Enterprise Account Administrator Access

What it is

If you use Runway through a workplace or team account, your employer's account administrator can access and control your Runway account. Runway may also share your email address with your employer if you signed up using a work email address.

Why it matters (compliance & governance perspective)

Employees using Runway with work email addresses may have their account information disclosed to their employer without a separate consent step, and enterprise account administrators are granted access and control rights over individual user accounts.

Consumer impact (what this means for users)

Users who access Runway through an employer-managed enterprise or team account should be aware that their employer's administrator can access and control their Runway account. Users who registered with a work email address may have that email disclosed to their employer or organization by Runway.

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision engages employment privacy law considerations that vary significantly by jurisdiction. In the EU and UK, employer access to employee accounts may require disclosure under GDPR Article 13/14 and must be supported by a legitimate legal basis. In California, the CCPA applies to employees of covered businesses. US federal law does not comprehensively regulate employer monitoring, but state-level employee privacy statutes in states such as Connecticut and Delaware impose notice requirements for electronic monitoring. 2) GOVERNANCE EXPOSURE: Medium. The provision grants enterprise account administrators broad access and control rights over individual user accounts. For compliance teams, this creates questions about whether users are adequately informed at the point of account creation that employer administrators will have this level of access. The email disclosure mechanism, which allows Runway to share user email addresses with employers based solely on email domain, may be considered a disclosure without explicit user consent in some contexts. 3) JURISDICTION FLAGS: EU and UK users are subject to GDPR, which requires transparent disclosure of the controller-processor relationship and legal basis for processing. Employees in jurisdictions with specific electronic monitoring notice requirements (such as Connecticut and Delaware) may have additional protections. Multinational enterprise deployments should assess whether administrator access rights are disclosed consistently with local law requirements across all operating jurisdictions. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should ensure their terms of service and internal policies clearly inform employees of administrator access rights before deploying Runway in a team or enterprise configuration. Data processing agreements between Runway and enterprise customers should address the scope of administrator access, audit rights, and obligations regarding employee personal data. 5) COMPLIANCE CONSIDERATIONS: Enterprise HR and legal teams should assess whether the administrator access rights described in this provision are disclosed to employees in onboarding documentation and acceptable use policies. The email domain-based disclosure mechanism should be reviewed to determine whether it is consistent with the organization's data governance obligations and employee privacy expectations. GDPR Article 88 and national implementing laws may impose additional requirements for processing employee personal data in EU member states.

Applicable agencies

Provision details

Other risks in this policy

• Biometric Data Collection high
• Advertising Partner Disclosure as Potential CCPA Sale high
• User Content Collection Including Prompts and Generated Outputs medium
• Business Transferee Data Disclosure medium
• GDPR Legitimate Interests Legal Basis medium
• Children's Privacy and Age Restriction medium

Related Analysis

• Robinhood's Agreement Authorizes Position Liquidation Without Prior Notice

  Buried in Robinhood's customer agreement is broad authority to close your positions, suspend your account, and force arbitration. Here is what it actually says.

• Stripe's Reserve and Hold Authority: What the Terms Authorize

  Stripe's terms authorize fund reserves, payout withholding, and account termination. Here is what the agreement states and what business owners should review.