Privacy Policy

Last Updated: 9 October 2026

Starry Horizon Limited ("RunMux", "we", "us" or "our") respects your privacy and we are committed to protecting it through our compliance with this Privacy Policy. We have created this Privacy Policy to inform you of our policies regarding the collection, use and disclosure of personal data and the choices you have associated with that information. Capitalised terms used but not defined in this Privacy Policy have the meaning given to them in our Terms of Service.

This Privacy Policy applies to all personal data collected through any written, electronic or oral communications, as you:

• Access the website located at https://runmux.com and all corresponding webpages that link to this Privacy Policy (the "Site");
• Use the RunMux dashboard, Billing Center and Playground;
• Send requests to the RunMux API using a RunMux API key;
• Otherwise utilise our Service.

Before using our Site and Service, please carefully read our Terms of Service and this Privacy Policy. By using the Site or Service, you consent to the collection and use of your personal data in accordance with this Privacy Policy and our Terms of Service. If you do not feel comfortable with any part of this Privacy Policy or our Terms of Service, you should not use or access our Site or Service.

We may modify this Privacy Policy at any time. If we make changes, a revised Privacy Policy will be posted on our Site and the date of the last revision will be shown at the top of the page. We will provide individuals who create an account ("Users") with advance notice by email if we make any material changes to how we collect, use or disclose Users' personal data or that affect Users' rights under this Privacy Policy. Users are responsible for ensuring we have an up-to-date, active and deliverable email address. Your continued use of the Site or the Service following the posting or notice of a revised Privacy Policy means that you accept and agree to the changes.

We may also provide additional "just-in-time" disclosures or information about the data practices of particular features of the Service. Such notices may supplement or clarify this Privacy Policy or provide you with additional choices about how we process your personal data.

Data controller Starry Horizon Limited (Company Registration No. 76247432) RM 2G, 1/F, Wah Hung Centre, 41 Hung To Road, Kwun Tong, Hong Kong Email: contact@runmux.com

1. Collection of Personal Data

We collect personal data when you use our Site and our Service. Personal data is any information that relates to you, identifies you personally or could be used to identify you, including but not limited to your name, mailing address, email address and telephone number. Any text or data you input into the Service ("Inputs") that includes personal data will also be collected by us, and the content generated by a Model in response ("Outputs") may likewise contain personal data. We do not control, and are not responsible for, Model Providers' handling of your Inputs or Outputs, including any use for model training. To understand how your Inputs are used by a Model Provider, review that Model Provider's terms, which we link from the model catalog.

The types of personal data we may collect include: the personal data you provide to us, personal data collected automatically about your use of our Site or Service, and confirmation of payments received through third-party payment institutions.

Personal Data You Voluntarily Provide to Us

The personal data we collect from you may include:

• Information that you provide by using our Site or Service or by filling out forms on the Site. This includes information provided at the time of or after registering and creating an account, such as your name, email address, password, organisation name and country; information you provide when setting up your Billing Profile, such as billing contact, company name, billing address, tax identification number (optional) and invoice email addresses; and information you provide when sending Inputs through the Service or using the Playground. We may also ask you for information when you report a problem with our Site or Service.
• Records and copies of your correspondence (including email addresses), if you contact us, including billing enquiries and support requests.
• Details of transactions you carry out through our Site, including top-ups, invoice payments, refunds and the fulfilment of those transactions. We do not collect, receive or store any payment information. All payments are accepted through licensed third-party payment institutions; you enter your card, e-wallet or other payment details directly with the payment institution, and RunMux receives only a confirmation that the payment succeeded or failed, together with the transaction reference, amount, currency and time, so that we can credit your account and issue a receipt.
• Saved payment method reference. If you choose to save a payment method for automatic top-up or automatic invoice payment, your payment details are stored by the payment institution in its secure vault, not by RunMux. We retain only an opaque reference identifier issued by the payment institution, which has no value outside that institution's systems and cannot be used to reconstruct your payment details, together with your automatic top-up and automatic payment settings (threshold and amount). You can remove a saved payment method or disable automatic charging at any time in the Billing Center.
• Image, audio, video and "biometric information". Certain Models available through our Service accept image, audio or video Inputs, or generate image, audio or video Outputs. If you submit image, audio or video files through the Service, including voice recordings and other depictions of identifiable individuals, those files may contain personal data about you or others that is considered "biometric information" or sensitive personal data under applicable laws.

