Privacy Policy

Scope and Controller Information

This Privacy Policy (“Policy”) describes how Alpine Asset Architects, LLC, doing business as PR Run, a Montana limited liability company with its principal office at 1001 S Main St, Ste #600, Kalispell, MT 59901(“PR Run,” “Company,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes personal information when you visit https://pr.run, write us, use the Service, or otherwise interact with us.

For personal information PR Run processes on behalf of a business customer (including a race organization, coach, or team) that later submits athlete data through the Service, PR Run generally acts as a processor (or service provider) and the customer acts as the controller. Such processing is governed by our Data Processing Addendum and the customer’s instructions.

Categories of Information We Collect

Depending on how you interact with PR Run, we may collect:

• Account and profile data: when you create a PR Run account through Clerk, we collect email address and authentication credentials through Clerk. Profile data you provide (public handle, optional profile image, bio, race selection, location, gear preferences, and follow relationships) is stored in Supabase Postgres as athlete product data. Clerk remains the authentication provider.
• Course setup and training inputs: when you complete PR Run course setup, we store race goals, training baseline estimates, weekly availability, terrain-access categories, experience categories, training preferences, and derived course-demand summaries in Supabase Postgres. This data is private to your account, used to prepare course-specific training, and is not displayed on public athlete profiles. A minimal training-safety screen response may be stored; PR Run does not collect detailed medical history through this flow. That screen is flagged for professional review.
• Training plans and workout records: when you generate, activate, and follow a PR Run training plan, we store plan metadata, weekly schedules, workout prescriptions, completion records, athlete feedback (including RPE and private notes), manual modifications (moves, shortenings, substitutions), pause history, adaptation evaluations, plan revision proposals, athlete training-state snapshots, and weekly review summaries in Supabase Postgres. This data is private by default and is not published on public athlete profiles. Analytics events may record coarse product actions (for example, that an adjustment was proposed) but do not include actual distance, duration, vertical, RPE, private notes, safety responses, or raw adaptation inputs.
• Optional Strava connection: if you connect Strava, we store your Strava athlete identifier, encrypted OAuth tokens, and activity summaries (distance, duration, elevation gain, sport type, and relative effort when Strava provides it). Strava data is private to your account, used to match activities to your training plan and update readiness metrics. We do not display Strava data on public athlete profiles or share it with other users. Disconnect removes tokens and activity links; Strava-sourced completions may remain unless you delete your account.
• Identifiers: email address and name when you write hi@pr.run or otherwise contact us outside the account system.
• User Content: race, course, fitness, file, and related materials you submit, which may include personal information about you or, if you are a business customer, about athletes on whose behalf you act.
• Usage and device information: pages viewed, approximate request metadata, browser type, operating system, IP address, analytics events through Datafast, and technical logs used to operate, secure, and deliver the Service.
• Communications: the content of messages you send to hi@pr.run, hi@pr.run, or security@pr.run.
• Commercial information: if paid features are offered, subscription status, invoice references, and transaction history. Payment card data, if collected, will be processed by a third-party processor (Stripe, Inc. or a successor). PR Run will not store full payment card numbers. Paid features and adaptive coaching subscriptions are not live as of the effective date of this Policy.

We do not knowingly collect sensitive personal information except as you choose to include it in a message or in User Content. You should not send us health diagnoses or other special-category data unless a later product feature expressly requests it and you have a lawful basis to provide it.

How We Use Information

We use personal information for the following business purposes:

• Providing, operating, maintaining, securing, and improving the Service.
• Responding to mail you send us and operating athlete accounts you create.
• Displaying public athlete profiles and follow features you enable.
• Understanding site usage through analytics.
• Generating course-specific training guidance and race-morning materials you request when those features are offered.
• Communicating transactional messages about the Service.
• Detecting, investigating, and preventing fraud, abuse, and security incidents.
• Enforcing our Terms, Acceptable Use Policy, and other agreements.
• Complying with applicable law, regulation, and legal obligations.
• Generating aggregated or de-identified analytics that do not identify individuals.

We do not sell personal information. We do not use personal information for cross-context behavioral advertising.

Legal Bases for Processing

Where the General Data Protection Regulation (“GDPR”), UK GDPR, or similar laws apply, we rely on the following legal bases:

• Contractual necessity: processing necessary to perform our contract with you, including delivering the Service and responding to requests you initiate.
• Legitimate interests: securing the Service, preventing fraud, improving functionality, and communicating about the Service, balanced against your rights and interests.
• Consent: where required for optional cookies, marketing communications, or other processing for which consent is the appropriate basis.
• Legal obligation: compliance with tax, accounting, regulatory, and law enforcement requirements.

Where U.S. state privacy laws apply, we process personal information as a business or controller for our own site operations and correspondence, and as a service provider or processor on behalf of business customers that submit athlete data.

Processing of User Content

User Content is processed to provide features you request, including storage, course analysis, training guidance, and race-morning materials. You control what content is submitted. If you submit data about other people, you are responsible for establishing an appropriate legal basis and for the instructions you give us.

