--- title: "Privacy Policy — Stride Run Club" description: "How Stride Run Club collects, uses, stores and deletes member data, and how to exercise your rights under the DPDP Act." canonical: https://www.strideclub.in/privacy-policy last-updated: 2026-10-21 --- # Privacy Policy - Stride Run Club Bengaluru *Effective Date: 13/10/2026* · See the [Changelog](#changelog) for what changed in this version. This Privacy Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and constitutes the notice required under Section 5 of the DPDP Act. ## 1. Introduction This Privacy Policy describes how Stride Run Club Bengaluru ("we," "us," or "our"), a community run club based in Bengaluru, collects, uses, and discloses your personal data when you use our website at https://www.strideclub.in/, create an athlete profile, or register for and attend our runs and events (together, the "Service"). When you join our runs and use our website, you trust us with your personal data. In this Privacy Policy, we explain in the clearest way we can what we collect, why we collect it, who we share it with, how long we keep it, and what rights you have over it. **We do not sell your personal data**, and we do not use it for advertising. Please read this Privacy Policy carefully. ## 2. Definitions To help explain things as clearly as possible in this Privacy Policy, every time any of these terms are referenced, they are strictly defined as: - **Cookie**: a small file placed on your device to enable certain features and functionality. - **Club**: when this policy mentions "Club," "we," "us," or "our," it refers to Stride Run Club Bengaluru. - **Country**: where Stride Run Club Bengaluru and its founder are based, in this case India. - **Member**: a person who has created an account on the Service. - **Device**: any internet-connected device such as a phone, tablet, or computer that can be used to visit the Website and use the Service. - **Personal Data**: any information that directly, indirectly, or in connection with other information allows for the identification of a natural person. - **Service**: the club's website, athlete profiles, leaderboard, and the registration, ticketing, and check-in for the club's runs and events, as described in our Terms of Service. - **Service Provider**: a company that processes Personal Data on our behalf and on our instructions so that we can run the Service — for example, for hosting, sign-in, email delivery, payments, or analytics. Service Providers are listed in Section 7. - **Website**: Stride Run Club Bengaluru's site, which can be accessed via https://www.strideclub.in/. - **You**: a person who visits the Website or is registered with the Service. ## 3. Information We Collect We collect only the Personal Data we need to run the club and the Service. This Section lists all of it. 3.1 Information You Give Us - **Account details**: your name, email address, and profile photograph, received from Google when you sign in with your Google account. - **Profile details you choose to add**: your username, biography, location, specialties, social-media links, cover image, prompt photographs, and race history. - **Event registration details**: your full name, date of birth, gender, contact phone number, and the phone number of the emergency contact you nominate (see Section 3.4); your answers to any additional questions an event asks (for example, a T-shirt size); the packages and any coupon code you select; and your acceptance of the event's terms. - **Declarations**: the record that you made the medical fitness declaration at registration (see Section 3.5) and, for a participant under 18, the record that a parent or guardian consented (see Section 11). - **Payment records**: for paid events, the amount, the payment status, and the order and payment identifiers issued by our payment gateway, Razorpay. Card and other payment-instrument details are entered directly with Razorpay and never reach us. - **Participation records**: your registrations, your check-in at events, your Stride Tag (the short code shown on your ticket and used at check-in), runs completed, and the milestones that follow from them. - **Marketing preference**: whether you have opted in to marketing email, and when (see Section 4.1). - **Messages you send us**: the content of any email, call, or contact-form message you send us. 3.2 Information Collected Automatically - **Usage data**: the pages you visit, the page that referred you, your browser and device type, and approximate location derived from your IP address, collected through the analytics tools described in Section 5. - **Cookies**: the cookies listed in Section 5 (Cookie Policy). 