Privacy Policy

Last updated October 11, 2026 · Runsheet is operated by SÔZ Studios Atelier, Laguna Beach, California · Questions: hello@runsheet.tech

In plain words: we collect what we need to run a directory, a review site and a production dashboard — your account details, what you put into the dashboard, reviews you write, and basic usage data. We do not sell personal information, we do not use your styles or tech packs to train AI, and reviewers’ email addresses are never shown to the business they reviewed. If you connect a bank account, the connection is read-only: Runsheet can see transactions to spot invoice payments but can never move money, and your bank login stays with Stripe and your bank. You can see, export or delete your data by emailing hello@runsheet.tech.

1. Who this covers

This policy applies to runsheet.tech, app.runsheet.tech, directory.runsheet.tech, our emails and the tools linked from them (the “Service”), operated by SÔZ Studios Atelier, Laguna Beach, California (“Runsheet”, “we”). It covers visitors, people who create accounts (brands, consultants and their teammates), businesses listed in the directory, reviewers, and people who post or answer briefs.

2. What we collect

You give us

Account details: name, email address, password (held by our login provider, Clerk — we never see it), company or brand name, role, and the teammates you invite.
Dashboard content: styles, photos and sketches, tech packs, measurements, costing and pricing, purchase orders, invoices, client and factory records, sampling rounds, files, tasks and notes. This may include names and contact details of your clients, factory contacts and buyers. Every file you upload anywhere in the Dashboard is also listed in your file library, so you and your teammates can search, preview and download it in one place; the library is a view of the same files, not a second copy shared with anyone else.
Factory accounts (Factory Studio): if you run a factory account, what you put into Factory Studio — the brands you produce for, production orders and their steps, floor counts entered at your stations (station links work without a login and reach only their own station), costing, weekly capacity, invoices, files, and any spreadsheet of orders you import. Brands you work with on Runsheet see only what is sent to them (for example an approval, a purchase-order update or an invoice), never your costing, margins or other brands.
Saved vendors: suppliers you save (for example fabric mills, trims or care-label makers): name, category, website, location, contact details and your private notes. We check saved vendors against the Runsheet directories. If one isn’t listed, we ask whether you’d like us to add it; only if you say yes do we receive a suggestion with the business’s name, website, category and location (plus any note you choose to add) so we can review and list it. Your private notes, pricing and contact names are not published.
Bobbin, the AI assistant (optional): what you type to Bobbin, and the parts of your Dashboard data it needs to answer or draft (for example the styles, samples, quotes, orders, invoices, time entries, clients or briefs involved), are sent to our AI provider, Anthropic, for that request. The same applies to what you give Bobbin to work on: an email you paste, replies that factories or brands send to your Runsheet reply address, fit photos, a tech pack PDF, and the column names and a few sample rows of a spreadsheet you import. We keep a log of Bobbin requests and replies to support you and improve answers. Bobbin drafts; it does not send messages to other people without you choosing to send them, and changes it proposes to your records (dates, prices, quantities, measurements) are made only when you tick and apply them.
How you heard about us: if you answer “How did you hear about Runsheet?” when you sign up, we keep your answer with your account.
Reviews: your ratings, written review, display name, reviewer category and, privately, your email and any evidence of the engagement you choose to send us for verification.
Directory and listing information: business name, location, capabilities, MOQ, lead times, certifications, website, contact name, email and phone — from you when you claim or create a listing, or from public sources for unclaimed listings.
Briefs and introductions: what you are making, quantities, timelines, budgets and the contact details you want factories to use.
Job board: if you post a free listing, the role details plus your name and email (used only if we need to follow up before it goes live — never shown publicly). If you use “know someone for this role?”, the first name and email of the person you name — used only to send that one email, never used for anything else. If you use “check your fit”, the resume file you upload for that one request — see Section 4 for how it’s handled.
Payments: handled by Stripe. We receive your name, email, the plan purchased, the last four digits of the card and a Stripe customer ID — never the full card number.
Messages you send us by email, feedback forms or the sandbox’s one-question surveys.
Google Calendar (optional): if you connect it from the Dashboard, Google gives us an access token (never your Google password) scoped to Calendar only — not Gmail, Drive or anything else in your account. We use it to show your existing events alongside your Runsheet tasks and milestones on Home, and to create and update a dedicated “Runsheet” calendar with your style milestones, target dates and forecast ex-factory dates. Disconnect any time from Settings; this revokes the token immediately and stops new syncing, though events already written to your calendar are not automatically deleted.
QuickBooks Online (optional): if you connect it, Intuit gives us an access token (never your Intuit password). We use it to send the invoices you choose to QuickBooks and, when you ask us to check, to read back the balance of those same invoices so ones QuickBooks shows as paid can be marked paid in Runsheet. We do not read your other books. Disconnect any time from Integrations; this revokes the token.
Shopify (optional): if you connect a store, we keep the store address and the access token you provide, and use them only to push the styles and size guides you choose and to pull inventory for those styles. Disconnect any time from Integrations, or uninstall the app in Shopify.
Adobe Illustrator panel (optional): the panel connects when you approve it in your browser while signed in to Runsheet (or with an API key you create in Integrations); the key is stored only in the panel on your computer, and you can remove it any time under Integrations. When you send an artboard, we store the image (and, if you choose, its SVG file) as that style’s flat; when you send a swatch group, we store the color names, values and Pantone references as the style’s colorways. The panel reads nothing else from your documents.
CLO 3D button (optional): it connects the same way, and its key is stored in a file only your user account can read on your computer. When you press Send to Runsheet, it uploads a render of each colorway, the colorway names and the file’s name, which wait for you to choose a style (the link works for 7 days); once you add them, the renders are stored as that style’s files and the names as its colorways. It reads nothing else from your garment files.
Bank connection (optional, consultant and Factory Studio accounts): if you connect a business bank account, the connection runs through Stripe Financial Connections. You sign in to your bank with Stripe, not with Runsheet; we never see or store your bank username, password or full account number. The connection is read-only and limited to transactions: Runsheet cannot move money, make payments or see your balance through it. We receive incoming transactions (amount, date and the bank’s description) and the bank name and last four digits of the account, and use them only to find deposits that match your open invoices. When a deposit matches exactly one open invoice, we mark that invoice paid; when it could match more than one, we show it to you and change nothing. We keep only the matches and near-matches (amount, date, description and the invoice they relate to) and a list of transaction IDs already checked so we don’t check them twice — not your full transaction history. Disconnect any time from Integrations; we then tell Stripe to end the connection and stop receiving transactions, and we delete the near-matches and checked-transaction list. Invoices already marked paid stay marked paid. Stripe’s handling of the connection is covered by its own privacy policy (stripe.com/privacy).
Slack (optional): if you connect a channel from the Dashboard, you give us a Slack incoming-webhook URL. We keep it in our database (and only ever show part of it back to you), use it only to post the notifications you chose (for example quotes, sample updates and purchase orders) to that channel, and never read anything from your Slack workspace. Disconnect any time from Integrations, or delete the webhook in Slack.

