Privacy and cookie policy
Last updated: 10 November 2026
1. Who is responsible for your data
- Controller: Endurance Freedom LLC, a limited liability company (LLC) based in the United States, which owns RunRocker and the runrocker.com website.
- Privacy contact: info@runrocker.com
2. What data we process, why, and on what legal basis
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| Pace calculator | Name, email, your result (distance and time) and your agreement to receive the newsletter | Showing your results, emailing you the pace sheet and, if you agree, sending the newsletter with training tips | Your consent (GDPR art. 6(1)(a)) |
| Personal coaching application | Name, email, phone, country, time zone, goals, level, races, availability, injuries or limitations, budget and how you found us | Assessing your application, contacting you and proposing a plan | Your consent and, if you sign up, performance of a contract (art. 6(1)(a) and (b)). For injuries or limitations (health data): your explicit consent (art. 9(2)(a)) |
| Application to become a coach | Personal and professional details you send us | Assessing your application | Your consent and pre-contractual steps |
| User account (athletes and coaches) | Email, name, profile details you add, plans and workouts | Providing the platform service | Performance of a contract (art. 6(1)(b)) |
| Strava connection (optional) | Your Strava activities (distance, time, pace, heart rate, etc.) | Displaying and analysing your training | Your consent when you connect the account; you can disconnect it at any time |
| Payments and invoicing | Billing and payment details (card data is handled by Stripe; we never see it) | Charging, invoicing and meeting tax obligations | Performance of a contract and legal obligation |
| Newsletter and sign-up forms | Name and email | Sending you RunRocker content | Your consent |
| Contact | What you write to us | Replying to you | Your consent or our legitimate interest in answering your enquiry |
| Advertising | If you arrive from an ad, we store which campaign your request came from (UTM tags) | Knowing which campaigns work | Legitimate interest; storage on your device and the Meta Pixel only with your consent |
We do not make automated decisions with legal effects on you.
3. Who else receives your data
We only use providers that deliver a service to us and process data on our behalf. We do not sell your data.
| Provider | Purpose |
|---|---|
| Supabase | Database and account access (project hosted in the EU) |
| Vercel | Website hosting and cookie-free visit statistics |
| Resend | Transactional email, such as the pace sheet |
| MailerLite | Newsletter sending and management |
| Stripe | Payments |
| Strava | Only if you connect your account |
| Meta (Facebook / Instagram) | Ad measurement, only if you accept cookies |
The controller is based in the United States, although most data is hosted in the European Union (the database is in Stockholm). If you are in the European Economic Area, your data may be processed or accessed from the United States. Whenever a provider or we process data outside the EEA, we apply appropriate safeguards, such as the EU standard contractual clauses or the EU-US Data Privacy Framework where the provider is certified.
4. How long we keep it
- Calculator and newsletter: until you unsubscribe or, if there is no activity, 24 meses.
- Coaching applications: 24 meses from the last contact, if they do not become a client.
- Clients and accounts: for as long as the relationship lasts and then as long as the law requires (for example 6 años for invoices and accounting).
- Strava: until you disconnect or delete your account.
5. Your rights
You can ask us for access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent at any time without affecting past processing. Write to info@runrocker.com.
If you are not satisfied with our reply, you can complain to the data protection authority in your country (in Spain, the Spanish Data Protection Agency, www.aepd.es). Every newsletter email contains an unsubscribe link.
7. Minors
The website is not aimed at children under 14. If you believe a minor has given us data, write to us and we will delete it.
8. Security
We apply reasonable technical and organisational measures: encrypted connections, access control and providers with security certifications. If a breach affecting you occurs, we will tell you as required by law.
9. Changes to this policy
If we change it in a significant way, we will say so on the website. The date above shows the latest version.