3.3 Strava Connection (Optional) If You choose to connect Your Strava account, We receive, through Strava's official authorisation process and only with the permissions You approve on Strava: Your Strava athlete identifier, Your year-to-date running distance and run count, and the name, date, start time, distance, moving time, elevation gain and route map of Your most recent runs that You have shared with "Everyone" on Strava. We do not receive activities You have set to "Only You", route sections inside Your Strava privacy zones, heart-rate data, or Your Strava password. We use this data only to show Your kilometres this year on the Stride leaderboard and Your last five (5) public runs on Your Stride profile, where they are visible to other visitors in the same way as the rest of Your profile. We keep only Your five (5) most recent public runs, and the access credentials Strava issues to Us are stored encrypted. We do not use Strava data for advertising, and We do not share it with, or use it to train, any artificial-intelligence system. You may disconnect Strava at any time from Your profile, or by removing Stride Run Club from Your Strava settings. When You do, or when You delete Your Stride account, all Strava data We hold about You is permanently deleted. 3.4 Emergency Contacts When you register for an event, we ask for the phone number of someone we can call if you are injured or unwell. That number is the Personal Data of another person, so: - you confirm, by providing it, that the person has agreed to be your emergency contact and knows that you have given us their number; - we use the number only to contact that person in an emergency involving you at a club run or event, and for no other purpose — we never send them marketing or add them to any list; - we do not ask for any other information about them; and - the number is kept with your account and erased with it (Sections 6 and 12). Your emergency contact may ask us to erase their number at any time using the details in Section 16. 3.5 Health-Related Information The only health-related information we collect is the record that you made the medical fitness declaration at registration — that is, that you confirmed you are fit to take part. We do not ask for, and you should not send us, details of any medical condition, medication, or medical records. Where information relating to your physical or physiological health is processed, we treat it as sensitive personal data under the SPDI Rules: we collect it only with your consent, use it only for the safe conduct of the event, and protect it with the security practices described in Section 10. We do not collect your postal address, government identity numbers, or biometric data. ## 4. How We Use Your Information We use your Personal Data only for the following purposes: - To create and operate your account and athlete profile, and to display it as you direct - To register you for runs and events, take payment where applicable, check you in, and record your runs completed and milestones - To run each event safely, including contacting you or your emergency contact in an emergency - To send you service email about your account and the events you have registered for (for example, booking confirmations, run-day details, and changes or cancellations) — these are not marketing and are sent whether or not you have opted in under Section 4.1 - To show the leaderboard and, if you connect it, your Strava activity - To respond to your questions and requests, including requests to exercise your rights - To understand how the Website is used and to improve it, using the analytics described in Section 5 - To detect, prevent, and address technical issues, abuse, and security incidents - To comply with our legal obligations, including tax and accounting obligations We will not use your Personal Data for a new purpose without first telling you and, where the law requires it, asking for your consent. 4.1 Marketing Email We send marketing email — news of other Stride runs, and of events we organise with partners — **only if you have opted in**. You can opt in by ticking the box offered at event registration, or by switching on marketing email on your profile page. The box is never ticked for you. You can withdraw that consent at any time, as easily as you gave it: - by using the **unsubscribe** link at the bottom of every marketing email, which takes effect immediately and does not require you to sign in; - by switching off marketing email on your profile page; or - by contacting us using the details in Section 16. Withdrawing consent stops marketing email only. You will still receive the service email described above for events you have registered for. 4.2 No Sale of Personal Data We do not sell, rent, or trade your Personal Data. We do not share it with advertisers, and we do not give our sponsors or event partners access to it. We share Personal Data only with the Service Providers listed in Section 7, and in the limited cases set out in Section 8. ## 5. Cookie Policy This Section describes every cookie and similar storage mechanism used by the Service. **We use strictly necessary cookies and analytics cookies.