Privacy policy

Last updated 3 November 2026

This policy explains what personal data Actuate ("we") collects when you use actuate.run, the Actuate dashboard, API and runtime, and what we do with it. Questions or requests: support@actuate.run.

What we collect

• Account details. When you sign in with Google, GitHub or email, we receive your email address, whether it is verified, and a user ID from our sign-in provider. The sign-in provider also holds your name, profile picture and, for GitHub, your username, if those services share them.
• What you deploy and run. Your actuators' code and configuration, the inputs and outputs of their runs, run logs, and the contents of each actuator's database.
• Provider credentials. Messaging, payment or LLM API keys you add. They are encrypted (AES-GCM) before they are stored and are only decrypted to make the calls your actuators ask for. They can't be read back through the dashboard or API.
• Usage and billing. Counts of runs, steps and database rows, used to enforce your plan's limits. If you subscribe, our payment processor handles your card details; we store only a customer and subscription reference.
• Technical logs. Our hosting provider records request metadata (such as IP address, time and response status) to operate and secure the service.

Google and GitHub sign-in

If you sign in with Google, we receive only your basic profile: email address, name and profile picture. We use it only to create and identify your account and to contact you about it. We don't request access to your Gmail, Drive, calendar or any other Google data. Actuate's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell it, use it for advertising, or use it to train AI models.

If you sign in with GitHub, we receive your public profile (username, name and profile picture) and your email address, and use them the same way. We don't request access to your repositories, organisations or any other GitHub data.

How we use it

• To run the service: host and execute your actuators, show you their runs, and enforce plan limits.
• To keep it secure: prevent abuse, investigate problems, and block accounts that break the terms.
• To contact you about your account, such as when a monthly budget runs out or a policy changes.
• To bill you, if you choose a paid plan.

We don't sell personal data, show ads, or use your code, run data or databases to train AI models.

Who processes it

We use a small number of service providers, each only for the purpose listed:

• Cloudflare: hosting, storage, databases, request logs and account emails.
• Clerk: sign-in and session management, including sign-in with Google and GitHub.
• Stripe: payments and subscriptions, if you subscribe.
• Google Fonts: the fonts on our web pages, which means your browser fetches them from Google.

Your actuators call the third-party services you configure (for example Telegram, WhatsApp, Stripe or an LLM provider) with your credentials. Those services handle that data under their own terms and your agreement with them.

These providers may process data outside Malaysia, including in the United States. We rely on their contractual safeguards for those transfers.

How long we keep it

• Run history and logs are deleted automatically after 7 days on Sandbox, 30 on Maker and 90 on Agency.
• Actuator databases, code and configuration are kept until you delete the actuator or your account.
• Account details are kept while your account exists. After you ask us to delete your account, we delete its data within 30 days, except billing records we must keep by law.

Cookies

The landing page and docs set no cookies and use no analytics or tracking. The dashboard uses cookies set by our sign-in provider to keep you signed in. They are necessary for the service and are not used for advertising.

Your rights

You can ask to access, correct, export or delete your personal data, or object to how we use it, by emailing support@actuate.run. You can also export your actuators' data yourself from the dashboard. We respond within 30 days. We handle personal data in line with Malaysia's Personal Data Protection Act 2010 and, where it applies to you, the GDPR.

Security

Data is encrypted in transit, provider credentials are encrypted at rest, each actuator runs in its own isolated environment with its own database, and access to production systems is limited. No system is perfectly secure; if a breach affects your personal data, we will tell you without undue delay.

Children

Actuate is not for anyone under 18, and we don't knowingly collect their data.

Changes

We will post changes here and update the date above. If a change materially affects how we use your data, we will also email you before it takes effect.