Personal Data Collected Automatically

As you navigate through and interact with our Site or Service, we automatically collect certain information about your device, your use of the Site and your use of the API, including:

• API usage metadata for each request: request identifier, timestamp, API key identifier (displayed in masked form), API key name, model identifier, endpoint, token counts (input, cached input, output and reasoning), image count and resolution, video duration and resolution, audio duration, request status and HTTP status code, latency, the published rate and discount applied, the resulting charge, the funding source (prepaid balance or credit line) and your balance after the request. This metadata is necessary to operate the gateway, calculate your bill, display usage in the Billing Center and generate the usage exports you can download. It does not include the content of your Inputs or Outputs.
• Details of your visits to our Site, including traffic data, log files, pages you view, links you click and other communication data and the resources that you access on the Site.
• Information about your computer and internet connection, including your IP address, operating system and browser type, time-zone setting and other unique online identifiers.
• Information about your preferences via the use of cookies. For more information, please see "Cookies and Other Tracking Technology" below.

Model Provider Data Practices

When you submit Inputs through the Service, those Inputs are transmitted to the Model Provider that operates the Model you select, or that is selected through routing you have enabled, as applicable. Different Model Providers have different data practices, including with respect to whether they retain your Inputs and Outputs and whether they use them to train, fine-tune, evaluate or improve their Models. Some Model Providers may use your Inputs and Outputs for model training or improvement. Before using a Model, you should review the applicable Model Provider's data practices, which are linked from the model catalog. Where disclosed to us, we label Models that do not use your data for training. If you do not want your Inputs used for model training, select a Model or Model Provider that commits to not using your data for that purpose.

Enterprise and API Users

If you have a Data Processing Agreement with us, the terms of that agreement and our separate agreements with Model Providers govern how your data is handled by each Model Provider, including any restrictions on model training. Business customers that require a Data Processing Agreement under the GDPR, UK GDPR or similar laws may request our standard Data Processing Agreement by emailing contact@runmux.com.

RunMux does not use your Inputs or Outputs for model training, and does not sell your personal data.

Biometric Data Processing

Some Models perform processing that may constitute biometric data processing under applicable law. This includes, but is not limited to:

• Voice cloning: creating a synthetic replica of a speaker's voice from audio samples, which requires extracting unique vocal characteristics (a voiceprint).
• Voice changing or voice-preserving translation: transforming audio while analysing or retaining the unique vocal characteristics of the original speaker.
• Speaker identification: distinguishing or identifying individual speakers based on voice characteristics.
• Face cloning or face-consistent generation: generating or editing images or video that replicate a real person's face from a photograph, video or other sample, which may require extracting facial geometry that constitutes a faceprint.

When using these features, the Model Provider will process your audio or visual data to extract biometric identifiers, including without limitation voiceprints, voice models and faceprints. Such data is treated as biometric data under the EU and UK GDPR, as sensitive personal data under the Hong Kong Personal Data (Privacy) Ordinance, and as biometric identifiers under similar laws elsewhere.

If you submit image, audio or video data containing the voice or image of another person to a Model that performs biometric processing, you are responsible for ensuring that you have obtained appropriate notice and consent from that individual as required by applicable law. You must not submit another person's voice or image data to a biometric processing feature without their informed consent. RunMux acts as an intermediary, passing source image, audio and video data to Models, and does not independently process or store biometric data or generate any biometric identifiers.

Cookies and Other Tracking Technology

We use cookies and similar technologies on the Site to make the Site function properly, to keep you signed in securely, to remember your preferences (such as language, theme and Billing Center table settings) and to record your cookie choices. We do not use advertising cookies, behavioural tracking, session-replay tools or third-party analytics services, and we do not track your activity across other websites. Requests to the RunMux API are authenticated with API keys and do not use cookies.

The following types of cookies are used on our Site:

• Strictly Necessary Cookies. These cookies are essential because they enable you to use our Site, for example by allowing you to access secure areas of the dashboard and protecting you against cross-site request forgery. This category of cookies cannot be disabled.
• Functional or Preference Cookies. We use functional cookies to remember your choices so we can tailor the Site to you, for example your language, display theme and the columns you have selected in the usage table. These cookies are not used for marketing. If you disable them, some features may not work as intended.

Your browser may provide you with the option to refuse some or all cookies, and you may be able to remove cookies from your browser. Please note that if you disable cookies you may not be able to sign in or access secure areas of the Site. Full details of the cookies we use are set out in our Cookie Policy.