** We do not use advertising or profiling cookies of any kind, and no third party is permitted to place advertising cookies through our Service. The cookies we set are: - **Authentication session cookies** (`sb-*`): first-party cookies set by our authentication provider (Supabase) to keep you securely signed in and to refresh your session. These are essential — without them, sign-in and every account feature of the Service would not function. - **Sign-in redirect cookie** (`stride_next`): a first-party cookie that remembers the page you were on when you began signing in with Google, so we can return you there afterwards. It expires automatically within ten (10) minutes and is deleted as soon as it is used. - **Security state cookie** (`strava_oauth_state`): a first-party cookie used solely to protect the optional Strava connection flow against cross-site request forgery (CSRF) attacks. It expires automatically within ten (10) minutes and is deleted as soon as it is used. - **Cookie notice cookie** (`stride_cookie_ack`): remembers that you have dismissed the cookie notice, so it is not shown again. It expires after one (1) year. - **Analytics choice cookie** (`stride_analytics_optout`): remembers that you have opted out of analytics, so Google Analytics is not loaded for you. It expires after one (1) year. - **Analytics cookies** (`_ga`, `_ga_*`): first-party cookies set by Google Analytics 4 to measure how the Service is used — which pages are visited, which links brought you here, and whether you are a returning visitor. They record aggregated usage, not the content of your account. They are **not** strictly necessary: refusing them affects nothing except our statistics. `_ga` and `_ga_*` expire after two (2) years, unless you clear them sooner. Google acts as our Service Provider for this data; it is not used for advertising, and we have not enabled Google Signals or ad personalisation. Google Analytics does not run on our administration pages. In addition to cookies, the Service uses your browser's session storage (which is erased when you close the tab) for minor interface conveniences, such as preventing a sign-in confirmation message from appearing twice. We also use Vercel Analytics and Vercel Speed Insights, which are cookieless services that collect aggregated, anonymised page-performance and usage statistics; they do not set cookies, do not build user profiles, and do not track you across other websites. **Your choice about analytics.** Google Analytics is switched on when you first visit the Website, and a cookie notice tells you so. You can opt out at any time — by choosing **"Opt out of analytics"** on the cookie notice, or later by using the **Analytics** control in the footer of every page. Once you opt out, Google Analytics is not loaded and no further `_ga` cookies are set; you can switch it back on in the same place. You may also opt out of Google Analytics on any site using Google's browser add-on at https://tools.google.com/dlpage/gaoptout. You may also instruct your browser to refuse or delete cookies at any time. If you refuse the strictly necessary cookies you will not be able to sign in or use account features of the Service; if you refuse or clear the analytics cookies, every part of the Service continues to work normally. We will not introduce advertising or profiling cookies, and if we ever intend to, we will seek your prior consent in accordance with the DPDP Act before setting them. ## 6. Retention of Your Personal Data 6.1 General Rule We retain your Personal Data only for as long as it is needed for the purposes set out in this Privacy Policy, and then erase it, unless the law requires us to keep it for longer (Section 6.4). Usage data collected through analytics is kept in aggregated form and is retained by Google Analytics for no longer than fourteen (14) months. 6.2 Erasure of Inactive Accounts In accordance with the data-retention limitations of the DPDP Act, we do not retain Personal Data indefinitely. If your account remains inactive for a continuous period of **three (3) years** — meaning that within that period you have not signed in, updated your profile, registered for an event, or checked in at an event — your account and all Personal Data associated with it will be **permanently and irreversibly erased** from our systems by an automated process. This erasure encompasses your profile, photographs, emergency-contact number, event registrations, run history, and sign-in credentials. Any activity on your account within the three-year period resets this retention clock. The only exception is the financial records described in Section 6.4. 6.3 Erasure upon Account Deletion When you delete your account (see Section 12), your Personal Data is erased immediately and permanently from our production systems. We do not keep anonymised or archival copies of your profile. The only exception is the financial records described in Section 6.4. 