Privacy Policy

Scope and Controller Information

This Privacy Policy (“Policy”) describes how PR Run, a company organized and existing under the laws of the State of Montana (“PR Run,” “Company,” “we,” “us,” or “our”), collects, uses, discloses, and otherwise processes personal information when you visit https://pr.run, write us, use the Service, or otherwise interact with us.

For personal information PR Run processes on behalf of a business customer (including a race organization, coach, or team) that later submits athlete data through the Service, PR Run generally acts as a processor (or service provider) and the customer acts as the controller. Such processing is governed by our Data Processing Addendum and the customer’s instructions.

Categories of Information We Collect

Depending on how you interact with PR Run, we may collect:

• Identifiers: email address, and name if you choose to give it, when you write hi@pr.run or otherwise contact us. The public site presently captures email through a mailto message. We collect that address if you choose to send it. We do not presently operate a hosted email service provider for waitlist enrollment.
• User Content: race, course, fitness, file, and related materials you submit, which may include personal information about you or, if you are a business customer, about athletes on whose behalf you act.
• Usage and device information: pages viewed, approximate request metadata, browser type, operating system, IP address, and technical logs used to operate, secure, and deliver the Service.
• Communications: the content of messages you send to hi@pr.run, hi@pr.run, or security@pr.run.
• Commercial information: if paid features are offered, subscription status, invoice references, and transaction history. Payment card data, if collected, will be processed by a third-party processor (Stripe, Inc. or a successor). PR Run will not store full payment card numbers. Paid features are not live as of the effective date of this Policy.

We do not knowingly collect sensitive personal information except as you choose to include it in a message or in User Content. You should not send us health diagnoses or other special-category data unless a later product feature expressly requests it and you have a lawful basis to provide it.

How We Use Information

We use personal information for the following business purposes:

• Providing, operating, maintaining, securing, and improving the Service.
• Responding to mail you send us, including course-note and waitlist requests.
• Generating course-specific training guidance and race-morning materials you request.
• Communicating transactional messages about the Service.
• Detecting, investigating, and preventing fraud, abuse, and security incidents.
• Enforcing our Terms, Acceptable Use Policy, and other agreements.
• Complying with applicable law, regulation, and legal obligations.
• Generating aggregated or de-identified analytics that do not identify individuals.

We do not sell personal information. We do not use personal information for cross-context behavioral advertising.

Legal Bases for Processing

Where the General Data Protection Regulation (“GDPR”), UK GDPR, or similar laws apply, we rely on the following legal bases:

• Contractual necessity: processing necessary to perform our contract with you, including delivering the Service and responding to requests you initiate.
• Legitimate interests: securing the Service, preventing fraud, improving functionality, and communicating about the Service, balanced against your rights and interests.
• Consent: where required for optional cookies, marketing communications, or other processing for which consent is the appropriate basis.
• Legal obligation: compliance with tax, accounting, regulatory, and law enforcement requirements.

Where U.S. state privacy laws apply, we process personal information as a business or controller for our own site operations and correspondence, and as a service provider or processor on behalf of business customers that submit athlete data.

Processing of User Content

User Content is processed to provide features you request, including storage, course analysis, training guidance, and race-morning materials. You control what content is submitted. If you submit data about other people, you are responsible for establishing an appropriate legal basis and for the instructions you give us.

Automated Processing

If we later offer software-generated training or pacing suggestions, those outputs are based on information you provide and on course data. They are probabilistic aids. We do not use User Content to train generally available third-party machine learning models except as expressly permitted in an applicable agreement or with your explicit consent.

How We Disclose Information

We may disclose personal information to:

• Service providers and subprocessors who process information on our behalf under contractual confidentiality and data protection obligations.
• Professional advisors including attorneys, accountants, and insurers, subject to confidentiality obligations.
• Law enforcement and regulators when required by law, subpoena, court order, or to protect rights, safety, and security.
• Successors in connection with a merger, acquisition, reorganization, or sale of assets, subject to this Policy.

