Skip to main content
Legal

Privacy Policy

Last updated: 24 March 2026

1. Who We Are

RuntCMS is a product of Tom Spetter Design, based in Victoria, BC, Canada. When we say "we", "us", or "our", we mean Tom Spetter Design.

2. What We Collect

When you purchase RuntCMS

Payments are handled by Lemon Squeezy. We receive your name, email address, and transaction details. We do not see or store your payment card information — that stays with Lemon Squeezy.

When you visit this website

We use Umami, a privacy-focused analytics tool, to understand how visitors use this site. Umami does not use cookies, does not collect personal data, and does not track you across websites. All data is aggregated and anonymous — we see page view counts and referrer URLs, not individual visitors.

We do not use third-party tracking pixels or advertising scripts.

When you contact us

Contact form submissions are processed by Deftform, a third-party form handling service. The information you provide (name, email, message content) is transmitted through Deftform and forwarded to us. We use this data solely to respond to your enquiry. Deftform's own privacy policy governs their handling of submitted data.

The RuntCMS software itself

RuntCMS does not phone home. It does not send telemetry, usage data, or analytics to us or any third party. The software runs entirely on your server. We have no access to your installation, your data, or your users' data.

3. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process personal data on the following bases:

  • Contract performance — processing your purchase, delivering your licence, and providing support
  • Legitimate interest — anonymous website analytics (Umami) to improve our site, and sending rare product update emails
  • Consent — when you voluntarily submit a contact form or subscribe to communications. You may withdraw consent at any time by contacting us
  • Legal obligation — retaining purchase records as required by tax law

4. How We Use Your Information

  • To deliver your licence and product updates
  • To process refunds if requested
  • To respond to support or sales enquiries
  • To send product update emails (rare, opt-out available)

5. Who We Share It With

We do not sell, rent, or trade your personal information. We share data only with:

  • Lemon Squeezy — payment processing and licence delivery
  • Umami — anonymous, cookie-free website analytics
  • Deftform — contact form submission processing
  • Email provider — transactional emails (purchase receipts, password resets)

That's the full list. These providers may process data outside the European Economic Area (EEA). Where this occurs, we rely on the provider's own GDPR-compliant safeguards (such as Standard Contractual Clauses or equivalent measures).

6. Data Retention

We retain purchase records for as long as your licence is active, plus any period required by tax law. Contact form messages are deleted after your enquiry is resolved. If you request deletion of your data, we will comply within 30 days.

7. Your Rights

Under the GDPR and Canadian privacy law (PIPEDA), you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Request a portable copy of your data in a machine-readable format
  • Withdraw consent at any time, where consent is the basis for processing
  • Object to processing based on legitimate interest
  • Opt out of any marketing emails

To exercise any of these rights, use our contact form. We will respond within 30 days.

If you believe your data has been handled improperly, you have the right to lodge a complaint with a supervisory authority. In Canada, this is the Office of the Privacy Commissioner of Canada (OPC). EU residents may contact their local data protection authority.

8. Security

We take reasonable measures to protect your information. All data is transmitted over HTTPS. Payment processing is handled by PCI-compliant providers. We do not store sensitive information beyond what is necessary for licence management.

9. Children's Privacy

RuntCMS is a professional software tool. We do not knowingly collect information from children under 16. If you believe we have, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. We won't reduce your rights under this policy without your consent.

11. Data Controller

The data controller for this website is:

Tom Spetter Design
Victoria, BC, Canada
Contact form

12. Contact

Questions about this policy? Get in touch.