Collected automatically

Usage and device data: pages viewed, actions taken in the Dashboard (which we log as an activity history your team can see — for example “Ed moved The Theo Blazer to Sampling”), IP address, browser and device type, referring page, and timestamps.
Cookies and local storage: a session cookie for login (Clerk), a cookie remembering which of your accounts you last opened, and browser storage for conveniences such as your theme, the last section you were in, dismissed nudges and unsent drafts. Our marketing site (Squarespace) sets its own analytics cookies, which you can manage through its cookie banner. We also set one first-party cookie (rs_ft, kept for 180 days) on your first visit that remembers where you came from — the referring website, any campaign (utm) tags in the link and the page you landed on — so that if you later sign up we can see which channels bring people to Runsheet. It is never overwritten, never shared with advertisers, and is stored with your account only if you sign up. We do not use cookies for remarketing or ad personalisation. The one exception to “no advertising cookies”: our Post a Brief page (/post-a-brief) loads a Google Ads conversion tag, which sets cookies so we can tell whether a visitor who clicked one of our Google ads went on to post a brief. It runs on that page only, with ad personalisation signals turned off, and we do not use it to build advertising audiences. You can block it with any standard content blocker, or manage Google’s ad settings at adssettings.google.com.

3. How we use it

To provide the Service: run your dashboard, generate tech pack drafts from what you upload, send sampling rounds and line sheets to the people you choose, publish listings and reviews, connect briefs and introductions, bill your plan, and — if you connect it — sync production milestones to Google Calendar.
To communicate: transactional email (verification codes, approvals, invoices, @mentions, a daily summary of what needs you), service announcements, and — if you signed up for them or created an account — occasional product updates. Every marketing email has an unsubscribe link or a reply-to-stop line, and we honour it.
To keep the Service safe and honest: verifying reviews, detecting fraud or abuse, enforcing our Terms, and keeping the directory accurate.
To improve the Service: aggregated, de-identified usage analysis. We do not use Your Content (styles, tech packs, files, client data) to train AI models, and we do not permit our AI provider to do so.
To comply with law and protect rights, including tax and accounting records.