2. How We Use Your Personal Data

We will only use your personal data as described in this Privacy Policy or as disclosed to you prior to such processing taking place. The purposes for which we may use your personal data include:

• Providing the Service.
• Transmitting your Inputs to third-party Model Providers for inference and returning Outputs to you.
• Measuring your Usage, applying the published rates and any discount or rebate agreed with you, maintaining your prepaid balance and credit line, and issuing invoices, receipts, credit notes and statements.
• Confirming receipt of funds from the payment institution and crediting your account.
• Where you have enabled automatic top-up or automatic invoice payment, instructing the payment institution to charge your saved payment method for the amounts and in the circumstances you have specified, and notifying you of each such charge.
• Sending you transactional notices about your account, including payment confirmations, invoices, balance and credit alerts, overdue notices and suspension or restoration notices.
• Notifying you about changes to our Site, our policies, our terms or the Models and features we offer.
• Sending you marketing and promotional emails, from which you may unsubscribe at any time.
• Responding to your questions, billing enquiries or other requests.
• Saving your account, registration, billing profile and preference data so you do not have to re-enter it each time you use the Service.
• Monitoring route health, availability and latency, and accumulating and reporting aggregate statistical information in connection with the Site and the Service.
• Determining which Models and features are used most to help us operate, enhance and improve the Service.
• Keeping you secure and safe while using our Site and Service, which requires us to process your personal data to combat spam, malware, malicious activity and security risks.
• Troubleshooting errors and providing customer support, including, where necessary to diagnose a specific issue, reviewing the content of a particular request within the retention period described in Section 7.
• Maintaining legal and regulatory compliance, including accounting and tax record-keeping.
• Enforcing compliance with our Terms of Service, Acceptable Use Policy and other policies, and the usage policies of Model Providers.
• Investigating and resolving disputes.
• Investigating and preventing fraud, abuse, violations of our Terms of Service and other policies, unlawful or criminal activity, and unauthorised access to or use of personal data or our systems and networks.
• Protecting you, others and our business.
• For any other purpose disclosed to you prior to you providing us your personal data or which is reasonably necessary to provide the Service or related products and services requested.

We do not use your personal data, Inputs or Outputs to deliver interest-based or targeted advertising.

Aggregated and De-identified Information

We may process personal data in an aggregated or de-identified form to analyse the performance of our Service and study usage patterns, including in the following ways:

• To create aggregate statistics, such as total requests, tokens processed or average latency per Model or route, for display on our Site or for internal planning. Such statistics do not identify individual Users and never include the content of Inputs or Outputs.
• To improve the user experience. We may analyse and aggregate general usage data. This information does not identify individual Users. However, for the purposes of debugging a specific problem you report, we may re-associate your User ID with request metadata and, within the retention period in Section 7, stored Inputs.

3. How We Share and Disclose Your Personal Data

We do not sell or rent your personal data. We do not share your personal data with advertisers, data brokers or analytics companies. We may share or disclose your personal data only in the following circumstances:

• With Model Providers. When you use our Service, we transmit your Inputs to the Model Provider(s) whose Models you select. Model Providers process your Inputs to generate Outputs and may, depending on their own terms and data practices, retain and use your Inputs and Outputs for their own purposes, such as model training and improvement. We require Model Providers to comply with applicable data-protection laws under our agreements with them, but each Model Provider's own terms govern its independent use of your data to the extent permitted by those agreements. Links to Model Providers' data practices are available in the model catalog.
• Payment institutions. We accept payment only through licensed third-party payment institutions. When you make a payment, you provide your payment details directly to the payment institution, which processes them under its own privacy policy; RunMux does not receive or store them. We share with the payment institution only the information needed to identify the transaction, such as the amount, currency and a transaction reference, and we receive back the confirmation described in Section 1. Where you have saved a payment method, we additionally share the reference identifier and the amount to be charged when an automatic top-up or automatic invoice payment is due.
• Corporate transactions. To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganisation, dissolution or sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which personal data held by us about Users is among the assets transferred; you agree to and hereby consent to our assignment or transfer of rights to your personal data in such circumstances.
• Aggregated information. We may share aggregated, de-identified information (for example, aggregate trends about the general use of our Service) publicly.
• Consent. We may disclose your personal data for any purpose with your consent.
• As required by law. Under certain circumstances your personal data may be subject to processing pursuant to laws, regulations, judicial or other government subpoenas, warrants or orders. We may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law-enforcement requirements. We will preserve and disclose information to law-enforcement agencies or others if required to do so by law or in the good-faith belief that such preservation or disclosure is reasonably necessary to: (a) comply with legal or regulatory process (such as a judicial proceeding, court order or government inquiry) or obligations that we may owe pursuant to applicable laws and regulations; (b) enforce our Terms of Service and other policies; (c) respond to claims that any content violates the rights of third parties; or (d) protect the rights, property or personal safety of RunMux, its employees, its Users, its clients and the public.

