RunOps Studio
Last updated: 14 November 2026
We help companies build the operating system they run on. That work only functions on trust, and trust starts with knowing exactly what happens to your data.
This page tells you that in plain language.
The short version
- We collect what we need to answer you, do the work and get paid. Nothing else.
- We never sell your data and we run no advertising trackers.
- Marketing emails go out only if you asked for it, and one click stops it.
- AI notes in meetings only when announced, and off if anyone objects. No audio kept.
- Your workspace stays yours. You decide what we see and for how long.
- Any question: hello@runopsstudio.com. We answer within a month, usually the same week.
1. Who we are
Item | Detail |
Controller | Vertex Creative and Data Solutions FZCO |
Trading name | RunOps Studio |
Registered address | DSO-THUB-G-D-FLEX-G140B, THUB Building, Dubai Silicon Oasis, Dubai, United Arab Emirates |
Licence number | 49141 |
Registration authority | Dubai Silicon Oasis Authority, part of the Dubai Integrated Economic Zones Authority |
Tax Registration Number | TRN 104752707000003 |
Contact |
We decide what happens to the data described here, which makes us the controller for it. The exception is the data inside your own workspace, covered in section 4.
Our services are built for businesses.
2. Which law applies
We are licensed in Dubai Silicon Oasis, so the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies to us, supervised by the UAE Data Office. We work with clients worldwide, so the law of your own country may apply as well. Where it gives you more, you get more.
This policy is governed by the federal laws of the United Arab Emirates and the laws of Dubai.
3. What we collect and why
In short: you visit, ask, take the assessment, subscribe, buy or work with us. Each has its own rules.
You... | What we get | Why · basis | Kept |
Visit the site | IP address, browser, device, pages viewed, referring page and timestamps, logged by our hosting and security providers and counted by Super Analytics, which places nothing on your device | To keep the site up, fast and safe · legitimate interest | As long as those providers keep their logs. We do not use them to identify you. |
Contact us | Name, email, phone, your message and whatever else you add | To answer you, plan an intake call, write a proposal · your consent and steps towards a contract | 12 months after our last exchange if nothing follows |
Take the Operational Assessment | Name, email, your scores and the confirmation in the form | To build and send your result and follow up on it · consent | 24 months, or until you ask us to delete it |
Subscribe | Email, and your name if you give it. Sent through MailerLite | To send what you signed up for · consent | Until you unsubscribe, then on a suppression list so we do not email you again |
Become a client | Contact and billing details, proposals, contracts, notes, the workspace content you share, and payment details: amount, status, invoice number, and the card brand and last four digits where a payment provider passes them to us. | To deliver, invoice, support and administer · our contract, tax law, legitimate interest | Accounting records 7 years after the tax period. Everything else 2 years after the engagement ends, longer only for a legal claim |
Buy a template | Your email address only. Templates are sold only on the Notion Marketplace: Notion takes the payment and passes us your email address if you choose to share it at purchase | To deliver the template, support you, keep our accounts · our contract and tax law | Accounting records 7 years, everything else 2 years after purchase |
Apply or propose something | Whatever is in your message, CV or profile | To assess it · consent and legitimate interest | 4 weeks after we decide, 12 months if you agree |
Card numbers never reach us. They go straight to the payment provider.
Every email says who it is from and carries a working unsubscribe link. We do not buy lists.
Your Assessment result is a calculation on your own answers. Nothing else feeds it, and it decides nothing about you.
4. Your team's data
In short: your data, our work. You stay in charge.
Building ownership maps and meeting structures puts your employees' names, roles and work emails in front of us. For that data, and for any customer data you share for a migration, you are the controller and we are your processor: we use it only for the work, under our agreement and, where needed, a data processing agreement.
We work inside your own tools wherever possible and delete our working copies within 30 days of go-live. Send us only what the work needs, and no special category data such as health or biometric information.
5. Cookies
Our site uses cookies to run and stay secure, and our analytics counts visits without placing anything on your device. Which cookies, and how to manage them, is in our Cookie Policy.
6. Who else touches your data
In short: a short list of providers, each under contract, most outside the UAE.
We never sell your data. We use the providers below, each bound by contract to keep it confidential and secure, and to use it only to provide their service to us. Most sit outside the UAE, so your data travels.
What for | Provider | Where |
Site hosting and publishing | United States | |
Workspace, content, template sales and AI meeting notes | Notion Labs, Inc. | United States |
Delivery, security, images | Cloudflare, Inc. | Global |
Site analytics | Super.so | United States |
Payments and invoicing | Stripe and affiliates | United States, Ireland |
Email | Google Workspace | Global |
Documents | Google Workspace | Global |
Newsletter | MailerLite | European Union |
Calls | Zoom | United States |
Bookkeeping | Zoho Books | India, UAE, United States |
Scheduling | TidyCal | United States |
We send data abroad only where the PDPL allows it: the destination offers adequate protection, a contract imposes PDPL-level safeguards, the transfer is needed for our contract with you, or you explicitly agreed. For EU and UK data we rely on the EU-US Data Privacy Framework or Standard Contractual Clauses, with the UK Addendum where needed. Ask us at hello@runopsstudio.com which applies to which provider.
We share data with anyone else only when UAE law or a competent authority requires it, or to defend a legal claim. If we merge or sell the business, client data moves with the engagement under these same terms.
7. How we protect it
In short: sensible measures on our side, no guarantees that the internet is safe.
Encrypted connections. Access on a need-to-know basis. Multi-factor authentication on business-critical accounts. Providers that encrypt at rest. Access rights reviewed on a schedule, not when we remember.
No system is completely risk-free, so no one can honestly promise absolute security. Your side matters too: keep your own accounts, devices and workspace permissions in order, and remove our access when an engagement ends.
If a breach puts your data at risk, we tell the regulator and the people affected where the law requires it.
8. AI and meetings
In short: we use AI tools. Your data does not train them.
We use AI inside our own work and inside the systems we build. We do not use your data to train AI models, and we choose AI providers whose business terms exclude training on customer data. Automated steps, including your Assessment score, never decide anything about you on their own.
Where we use an AI notetaker, we say so in the invite and again at the start of the call, and switch it off if anyone objects. We keep no audio recordings. Transcripts and the notes built from them are deleted within 24 months after the engagement ends, or earlier if you ask.
9. Your rights
In short: ask us anything about your data. We answer within a month.
You can ask us to:
- tell you what we hold and what we do with it
- give you a copy, in a format you can take elsewhere
- correct what is wrong
- delete what we no longer need
- pause processing while something is disputed
- stop processing that rests on legitimate interest, and stop marketing outright
- have a person review any automated result, such as your Operational Assessment score
- withdraw consent, at any time, with no effect on what happened before
Write to hello@runopsstudio.com. We reply within one month. Complex requests can take two months more, and we tell you before the first month is up. Supervisory authorities reach us at the same address.
We check who you are before we act, and ask for no more than that check needs. Where the law allows, we can refuse requests that are repetitive, excessive or clearly unfounded, or charge a reasonable fee for them. Deleted data can survive in backups for a short period until those backups cycle out.
Unhappy with how we handled it? Tell us first. You can also go to the UAE Data Office or the privacy regulator where you live.
10. Changes
Our tools and obligations change, so this page changes too. The date at the top tells you when. The current version always lives at runopsstudio.com/privacy-policy, and clients and subscribers hear about material changes directly.