Automated Processing

If we later offer software-generated training or pacing suggestions, those outputs are based on information you provide and on course data. They are probabilistic aids. We do not use User Content to train generally available third-party machine learning models except as expressly permitted in an applicable agreement or with your explicit consent.

How We Disclose Information

We may disclose personal information to:

• Service providers and subprocessors who process information on our behalf under contractual confidentiality and data protection obligations.
• Professional advisors including attorneys, accountants, and insurers, subject to confidentiality obligations.
• Law enforcement and regulators when required by law, subpoena, court order, or to protect rights, safety, and security.
• Successors in connection with a merger, acquisition, reorganization, or sale of assets, subject to this Policy.

We do not disclose personal information to third parties for their own marketing purposes.

Service Providers and Subprocessors

We engage infrastructure, authentication, and analytics providers to operate PR Run. A current list of subprocessors, their purposes, and applicable privacy policies is maintained at our Subprocessor page. As of the effective date, providers include Vercel, Inc. (hosting), Clerk, Inc. (authentication), Supabase, Inc. (application database for athlete product data), and Datafast (analytics).

Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookie Policy. Authentication session cookies are set by Clerk when you log in. Analytics scripts from Datafast may set their own cookies or similar storage. We do not use advertising cookies.

Analytics

PR Run uses Datafast for website analytics on https://pr.run. Datafast receives page views, approximate device and browser metadata, referral information, and custom goal events configured in the application. Exact cookie and storage behavior should be verified against Datafast documentation. We do not use personal information for cross-context behavioral advertising.

Data Retention

We retain personal information for as long as necessary to provide the Service, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data category:

• Correspondence: retained while we are responding to you and for a reasonable period thereafter.
• Course setup data: deleted with your account through the same Supabase cascade as other athlete product data, including onboarding progress, baselines, availability, terrain access, and preferences.
• Account and profile data: retained while your account is active and deleted when you delete your account through the Service or request deletion, subject to backup retention through Clerk.
• User Content: retained until you request deletion or your account is terminated, subject to backup retention.
• Strava data: while connected, activity links and encrypted tokens are retained until you disconnect or delete your account. On disconnect, tokens and links are removed from PR Run. On account deletion, Strava connection records and activity links are purged with your athlete data.
• Billing records: if paid features are offered, retained as required by tax and accounting laws.
• Security logs: retained for a period consistent with security and incident response needs.

Backup copies may persist for a limited period before being overwritten in the ordinary course.

Security

We implement administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. See our Security page for an overview. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

International Data Transfers

PR Run is based in the United States. Personal information is hosted in the United States and may be processed in other countries where we or our subprocessors maintain facilities. When we transfer personal information from the European Economic Area, United Kingdom, or Switzerland to countries without an adequacy determination, we implement appropriate safeguards, including:

• Standard Contractual Clauses approved by the European Commission (Module 2: Controller to Processor and Module 3: Processor to Processor, as applicable).
• The UK International Data Transfer Addendum where required for UK transfers.
• Supplementary measures as assessed through transfer impact analysis where appropriate.

A copy of applicable transfer mechanisms may be requested by contacting hi@pr.run.

Your Privacy Rights and Choices

Depending on your location, you may have the following rights regarding your personal information, subject to applicable exceptions:

• Access: request confirmation of whether we process your information and obtain a copy.
• Correction: request correction of inaccurate information.
• Deletion: request deletion of your information, subject to legal retention requirements.
• Restriction: request restriction of processing in certain circumstances.
• Portability: receive information you provided in a structured, commonly used, machine-readable format where applicable.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: where processing is based on consent, withdraw consent at any time without affecting prior lawful processing.

California and U.S. state privacy rights

If you are a California resident or reside in a state with a comprehensive privacy law, you may have additional rights, including the right to know categories of information collected, request deletion, and opt out of certain processing. PR Run does not sell personal information and does not share personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”).

To submit a request, contact hi@pr.run. We will verify your identity before responding and will respond within the timeframe required by applicable law (generally forty-five (45) days for CCPA/CPRA requests, extendable once where permitted). You may designate an authorized agent to submit requests on your behalf where permitted by law. If we deny a request, you may appeal by replying to our response. California residents may contact the California Attorney General with complaints regarding our handling of personal information.

EEA, UK, and Swiss rights

If you are located in the EEA, UK, or Switzerland, you have the right to lodge a complaint with your local supervisory authority. PR Run’s primary contact for GDPR inquiries is hi@pr.run.

Business Customers and Athlete Data

If a race organization, coach, or team later submits athlete data through the Service, that customer controls the data it submits. Individuals whose information is contained in such submissions should direct requests to the relevant organization, which PR Run will assist in responding to as processor where applicable.

Children's Privacy

The Service is not directed to children under sixteen (16) years of age, and we do not knowingly collect personal information from children. If you believe we have collected information from a child, contact hi@pr.run and we will take appropriate steps to delete such information.

Changes to This Policy

We may update this Policy from time to time. Material changes will be posted on this page with an updated effective date and, where required, additional notice. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

Contact

Privacy inquiries and rights requests: hi@pr.run. General support: hi@pr.run.