We do not disclose personal information to third parties for their own marketing purposes.

Service Providers and Subprocessors

We engage infrastructure providers to operate PR Run. A current list of subprocessors, their purposes, and applicable privacy policies is maintained at our Subprocessor page. We require subprocessors to process personal information only on our instructions and in accordance with applicable data protection requirements. As of the effective date, application hosting is provided by Vercel, Inc.

Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookie Policy. As of the effective date, the public site uses only strictly necessary cookies associated with delivering and securing the Service. We do not presently set optional analytics or advertising cookies.

Analytics

We do not presently use a third-party analytics vendor on https://pr.run. If we later enable optional analytics, we will update this Policy and the Cookie Policy and, where required, obtain consent before placing non-essential cookies.

Data Retention

We retain personal information for as long as necessary to provide the Service, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data category:

• Correspondence: retained while we are responding to you and for a reasonable period thereafter.
• User Content: retained until you request deletion or your account (if offered) is terminated, subject to backup retention.
• Billing records: if paid features are offered, retained as required by tax and accounting laws.
• Security logs: retained for a period consistent with security and incident response needs.

Backup copies may persist for a limited period before being overwritten in the ordinary course.

Security

We implement administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. See our Security page for an overview. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

International Data Transfers

PR Run is based in the United States. Personal information is hosted in the United States and may be processed in other countries where we or our subprocessors maintain facilities. When we transfer personal information from the European Economic Area, United Kingdom, or Switzerland to countries without an adequacy determination, we implement appropriate safeguards, including:

• Standard Contractual Clauses approved by the European Commission (Module 2: Controller to Processor and Module 3: Processor to Processor, as applicable).
• The UK International Data Transfer Addendum where required for UK transfers.
• Supplementary measures as assessed through transfer impact analysis where appropriate.

A copy of applicable transfer mechanisms may be requested by contacting hi@pr.run.

Your Privacy Rights and Choices

Depending on your location, you may have the following rights regarding your personal information, subject to applicable exceptions:

• Access: request confirmation of whether we process your information and obtain a copy.
• Correction: request correction of inaccurate information.
• Deletion: request deletion of your information, subject to legal retention requirements.
• Restriction: request restriction of processing in certain circumstances.
• Portability: receive information you provided in a structured, commonly used, machine-readable format where applicable.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: where processing is based on consent, withdraw consent at any time without affecting prior lawful processing.

California and U.S. state privacy rights

If you are a California resident or reside in a state with a comprehensive privacy law, you may have additional rights, including the right to know categories of information collected, request deletion, and opt out of certain processing. PR Run does not sell personal information and does not share personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”).

To submit a request, contact hi@pr.run. We will verify your identity before responding and will respond within the timeframe required by applicable law (generally forty-five (45) days for CCPA/CPRA requests, extendable once where permitted). You may designate an authorized agent to submit requests on your behalf where permitted by law. If we deny a request, you may appeal by replying to our response. California residents may contact the California Attorney General with complaints regarding our handling of personal information.

EEA, UK, and Swiss rights

If you are located in the EEA, UK, or Switzerland, you have the right to lodge a complaint with your local supervisory authority. PR Run’s primary contact for GDPR inquiries is hi@pr.run.

Business Customers and Athlete Data

If a race organization, coach, or team later submits athlete data through the Service, that customer controls the data it submits. Individuals whose information is contained in such submissions should direct requests to the relevant organization, which PR Run will assist in responding to as processor where applicable.

Children's Privacy

The Service is not directed to children under sixteen (16) years of age, and we do not knowingly collect personal information from children. If you believe we have collected information from a child, contact hi@pr.run and we will take appropriate steps to delete such information.

Changes to This Policy

We may update this Policy from time to time. Material changes will be posted on this page with an updated effective date and, where required, additional notice. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

Contact

Privacy inquiries and rights requests: hi@pr.run. General support: hi@pr.run.