Privacy Policy
Clear, with no catches. Which data we collect, why, who we share it with and what your rights are.
This Policy explains how Slashrunner collects and processes personal data - yours as a client and as a visitor to the site, and the data you enter through our forms and the portal. It goes with the Terms of Use; where those mention privacy, the detail is here.
Last updated: October 2026.
Who processes your data
The data controller is Slashrunner, registered at Veselina Masleše 116, 21113 Novi Sad, Republic of Serbia, company number 66947718, tax number (PIB) 113609475. For anything to do with privacy, write to us at [email protected] and we will get back to you.
When we build and run a site or application for you, you are the controller of the data your visitors leave on that site and we are the processor - we process it on your instructions, as part of the service.
Which data we collect
Data from the intake questionnaire and the contact form: name, email and, where relevant, phone, company name, project description, budget and deadline, plus any files you attach yourself (a logo, materials). You also send us data when you talk to the AI assistant.
When you reply to an email from us, or write to an address at mail.slashrunner.com, we receive the message - your address, the content and any attachments - through Resend and keep it in the portal, with the enquiry, offer or correspondence it belongs to. Email you write directly to an address ending in @slashrunner.com goes to the mailbox of the team member who reads that address.
Portal account data (for clients and the team): name, email, password (stored only as a cryptographic hash, never as text), and the company, project, ticket and invoice data that comes out of working together.
The technical data the site needs to work: a session cookie while you are signed in, the language you picked, and - if you arrive through a partner link - that partner's code (see Cookies).
Visit data through Google Analytics - only if you choose to accept on the cookie banner. Without your consent Analytics is not loaded and sets no cookies of its own.
Note: we keep an IP address, or its pseudonym, solely for security reasons, never for marketing or analytics. When someone goes over a request limit on the site (sending forms or checking a site's speed, for instance), we write the IP address into a security log to protect against abuse. With a portal sign-in we record it as part of session security. With a conversation with the AI assistant we keep only its pseudonym. The basis is our legitimate interest in protecting the site and the portal (more on the assistant in Talking to the AI assistant).
Talking to the AI assistant
On the site you can talk to our AI assistant by voice. It is a computer program, not a person, and it tells you so as soon as the conversation starts. The conversation only starts when you start it yourself, and you can end it whenever you like.
Your voice is processed by ElevenLabs: while you speak it turns your voice into text, and it turns the assistant's answer into speech. We do not record your voice and it is not kept as an audio recording, neither by us nor by ElevenLabs. The answer is written by a language model (the AI that writes the reply), which gets only the text of the conversation, through ElevenLabs. So that the assistant knows what you are asking about, during the conversation we also tell it the topic of the page you are on (pricing, for example).
What stays with us is the text of the conversation, a short summary and what the assistant picked out of it: what you need and what you do and, if you said them yourself, your name, company name, company or tax number, town, the address of your current site, deadline, budget and how you would like us to contact you, plus the questions the assistant could not answer. We also keep an assessment of the conversation (whether the assistant said it is an AI and whether there was any abuse, for instance), the page you started it from, the language, the time and length of the conversation, and whether we show you prices for Serbia or for abroad. The assistant does not ask for your email or phone number in the conversation. Why we do this and on what basis is in Why we process it.
Please do not talk about health, religion, politics or similar sensitive matters in the conversation, your own or anybody else's. If it happens anyway, the conversation does not go any further automatically: a team member reviews it first.
If you would like us to get back to you, the assistant opens a form where you type in your first name, last name and an email or phone number yourself. We get back to you at the contact details you type there. If you say an email or phone number out loud in the conversation anyway, it stays written in the conversation text, which we keep and delete as described below. What you type in the form comes straight to us, not to the assistant, and we keep it like any other enquiry from the site. We send one confirmation that we received the enquiry to the email from the form, at most once in 24 hours, and never to an address on our suppression list (see Business contact with companies).
When you send the form, we compare the email and phone number with the enquiries and clients we already have, with the public business register (APR), with other business contact databases and with our suppression lists. That way two people do not both get in touch with you, and we know if you once asked us not to contact you. Based on that, one team member is given the task of getting back to you.
We do not keep your IP address with the conversation. To limit the number of conversations per visitor we turn it into a pseudonym, a one-way fingerprint made with a secret key, from which the address cannot be recovered, and delete it from the conversation record after 48 hours. If you go over the conversation limit, we write that pseudonym and your browser details into a security log. If the assistant judges a conversation to be abuse (swearing, threats, repeated attempts to get round the rules), no new conversation can be started from the same network for 24 hours. A team member can overturn that decision.
When you open the assistant's window, Google reCAPTCHA loads, the same bot protection as on the forms (see Cookies). If the score is not good enough, the conversation does not start; we keep the score with the conversation. So that the form still works after a page refresh, your browser remembers a marker for the conversation in the tab's temporary memory (it is not a cookie), and it is cleared when you close the tab.
If you did not leave your details in the form, we delete the text of the conversation, the summary and what was picked out of it after 30 days. All that remains is a record that the conversation took place (when it was, how long it lasted, in which language, what it cost and markers such as abuse), and we delete that after a year. The exception: if, while the conversation text still exists, a team member links the conversation to details we already hold about you or your company (by the company name or tax number you mentioned, for example), the conversation stays with those details for as long as they are kept. If you left your details in the form: the conversation stays with your enquiry and, if we get back to you, with your project with us, for as long as the rest of the data from that work (see How long we keep data). If we do not take your enquiry any further (if it is marked as spam, for example), we delete the conversation attached to it after a year. ElevenLabs deletes its copy of the conversation text after 30 days.
