Users in over twenty US states, as well as the EU, UK, and Japan, have rights under local law to access, delete, correct, or port their personal data, object to certain processing, and opt out of direct marketing. These rights can be exercised by emailing privacy@runwayml.com.
This analysis describes what Runway's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy identifies a broad set of jurisdictions where users have statutory data rights and provides a single email address as the submission mechanism, which means users in these states can formally request access to or deletion of the data Runway holds about them.
Users in the listed US states, EU, UK, and Japan can email privacy@runwayml.com to exercise rights including data access, deletion, correction, and portability; the policy also states that users in states including Colorado, Connecticut, and Oregon may appeal a denial of their request by emailing the same address.
How other platforms handle this
If you are a California resident, you may have certain rights under the California Consumer Privacy Act (CCPA). These rights may include: the right to know about personal information collected, disclosed, or sold; the right to delete personal information collected from you; the right to opt-out of t...
Depending on where you live, you may have certain rights with respect to your personal information. These rights may include: The right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which we collected i...
If you are located in the European Economic Area or the United Kingdom, you have certain rights under applicable data protection laws, including the right to access, correct, or delete your personal data, the right to object to or restrict processing, and the right to data portability. You may also ...
Monitoring
Runway has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"In addition to the above rights, your local laws (including those in the EU, UK, Japan, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia, or Utah) may afford you further rights, which may include: Right to know the categories and specific pieces of personal information we have collected, used, or shared; Right to delete, correct, or update your personal information; Right to prevent the processing of your information for direct marketing purposes (including any direct marketing processing based on profiling); Right to restrict the way that we process and disclose certain information about you; Right to object to certain processing of your personal information; Right to revoke your consent for the processing of your personal information; Right to be free from discrimination for exercising your rights; Right to data portability; and Right to information about financial incentives that we offer to you, if any.— Excerpt from Runway's Runway Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages the GDPR, UK GDPR, California CCPA and CPRA, and state privacy laws across more than fifteen US states. Enforcement authorities include the California Privacy Protection Agency, state attorneys general in all listed states, EU data protection authorities, and the UK Information Commissioner's Office. The policy's use of qualified language ('may afford you further rights') rather than unconditional acknowledgment may be reviewed by regulators in states that mandate affirmative disclosure of rights. (2) GOVERNANCE EXPOSURE: Medium. Runway's use of a single email address for all data subject requests creates an operational dependency on the responsiveness and verification processes of the privacy@runwayml.com inbox; compliance teams should verify that Runway's response timelines and verification procedures satisfy the statutory deadlines in each listed jurisdiction (45 days under CCPA, one month under GDPR, etc.). (3) JURISDICTION FLAGS: California imposes the most detailed requirements including the right to know, delete, correct, and opt out, with specific timelines and authorized agent provisions. EU and UK users have GDPR rights with specific response deadlines and the right to lodge supervisory authority complaints. Japan's Act on Protection of Personal Information imposes separate disclosure and access rights. Colorado and Connecticut provide appeal rights for denied requests, which Runway acknowledges. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers operating in multiple jurisdictions should confirm with Runway whether a single data subject request submitted to privacy@runwayml.com is processed consistently across all listed jurisdictions or whether jurisdiction-specific procedures apply. The authorized agent provision for California residents should be assessed for operational completeness, including what constitutes acceptable proof of authorization. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the data subject request process at privacy@runwayml.com has documented response time targets aligned with the fastest applicable statutory deadline across all listed jurisdictions. Data mapping exercises should confirm that all categories of user data described in this policy, including biometric data, prompts, and outputs, are within scope for deletion and access requests.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The policy identifies a broad set of jurisdictions where users have statutory data rights and provides a single email address as the submission mechanism, which means users in these states can formally request access to or deletion of the data Runway holds about them.
Users in the listed US states, EU, UK, and Japan can email privacy@runwayml.com to exercise rights including data access, deletion, correction, and portability; the policy also states that users in states including Colorado, Connecticut, and Oregon may appeal a denial of their request by emailing the same address.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Runway.