privacy policy

runmetal is a tool machine shops use to send requests for quotes to their material vendors — and to additional suppliers runmetal chooses — by email, collect the replies in one place, and issue purchase orders. This policy explains what information the service handles to do that, and what happens to it. It is short because the product is simple.

information we collect

Your account

Your email address and a password, stored only as a salted hash — we cannot read it. If you turn on two-factor authentication, the secrets that make it work. Sign-in sessions, so you can see and revoke them.

Your shop's profile

Shop name, ship-to and billing addresses, a contact name, email and phone, your purchase-order number prefix, and the teammates you invite.

Your vendor book

The vendors you add — company name, sales contact's name, email and phone, city and state, and the materials they carry.

Your RFQ traffic

The material lists you build, the exact emails runmetal sends in your shop's name, and every reply a vendor sends back — the full email, including attachments like PDF quotes. Inbound vendor mail is stored complete, unaltered, and unscreened: we do not open, review, or classify what arrives, including for export-controlled technical data. It is kept because it is the business record your orders are built on.

Supplier directory

Separately from your vendor book, we maintain a directory of metal suppliers — company names, locations, and business contact details — compiled from public sources and from suppliers that shops add. It holds business information, not consumer data. We use it to suggest suppliers to shops and to choose additional suppliers to send a shop's requests to.

Usage and technical data

We use PostHog analytics to understand how the product is used: pages viewed, buttons clicked, and session recordings in which everything typed into any field is masked — recordings show the workflow, never your prices, vendors, or contact details. Analytics is tied to your work email and shop so we can support you. Our servers also keep routine logs: IP addresses, timestamps, errors.

Cookies

Four the service cannot work without: your sign-in session, a security token, a one-page message cookie, and — only if you turn on two-factor authentication and ask us to — a 14-day "trust this browser" cookie. One optional: PostHog's analytics cookie, set only if you allow it and switchable off at any time from your account page. One more records that choice, so you are not asked twice. No advertising cookies — there are no ads.

how we use it

• To run the loop: send your RFQs and purchase orders by email, route vendor replies back to the right request, and keep the record.
• To send you the service's own account emails — sign-in links, password resets, team invitations. We do not email you copies of your RFQs or notices when a vendor replies; that all stays in the app. No marketing lists.
• To suggest suppliers you might want in your book, based on location and the materials you buy.
• To send your requests for quote to additional suppliers from our directory that carry the material and serve your area, so you have more quotes to compare.
• To keep the service secure, and to understand and improve how it is used.

We do not sell your information. We do not use it for advertising. We do not train machine-learning models on it.

what other shops can see

Machine shops are each other's competitors, and the service is built around that fact. Your vendor book, your material lists, your vendors' quoted prices, and your purchase orders are never visible to another shop.

The one place activity crosses shops is supplier suggestions: a supplier may be described as used by other shops only in aggregate, and only when at least three distinct shops contribute to the signal — never a count, never a name, never a price.

if you are a vendor or supplier

Vendors do not have accounts with runmetal and have not agreed to these terms. We say that plainly because it is the honest description of the data we hold about you: either a shop entered your business contact details — name, email, phone, company, city — into its own vendor book, or we hold them in our supplier directory, and we store them so shops can send you requests for quote. You did not give them to us, and you were not asked.

Requests from shops you don't know. If you receive a request from a shop you have never dealt with, it is because runmetal chose your business from our directory as a likely source for that material. Reply as you would to any request for quote; ignore it if you would rather not. To stop receiving requests we choose to send you, email legal@runmetal.co and we will remove you.

What we do with it. We use your contact details to deliver a shop's request for a quote and to route your reply back to that shop. When you reply, we store the full email and any attachments, exactly as sent, and show them to that shop alone. We do not send vendors marketing, we do not sell or share vendor data, we do not build profiles or scores from your quotes, and no other shop sees your prices or your messages.

Unscreened by design. Your reply and its attachments are stored as received. We do not open, review, classify, or screen them — including for export-controlled technical data. Please do not send controlled technical data to a shop through runmetal; the request you received asks the same.

How long we keep it. Your contact details stay while a shop keeps them in its vendor book and keeps its account, or while you are listed in our supplier directory. Your replies are kept as long as that shop's account, because they are the record behind any purchase order it placed with you.

How to get it removed. Email legal@runmetal.co and tell us the address or company. We will tell you what we hold, correct it, or delete it — including your contact details, your listing in our supplier directory, and, where we are not required to keep them as a business record of a completed order, your messages. We will confirm when it is done. You do not need an account to ask, and we will not ask you to create one.

who we share it with

Suppliers who receive your requests. Every request for quote goes to the vendors you select and may also go to additional suppliers we select from our directory. Each recipient gets the request itself: your shop name, ship-to address, needed-by date, material list, notes, and your shop's quote address to reply to. They do not see your vendor book, other suppliers' quotes, your purchase orders, or which other suppliers received the same request. You can ask us to stop sending your requests beyond the vendors you choose at legal@runmetal.co.

Service providers that run the product, each processing data on our instructions:

• Render — application hosting and the database (United States).
• Postmark (ActiveCampaign) — sends and receives the service's email.
• Cloudflare — storage for email attachments.
• PostHog — product analytics, US cloud, as described above.

Beyond that, we disclose information only if the law requires it, or as part of a sale or reorganization of the business — in which case this policy continues to bind whoever receives the data, and we will tell you.

retention and deletion

We keep your data while your account is active. RFQ and quote emails are kept for as long as the shop that owns them keeps its account, because they are the record behind its purchase orders.

If you close your account and ask us to delete your shop's data, we will delete it within 30 days, except where a record must be kept to meet a legal obligation; copies may persist in routine encrypted backups for a limited period before rotating out. Email legal@runmetal.co to make the request.

export-controlled material

runmetal is not built to receive, review, or store export-controlled technical data, and it does not screen, classify, or filter what you or a vendor submit. Do not put ITAR- or EAR-controlled technical data into the service — in a file, a material description, or a note — not least because a request may reach suppliers you did not select. Every account holder acknowledges this before using runmetal, and we record which version of that notice they accepted, when, and from which address.

where your data lives, and who can reach it

Application data sits in a managed Postgres database on Render, in the United States; email attachments sit in Cloudflare R2 object storage. Both are encrypted in transit, and access is limited to the people who operate runmetal.

Within the product, your shop's data is visible to the members of your shop and to nobody else. runmetal staff can reach production data through an administrative console when operating or supporting the service. We keep a full inventory of what we hold and for how long, and will send it to you on request at legal@runmetal.co.

security

All traffic is encrypted in transit. Passwords are hashed, never stored. Two-factor authentication is available on every account. Access to production data is limited to the people who operate the service. No system is perfectly secure; if a breach affects your data, we will tell you promptly.

your rights

Email legal@runmetal.co to access, correct, export, or delete the information we hold about you or your shop. We honor these requests for everyone, whether or not a particular state privacy law applies to a company of our size. runmetal is a business tool intended for use in the United States by people 18 or older.

changes

If this policy changes in a way that matters, we will email account holders before the change takes effect and update the date at the top.

contact

Runmetal Inc. · legal@runmetal.co