is exactly one place to look when you want to know where a prompt went.
Neither we nor the providers we route through are permitted to train on your content. Model output is generated text: it can be wrong, and it is your decision what to do with it. Nothing the model produces is used to make a decision about a person with legal or similarly significant effect.
07How it is protected
The measures that matter most, stated plainly:
- Connection credentials are held in an encrypted vault, never in configuration files or environment variables.
- Every workspace is isolated at the database row level, so one workspace's queries cannot reach another's rows.
- Read, write and destructive rules are enforced at the gateway, before a call reaches the connected application — not in a prompt, which an agent can talk itself out of.
- Agent-authored content is served sandboxed, from an opaque origin, with no session cookie attached. The routes that serve it are deliberately excluded from the middleware that would otherwise set one.
- Object storage is private. No pre-signed URL is ever minted; every read goes through an authenticated route.
- The nightly retention job authenticates with a shared secret and refuses to run without it, so it fails closed rather than open.
08How long it is kept
Activity logs and the payloads inside them have separate windows, both set by your plan. A job at 04:00 UTC each night scrubs payloads past their window, deletes log rows past theirs, and does it automatically rather than on request.
Free7 days / 1 dayPro30 days / 7 daysBusiness90 days / 30 daysEnterprise365 days / 90 days- Offloaded tool results — when a response is too large to hand back inline it is stored and referenced by a handle. Both the record and the stored object are deleted 24 hours later, on a fixed timer that no plan extends.
- Sandbox keys — short-lived credentials issued to a sandbox are deleted one day after they expire.
- Usage data — analytics events and session replays are deleted on the retention window configured in our PostHog project, and replays are kept for a materially shorter time than events. Withdrawing consent stops any further collection immediately; to have what was already collected deleted, write to us and we will remove it.
- Account data — kept while your workspace exists. When you close it, connected authorisations are revoked and workspace data is deleted, except where we must keep records to meet a legal obligation — invoices, most commonly, which Romanian law requires us to keep for ten years.
09Who else processes it
We use a small number of subprocessors to run the Service. Each is bound by a data-processing agreement, and we give 14 days' notice before a new one starts processing your data.
SupabaseDatabase, authentication, queues and vector search.VercelApplication hosting and delivery.Vercel AI GatewayRoutes every model call. The only path inference takes.GoogleThe Gemini models behind the playground and Brain embeddings, and Google sign-in.Vercel SandboxRuns agent-authored code, on plans where sandboxes are enabled.Cloudflare R2Storage for agent-authored artifacts and offloaded tool results.ComposioThe toolkit catalogue and connection infrastructure behind many integrations.CloudflareTransactional email — invitations and admin notices.PostHogAnalytics for the marketing site, on European servers. Receives nothing until you accept the cookie banner. Also receives the server-side product events described above.10International transfers
Some subprocessors operate outside the European Economic Area. Where data leaves the EEA it is transferred under the Standard Contractual Clauses adopted by the European Commission, or an equivalent approved mechanism, with technical measures — encryption in transit and at rest, access control — behind them. Write to us if you want the detail for a particular provider.
Analytics is deliberately not one of them. PostHog is used on its European instance, so nothing measured about your visit or your use of the product leaves the EEA in the first place — which is a stronger answer than a transfer safeguard, and the reason that instance was chosen.
11Your rights
Under the GDPR you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict how we process it, withdraw a consent you gave, and ask for your data in a portable form. Write to legal@spinrun.ai and we will respond within one month. We may need to confirm who you are first, and where we hold the data as someone else's processor we will pass the request to them rather than act on it ourselves.
We have not appointed a Data Protection Officer; the GDPR does not require one for processing of this kind. Requests go to the address above and are handled by the people who built the Service.
If you are unhappy with how we have handled a request you can complain to your national data protection authority. In Romania that is Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) — https://www.dataprotection.ro/, anspdcp@dataprotection.ro, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania.
13Children
The Service is not directed at children and we do not knowingly collect their personal data. If you believe a child has given us data, write to legal@spinrun.ai and we will delete it.
14Changes
We update this policy when the Service, our subprocessors, or the law change. The date at the top always reflects the current version, and we tell workspace owners by email before a material change takes effect.
15Contact
Privacy questions and data requests go to legal@spinrun.ai. Anything else reaches us at sales@spinrun.ai.