The rights in Your rights apply to a conversation with the assistant too. If you left your details in the form, we find the conversation by them. If you did not, the conversation is, as a rule, not tied to your name: to find it, tell us roughly when you had it and the page you started it on. We delete by hand.
The assistant is meant for adults and companies. If the conversation suggests we are talking to a child, it does not go any further automatically and we send no confirmation email.
Why we process it (legal basis)
To provide the service and perform the contract: handling enquiries, building and running the site, support, billing and communication about the service (basis: performance of a contract).
We process a conversation with the AI assistant to answer your questions about our services and to get back to you if you ask us to through the form (basis: steps taken at your request before entering into a contract). The IP pseudonym, reCAPTCHA and the limit on conversations are there to prevent abuse and runaway costs, and we use the questions the assistant could not answer, and the number and length of conversations, to improve what the assistant knows and for statistics (basis: legitimate interest).
To meet legal obligations - keeping invoices and accounting records, for example (basis: legal obligation).
To measure visits and improve the site through Analytics - solely on the basis of your consent, which you can withdraw at any time (basis: consent).
For occasional informational email and, to a limited extent, for business contact with companies - on the basis of our legitimate interest in presenting our services, with a one-click unsubscribe (basis: legitimate interest). More about email is in the Terms.
Transfers outside the EU
Some of our providers are US-based companies (Railway, Cloudflare, Stripe, Resend, Google, Cal.com and ElevenLabs, for instance), so part of the processing may take place outside the European Economic Area, even though as a rule we keep data on servers in the EU. The text of a conversation with the AI assistant may also be processed outside the EU, by ElevenLabs and the language model providers.
When such a transfer happens, we rely on appropriate safeguards (the EU standard contractual clauses and/or the EU-US Data Privacy Framework), so your data stays protected at the level the GDPR requires.
How long we keep data
We keep data for as long as we work together and for as long as the purpose it was collected for requires. When that need ends - or when you ask for deletion - we remove it from our infrastructure.
The exception is documentation we are required by law to keep for a set period (invoices and accounting records, for example) - we retain that until the statutory period runs out, even once everything else has been deleted. The other exception is our suppression lists: if you asked us not to get in touch again, that entry stays on them after deletion too. Your Analytics consent is remembered for up to 6 months, after which we ask again. Conversations with the AI assistant follow the periods described in Talking to the AI assistant.
Your rights
You have the right to: see your data and get a copy of it, ask for inaccurate data to be corrected, ask for deletion, restrict or object to processing, and withdraw consent where processing rests on it (Analytics, for instance) - without affecting what has already been processed.
Send your request to [email protected]; we handle it without delay and in person - there is no automatic export or delete button yet, we do it by hand. Even after deletion we keep the invoices we are legally required to retain and, if you asked us not to contact you again, that entry on the suppression list - so that we do not get in touch again.
If you have a complaint about how we store and use your data, come to us first - we will do our best to sort it out. If you still believe your rights have been breached, you can turn to a data protection supervisory authority - in Serbia the Commissioner for Information of Public Importance and Personal Data Protection, and if you are in another country, the competent data protection authority there.
Business contact with companies
We sometimes get in touch with companies by email or phone about our services. We get the contact details from business sources - public registers and other business contact databases. Our business emails come with a one-click unsubscribe link, and on the phone it is enough to say you do not want to be called again.
When you unsubscribe from our emails, we add the address to a suppression list and stop writing to you. When you tell us not to get in touch again - on the phone, in a reply or any other way - we add both your address and your phone numbers to our suppression lists, and from then on we do not contact you to sell anything, neither by email nor by phone. We block the number itself, so we do not call other companies that use it either. If you are already our client, we will still contact you about the work we do for you. If you once asked us not to contact you and now get in touch yourself, through a form on the site or the AI assistant, we answer that enquiry. Answering it does not take your earlier request off the list. If you ask us in that enquiry to get back to you, an administrator can remove the earlier request from the list, and that is logged.
We keep those lists for as long as we need to in order to respect your request - only an administrator can remove an entry, and that is logged. The entry stays on the list even when we delete the rest of your data: without it we would not know not to get in touch with you again.
Security
We protect data seriously and technically: passwords are stored only as a one-way cryptographic hash, sessions as random tokens (only their hash is in the database), sensitive access credentials are encrypted, all traffic goes over TLS, and access to data is strictly separated per client. Secrets (keys) exist only in the server environment.
No system is absolutely secure; we do everything reasonable to keep an incident from happening, and if one does, we react quickly. There is more on the security of the service in the Terms.
Children
Our services are meant for companies and adult users, and we do not address children. We do not knowingly collect data about minors; if you believe that has happened anyway, tell us and we will remove it.
Changes to this Policy
We may update this Policy from time to time - when we add a service, or a provider or a rule changes. The date of the last change is at the top; for more significant changes we will tell you through the site or by email.
Contact
For any question about privacy, to exercise a right or to have data deleted - write to us at [email protected] or reach us through the portal. We are here.