4. Your Rights and Choices

Marketing Communications

We strive to provide you with choices regarding the personal data you provide to us. If you do not wish to have your email address or other contact information used by us to promote our Service, you can opt out by sending an email stating your request to contact@runmux.com, or by following the "unsubscribe" instructions included in any promotional message. This opt-out does not apply to transactional notices such as invoices, receipts, balance alerts and account notices, which are necessary to provide the Service while your account is active. Please note that opt-out and unsubscribe requests may take a reasonable amount of time to receive, process and apply.

Keeping Your Personal Data Accurate and Deletion

We are committed to ensuring that your personal data is kept accurate and up to date; however, it is up to you to update it with any changes. You can review and change your account and billing profile information by logging into the Site. You may also email contact@runmux.com to request access to, or correction of, any personal data you have provided to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

If you no longer wish to use our Service, or no longer wish to have your personal data processed, you may request deletion of your account and the information in your account, subject to certain limitations, by emailing contact@runmux.com from your registered email address. We will send an email to the address linked to your account asking you to confirm the deletion request. Once you confirm, your account will no longer be accessible while we process the request, and the process cannot be cancelled, undone, withdrawn or reversed. Deletion does not relieve you of any obligation to pay Fees incurred before deletion, and any remaining prepaid balance, rebate credit or bonus balance is forfeited except as provided in our Refund and Cancellation Policy. When your account is deleted, all associated personal data is deleted, unless we are required to maintain it for regulatory and compliance purposes (for example, invoices and payment records that must be retained under Hong Kong law) or for a legal or business necessity.

Rights Regarding Your Personal Data

Depending on where you live and the laws that apply in your country of residence, you may have certain rights regarding your personal data, as described here. While we strive to prioritise the protection of personal data and comply with all applicable laws, we may decline a request if we have a lawful reason for doing so.

To exercise your rights, you or your authorised agent may submit a request by email to contact@runmux.com. We may first request additional information to verify your identity before processing your request. We will respond within the time required by applicable law (forty (40) days under the Hong Kong Personal Data (Privacy) Ordinance; one month under the GDPR, extendable where permitted). Hong Kong law permits us to charge a reasonable fee for complying with a data access request.

• Right to know. You have the right to know what personal data RunMux processes about you, including the categories of personal data, the sources from which it is collected, the purposes for collection, and the categories of third parties to whom we disclose it.
• Access and data portability. You have the right to request a copy of the personal data we process about you, subject to certain exceptions and conditions. Your usage records can be exported at any time in CSV format from the Billing Center.
• Deletion. You have the right to request that we delete personal data we have collected from you, subject to certain exceptions, including our legal obligation to retain accounting records.
• Correction. You have the right to request that we correct inaccurate personal data we have retained about you, subject to certain exceptions.
• Objection. You have the right to object to processing of your personal data, subject to certain exceptions. You can opt out of marketing communications by following the directions in this section.
• Restriction. You have the right to restrict our processing of personal data in certain circumstances.
• Withdrawal of consent. Where our processing of your personal data is based on your consent, you have the right to withdraw consent, but that withdrawal does not affect the lawfulness of processing based on consent provided before your withdrawal.
• Complaint. You have the right to lodge a complaint with a supervisory authority. In Hong Kong this is the Office of the Privacy Commissioner for Personal Data (www.pcpd.org.hk). Residents of the EEA or the UK may contact their national data-protection authority.
• Sale and targeted marketing. We do not "sell" your personal data as that term is defined by applicable laws and regulations, and we do not share it for targeted advertising.

If you are an end user of a product built by one of our customers, that customer controls your data; please direct your request to them, and we will assist as required.

5. Data Security

We have implemented measures designed to secure your personal data from accidental loss and from unauthorised access, use, alteration and disclosure. These include encryption of data in transit and at rest, scoped API keys that can be rotated or revoked at any time, isolation of upstream Model Provider credentials from customer-facing keys so that a leaked API key can be rotated without exposing provider accounts, access controls and logging, and regular review of our security practices.