6.4 Financial Records Required by Law Where you have paid for a run, event, or purchase, Indian tax law requires us to keep a record of that transaction even after your account is deleted: Section 36 of the Central Goods and Services Tax Act, 2017 requires accounts and records to be kept for seventy-two (72) months, and the Income-tax Act, 1961 requires books of account to be kept for six (6) years. For each paid transaction, we therefore keep only: - the name and email address the payment was made under; - the event or item paid for, the amount, any tax charged, and the date; and - the order and payment identifiers issued by Razorpay, the payment status, and any refund. These records are kept separately from your profile, are used only to meet our tax, accounting, and legal obligations (including handling a dispute or chargeback), are not used for any other purpose, and are erased when the longest applicable retention period ends. Your profile, photographs, emergency contact, and other non-financial data are still erased as described in Sections 6.2 and 6.3. ## 7. Where Your Data Is Processed We are based in India, and our main systems are hosted in India. Some of our Service Providers process Personal Data outside India. These transfers are permitted under Section 16 of the DPDP Act, which allows transfers to any country other than those the Government of India has restricted by notification; no country is currently restricted. We use only Service Providers that are bound to protect your data and to use it only on our instructions. Our Service Providers, and where they process your data, are: - **Supabase** (database, sign-in, and file storage): your account, profile, registrations, and photographs are stored in Supabase's Mumbai, India region (AWS `ap-south-1`). - **Vercel** (website hosting): the Website's servers run in Vercel's Mumbai, India region (`bom1`). Public pages and images are also delivered through Vercel's global content-delivery network, which may serve them from locations outside India. - **Google** (Sign in with Google, and Google Analytics): Google processes your sign-in, and the analytics data described in Section 5, on its global infrastructure, including in the United States. - **Brevo** (email delivery): your name and email address are processed by Brevo, in the European Union, to deliver the email we send you. - **Razorpay** (payments): payments are processed by Razorpay in India. - **Strava** (only if you connect it): data is exchanged with Strava in the United States, as described in Section 3.3. - **WalletWallet** (only if you add a ticket to your phone's wallet): the event's name, date, and venue and your Stride Tag are sent to WalletWallet to create the wallet pass. ## 8. Disclosure of Your Personal Data We do not sell your Personal Data or share it with advertisers, sponsors, or event partners. Apart from our Service Providers (Section 7), we disclose Personal Data only in the following cases. ### Other Visitors The parts of your profile you make public, and your name, photograph, distance, and runs completed on the leaderboard, are visible to anyone who visits the Website, as described in Section 9 and in our Terms of Service. ### Business Transactions If Stride Run Club Bengaluru is involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy. ### Disclosure for Law Enforcement Under certain circumstances, Stride Run Club Bengaluru may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency). ### Legal Requirements Stride Run Club Bengaluru may disclose your Personal Data in the good faith belief that such action is necessary to: - Comply with a legal obligation - Protect and defend the rights or property of Stride Run Club Bengaluru - Prevent or investigate possible wrongdoing in connection with the Service - Protect the personal safety of users of the Service or the public, including sharing the information needed with medical personnel in an emergency at an event - Protect against legal liability ## 9. Photographs This Section describes the two kinds of photographs we deal with: the profile photograph on your account, and photographs taken by the club at its runs and events. 9.1 Your Profile Photograph When you sign in to the Service using your Google account, we receive, with your consent, the profile photograph associated with that Google account, together with your name and email address, and we display that photograph as your profile image. You may also choose to upload a photograph of your own at any time; uploaded photographs are processed (resized and converted) and stored on our secure storage infrastructure. We use your profile photograph solely to represent you within the Service — on your profile, on the leaderboard, and in club administration tools — and for no other purpose. We do not use it for advertising, facial recognition, or automated profiling, and we never sell, license, or give it to any sponsor, partner, or other third party. 9.2 Your Control over Your Profile Photograph You have, at all times, the following controls over your profile photograph: - **Replacement**: you may upload a new photograph at any time, which permanently replaces the previous one. - **Deletion**: you may permanently delete your photograph at any time from your profile. Upon deletion, the image file is removed from our storage and a neutral placeholder displaying only the initials of your name is shown in its place, everywhere on the Service. - **Private profile**: you may make your profile private from your profile page. A private profile can be seen only by you and by club administrators. If you appear on the leaderboard, your name and photograph remain visible there but are no longer linked to your profile; to stop your photograph appearing on the leaderboard, delete it as described above. 