Users in over twenty US states, as well as the EU, UK, and Japan, have rights under local law to access, delete, correct, or port their personal data, object to certain processing, and opt out of direct marketing. These rights can be exercised by emailing privacy@runwayml.com.
This analysis describes what Runway's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The clause establishes the entity's recognition of multi-jurisdictional privacy law obligations and reserves users' statutory rights without modifying or limiting them through the agreement. This provision creates a framework for compliance with fragmented privacy regulations across multiple state and international regimes.
Users in the listed US states, EU, UK, and Japan can email privacy@runwayml.com to exercise rights including data access, deletion, correction, and portability; the policy also states that users in states including Colorado, Connecticut, and Oregon may appeal a denial of their request by emailing the same address.
How other platforms handle this
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
If you are a California resident, you may have the right to: Know what personal information we collect, use, disclose, sell, or share. Correct inaccurate personal information. Delete your personal information. Opt out of the sale or sharing of your personal information. Limit the use and disclosure ...
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
Monitoring
Runway has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"In addition to the above rights, your local laws (including those in the EU, UK, Japan, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia, or Utah) may afford you further rights, which may include: Right to know the categories and specific pieces of personal information we have collected, used, or shared; Right to delete, correct, or update your personal information; Right to prevent the processing of your information for direct marketing purposes (including any direct marketing processing based on profiling); Right to restrict the way that we process and disclose certain information about you; Right to object to certain processing of your personal information; Right to revoke your consent for the processing of your personal information; Right to be free from discrimination for exercising your rights; Right to data portability; and Right to information about financial incentives that we offer to you, if any.— Excerpt from Runway's Runway Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages the GDPR, UK GDPR, California CCPA and CPRA, and state privacy laws across more than fifteen US states. Enforcement authorities include the California Privacy Protection Agency, state attorneys general in all listed states, EU data protection authorities, and the UK Information Commissioner's Office. The policy's use of qualified language ('may afford you further rights') rather than unconditional acknowledgment may be reviewed by regulators in states that mandate affirmative disclosure of rights. (2) GOVERNANCE EXPOSURE: Medium. Runway's use of a single email address for all data subject requests creates an operational dependency on the responsiveness and verification processes of the privacy@runwayml.com inbox; compliance teams should verify that Runway's response timelines and verification procedures satisfy the statutory deadlines in each listed jurisdiction (45 days under CCPA, one month under GDPR, etc.). (3) JURISDICTION FLAGS: California imposes the most detailed requirements including the right to know, delete, correct, and opt out, with specific timelines and authorized agent provisions. EU and UK users have GDPR rights with specific response deadlines and the right to lodge supervisory authority complaints. Japan's Act on Protection of Personal Information imposes separate disclosure and access rights. Colorado and Connecticut provide appeal rights for denied requests, which Runway acknowledges. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers operating in multiple jurisdictions should confirm with Runway whether a single data subject request submitted to privacy@runwayml.com is processed consistently across all listed jurisdictions or whether jurisdiction-specific procedures apply. The authorized agent provision for California residents should be assessed for operational completeness, including what constitutes acceptable proof of authorization. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the data subject request process at privacy@runwayml.com has documented response time targets aligned with the fastest applicable statutory deadline across all listed jurisdictions. Data mapping exercises should confirm that all categories of user data described in this policy, including biometric data, prompts, and outputs, are within scope for deletion and access requests.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The clause establishes the entity's recognition of multi-jurisdictional privacy law obligations and reserves users' statutory rights without modifying or limiting them through the agreement. This provision creates a framework for compliance with fragmented privacy regulations across multiple state and international regimes.
Users in the listed US states, EU, UK, and Japan can email privacy@runwayml.com to exercise rights including data access, deletion, correction, and portability; the policy also states that users in states including Colorado, Connecticut, and Oregon may appeal a denial of their request by emailing the same address.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Runway.