The safety and security of your information also depends on you. You are responsible for keeping your password and API keys confidential. You should not share your password or API keys with anyone, and you should issue separate keys with spend limits for different tools or teams.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted to our Site. Any transmission of personal data is at your own risk. If we become aware of a personal-data breach affecting you, we will notify you and the relevant authorities as required by applicable law.

6. Integration of Third-Party Platforms and Services

The Site may link to websites, documentation, pricing pages and platforms operated by other companies, including Model Providers and payment institutions. We are not responsible for the privacy practices of such third-party websites, applications or platforms. Once you leave the Site via a link or access a third-party service, you should check the applicable privacy policies to determine how those companies process personal data they may collect about you. This Privacy Policy applies solely to information collected by RunMux.

7. Personal Data Retention

We are subject to applicable laws on the retention of information and will retain your information for as long as is reasonably necessary to comply with our business and legal obligations and to meet regulatory and compliance requirements. When the personal data we have collected is no longer required by us, we will perform the necessary procedures for destroying, deleting, erasing or converting it into an anonymous form as permitted or required by applicable laws.

In particular:

• Content of Inputs and Outputs. We retain the content of Inputs and Outputs for a maximum of seven (7) days after the request, solely for troubleshooting, security monitoring and abuse investigation. After this period the content is automatically and permanently deleted from our systems. We may retain specific Inputs and Outputs for longer where we reasonably believe they evidence a violation of our Terms of Service, Acceptable Use Policy or applicable law, or where a legal obligation or lawful request requires it.
• API usage metadata (as described in Section 1), which does not include the content of Inputs or Outputs, is retained for the life of your account and for seven (7) years thereafter, as required for accounting and tax records.
• Invoices, receipts, credit notes, statements and payment confirmations are retained for seven (7) years from the end of the financial year in which they were issued, in accordance with the Hong Kong Companies Ordinance and Inland Revenue Ordinance.
• Account and billing profile information is retained for the life of your account and for up to ninety (90) days after closure, unless longer retention is required by law or to resolve disputes.
• Saved payment method reference and automatic charging settings are retained until you remove the saved payment method, disable automatic charging or close your account, whichever is earliest, after which the reference is deleted and the payment institution is instructed to release the saved payment method.
• Correspondence is retained for three (3) years from the last communication.
• Site log data is retained for twelve (12) months.

Image, Audio and Video Data

Image, audio and video data submitted through the Service is transmitted to the applicable Model Provider for inference. We do not persist image, audio or video files beyond the duration necessary to route the request and the seven-day retention period described above, except as required for abuse detection, security, billing or legal compliance. Model Providers' retention practices vary; check the applicable Model Provider's data practices. You may request deletion of your data by contacting us at contact@runmux.com.

8. Eligibility

The Site and Service are offered and available to users who are 18 years of age or older. By using the Site, you represent and warrant that you are at least 18 years old and that you are of legal age to form a binding contract with us. If you do not meet these requirements, you must not access or use our Site or Service. We do not knowingly collect personal data from anyone under 18; if you believe a minor has provided us with personal data, contact us and we will delete it.

9. Governing Law

All disputes arising out of or relating to this Privacy Policy or the registration for or use of any RunMux product or Service shall be governed by the laws of the Hong Kong Special Administrative Region, regardless of where you access the Site or the Service and notwithstanding any conflict-of-law principles, and shall be subject to the exclusive jurisdiction of the courts of Hong Kong, except to the extent applicable privacy laws provide rights or obligations that cannot be waived or varied by contract.

10. Additional Disclosures for Hong Kong and Legal Bases for Processing Under the GDPR

Hong Kong. We comply with the Personal Data (Privacy) Ordinance (Cap. 486) and its Data Protection Principles. This Privacy Policy serves as our Personal Information Collection Statement. We will not use your personal data for direct marketing without your consent, and you may opt out at any time free of charge as described in Section 4.

GDPR. The GDPR requires specific disclosures. The table below provides additional information about the categories of personal data we collect, how we use it and our legal bases. You can read more about the personal data we collect in Section 1, how we use it in Section 2, how we share it in Section 3, how long we retain it in Section 7 and your rights in Section 4. We do not have an establishment in the EEA or the UK.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, or wish to exercise your rights, please contact us at:

Starry Horizon Limited RM 2G, 1/F, Wah Hung Centre, 41 Hung To Road, Kwun Tong, Hong Kong Email: contact@runmux.com