4. Who we share it with

We do not sell personal information, and we have not sold or shared it for cross-context behavioural advertising in the preceding 12 months. We share data only:

With people you choose: teammates on your account; a factory you send a sampling round, approval or fit check to; a buyer you send a line sheet to; a consultant or brand you connect with through a brief or introduction. What they see is what you send.
Publicly, where the feature is public: directory listings, consultant and factory profiles, approved reviews (display name only — never the reviewer’s email), and factory responses.
With service providers who process data on our behalf under contract: Vercel (hosting, file storage, logs), Airtable (database), Clerk (authentication), Stripe (payments and, if you connect a bank, Financial Connections), Resend (email delivery), OpenAI (tech pack drafting — receives the photo, sketch and description you submit for a draft, and per its API terms does not train on it), Anthropic (Bobbin, the AI assistant — receives your request and the Dashboard data needed to answer it; job board “check your fit” — receives the resume PDF you upload plus the listing’s own text for that one request only; we do not store the file afterward; and the “describe your brief” tool on /start-a-brief — receives the text you type so it can be sorted into brief fields, for that one request only; per Anthropic’s API terms neither is used to train models. Please don’t put passwords, payment details or other sensitive personal data in that text), Squarespace (marketing site and forms), Make (automation), Google Workspace (our email), Google Ads (conversion measurement on /post-a-brief only — see Cookies above) and, only if you connect them, the Google Calendar API, Intuit QuickBooks, Shopify and Slack (see above). Each receives only what it needs.
For legal reasons: to comply with law, a court order or a valid government request; to enforce our Terms; or to protect the rights, safety or property of Runsheet, our users or the public.
In a business transfer: if Runsheet is acquired or merges, your data may transfer to the successor, who will be bound by this policy.

5. Reviews and the businesses reviewed

A reviewed business sees the review, your display name and reviewer category, and can post one public response. It never sees your email address or the evidence you sent us for verification. If a business disputes a review we may ask you for more detail, and we may share a summary of your evidence with the business only with your consent. We may keep verification evidence for as long as the review is published.

6. Directory listings for businesses

Business contact details in unclaimed listings come from public sources (company websites, industry directories, trade associations) and are used to display the listing, to route briefs and introductions, and occasionally to invite the business to claim its page. Business email addresses are not displayed publicly. To claim, correct or remove a listing, or to opt the business out of invitation emails, write to hello@runsheet.tech.

7. How long we keep it

Account and Dashboard content: while your account is open, and for 90 days after you close it (so you can change your mind), then deleted, except invoices and payment records kept for 7 years for tax and accounting.
Reviews: while published. If you delete your account, your reviews stay published under your display name unless you ask us to remove them.
Directory listings: while the business is listed.
Activity logs, Bobbin request logs and server logs: up to 12 months.
Bank connection: the last 20 matches and near-matches and the list of checked transaction IDs, while the bank is connected; on disconnect the near-matches and the list are deleted. The paid status and payment date on your invoices are kept with your invoices.
First-touch cookie (rs_ft): 180 days in your browser; if you sign up, the source it recorded is kept with your account.
Vendor suggestions you approve: kept with our directory records; once a business is listed, its listing follows Section 6.
Email and support correspondence: up to 3 years.
Job board referrals (“know someone for this role?”): kept only so we can watch for abuse, never used for anything else. Resumes uploaded for “check your fit”: not stored at all — sent for one request and discarded.

8. Your choices and rights

You can update most account details in the Dashboard. Email hello@runsheet.tech to: see the personal information we hold about you; get a copy of Your Content in a portable form; correct or delete it; close your account; or stop marketing emails. We respond within 30 days and will verify the request comes from the account holder.

California residents (CCPA/CPRA) have the right to know what personal information we collect, use and disclose; to request deletion or correction; to opt out of sale or sharing (we do neither); to limit use of sensitive personal information (we collect none beyond login credentials held by Clerk); and not to be discriminated against for exercising these rights. Send requests to hello@runsheet.tech; an authorised agent may submit on your behalf with written permission.

Residents of the UK, EEA and Switzerland: we process your data on the basis of contract (providing the Service), legitimate interests (running, securing and improving it; operating a directory and review site in the public interest), consent (marketing emails, cookies on the marketing site) and legal obligation. You have rights of access, rectification, erasure, restriction, portability and objection, and may complain to your supervisory authority. Data is processed in the United States; where required we rely on standard contractual clauses with our providers.

9. Security

Data is encrypted in transit (TLS) and at rest with our providers. Access to production systems is limited to the people who run Runsheet and protected by multi-factor authentication. Passwords are handled entirely by Clerk. Public links (sampling rounds, approvals, line sheets, claim links) use long random tokens that we can rotate on request. Integration tokens (Google, QuickBooks, Shopify, Slack) are stored server-side and never shown back in full. Bank connections are held by Stripe; Runsheet stores only Stripe’s reference to the connected account, never bank credentials. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the relevant authorities as the law requires.

10. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect information from children; if you believe we have, contact hello@runsheet.tech and we will delete it.

11. Do Not Track and global privacy controls

The app does not track you across other sites, so there is nothing to opt out of; we treat Global Privacy Control signals as a request to opt out of any sale or sharing, which we do not do.

12. Changes

We will post changes here with a new “last updated” date and, for material changes, email account holders at least 14 days before they take effect.

13. Contact

SÔZ Studios Atelier · Laguna Beach, California · hello@runsheet.tech