9.3 Club Event Photography The club, or photographers working for it, take photographs and video at runs and events, and you may appear in them. The club uses this photography to share and promote its runs on its website and social-media channels. Where an event is organised with a partner, the club may also share photographs from that event with that partner, so the partner can use them in coverage of that event. The club does not: - give event photographs to any partner for use in advertising the partner's products or services; - sell or license event photographs to anyone; or - share any of your other Personal Data (such as your name or contact details) with a partner along with a photograph. If you do not want to appear in published club photographs, tell the photographer or an organiser on the day, or contact us using the details in Section 16 at any time. We will remove any published club photograph of you that you ask us to, from our own channels, and ask any partner we shared it with to remove it too. 9.4 Erasure Your profile photograph and all images you uploaded are permanently erased when you delete your account, as described in Sections 6 and 12. ## 10. Security of Your Personal Data We protect your Personal Data with reasonable security practices, including encrypted connections (HTTPS) for all traffic, access controls that restrict administrative access to a small number of club administrators, database-level access rules so that each Member can read and change only their own records, and encryption of the access credentials we receive from Strava. No method of transmission over the Internet, or method of electronic storage, is completely secure, so while we work hard to protect your Personal Data, we cannot guarantee its absolute security. ## 11. Children's Privacy In accordance with Section 9 of the DPDP Act, we process the Personal Data of a child (a person who has not completed eighteen (18) years of age) only with the verifiable consent of the child's parent or lawful guardian. We do not undertake tracking or behavioural monitoring of children, nor do we direct any advertising at children. Members under 18 are not shown on the public leaderboard. If you are a parent or guardian and you become aware that a child in your care has provided us with Personal Data without your consent, please contact us using the details in Section 16. If we become aware that we have collected Personal Data from a child without verifiable parental or guardian consent, we will take immediate steps to erase that information from our systems. ## 12. Your Data Protection Rights Under the DPDP Act, you have the right to access, correct, complete, update, and erase your Personal Data, to withdraw your consent, to nominate another person to exercise your rights in the event of your death or incapacity, and to have your grievances addressed. We honour these rights regardless of where you are located. 12.1 Access, Correction and Erasure on Request You can make the following requests regarding your Personal Data: - **Access Your Data**: You can request a summary of the Personal Data we hold about you, the processing we carry out, and the Service Providers we have shared it with. We will provide this information in a structured, commonly used, and machine-readable format. - **Correct Your Data**: You can correct and update most of your details yourself on your profile page, or ask us to do it. - **Delete Your Data**: You can request that we delete your Personal Data from our systems. We will comply with this request, except for the financial records we are required by law to keep (Section 6.4). - **Nominate**: You can nominate another person to exercise your rights on your behalf in the event of your death or incapacity. To submit a request, please contact us using the contact information in Section 16. We will respond to your request within 30 days. We may need to verify your identity before processing your request. 12.2 Self-Service Right to Erasure (Account Deletion) In accordance with Section 12 of the DPDP Act, you may exercise your right to erasure directly and at any time, without contacting us, by using the **"Delete account"** control on your profile page. Exercising this right effects an **immediate, permanent, and irreversible erasure** of all Personal Data associated with your account from our production systems, including: - your profile and all details contained in it (name, email address, biography, contact details, social links, and preferences); - the emergency-contact number you provided; - all photographs and images you have uploaded or that were obtained from your Google account; - all of your event registrations, declarations, and attendance history; - any Strava data and credentials; - your sign-in credentials, so that the account can no longer be accessed. The only data kept after deletion is the financial record of any payment you made, as required by law and described in Section 6.4. Erased data cannot be recovered. If you later wish to use the Service again, you must create a new account, which will not be linked to any previously erased data. **Sole administrator**: where the person seeking deletion is the only administrator of the club platform, the deletion will not proceed until administrative responsibility has been transferred by designating another member as administrator. This safeguard exists solely to ensure continuity of the Service's operation and does not otherwise limit the right to erasure. 12.3 Withdrawal of Consent You may withdraw your consent to our processing of your Personal Data at any time with the same ease with which it was given. You can withdraw consent to marketing email on its own, as described in Section 4.1, and opt out of analytics on its own, as described in Section 5. Withdrawing consent to the rest of our processing is effected by deleting your account as described above. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. 12.4 Other Jurisdictions Many countries around the world have adopted comprehensive data protection laws that provide various rights to individuals regarding their personal data. Even if we haven't specifically listed your country's laws, we're committed to respecting your rights to access and delete your personal information wherever you are located. If you have any questions about exercising your data rights, please contact us using the information provided in the "Contact Us" section below. ## 13. Personal Data Breach If a breach of security leads to the accidental or unlawful loss, disclosure, alteration, or destruction of, or access to, Personal Data that we hold, we will: - **Tell you without delay.** We will inform each affected person, by email and in plain language, of what happened, when, the likely consequences, what we are doing about it, what you can do to protect yourself, and how to contact us. We will do this for every breach that affects your Personal Data, however few people are affected. - **Report it to the Data Protection Board of India.** We will inform the Board without delay, and give it a full report within seventy-two (72) hours of becoming aware of the breach, as required by Section 8(6) of the DPDP Act and the Digital Personal Data Protection Rules, 2025. - **Report it to CERT-In.** Where the breach is a cyber-security incident of a kind that must be reported, we will report it to the Indian Computer Emergency Response Team (CERT-In) within six (6) hours of noticing it, as required by its directions under Section 70B of the Information Technology Act, 2000. We will also act immediately to contain the breach and to prevent it from happening again. ## 14. Links to Other Sites Our Service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services. ## 15. Changes to This Privacy Policy We may update this Privacy Policy from time to time. Before a material change becomes effective, we will tell you by email and/or by a prominent notice on the Service. We will update the "Effective Date" at the top of this Privacy Policy and record every change in the Changelog at the end of it. Where a change would use your Personal Data for a new purpose that needs your consent, we will ask for that consent first. ## 16. Contact Us If you have any questions about this Privacy Policy, please contact us: - By email: striderunclubbengaluru@gmail.com - By visiting this page on our website: [https://www.strideclub.in/contact-us/](https://www.strideclub.in/contact-us/) - By phone number: +91 8368877289 ## 17. Grievance Redressal In accordance with the DPDP Act and applicable Indian law, if you have any grievance regarding the processing of your Personal Data, the exercise of your rights under this Privacy Policy, or any other aspect of our handling of your information, you may contact our Grievance Officer: - **Name**: Sidharth Yadav, Founder — Stride Run Club Bengaluru - **Email**: striderunclubbengaluru@gmail.com - **Phone**: +91 8368877289 We will acknowledge your grievance within forty-eight (48) hours of receipt and endeavour to resolve it within fifteen (15) days. If you are not satisfied with our response, you have the right to escalate your grievance to the Data Protection Board of India in the manner prescribed under the DPDP Act. ## Changelog - **13/10/2026.** Listed every category of Personal Data we collect (Section 3), including emergency contacts, health-related declarations, Strava, and payment records. Made marketing email opt-in only, with an unsubscribe link in every marketing email (Section 4.1). Stated that we do not sell Personal Data. Described the analytics opt-out (Section 5). Added the retention of financial records required by tax law (Section 6.4). Rewrote Section 7 to name each Service Provider and where it processes data. Set out how club event photography is used and shared (Section 9.3), and corrected the description of profile visibility (Section 9.2). Added the Personal Data Breach section (Section 13). Removed template wording that described the club as a software service, and fixed the section numbering. - **23/09/2026.** Added the Strava Connection section (Section 3.3). - **26/08/2026.** Updated the Cookie Policy for Google Analytics. - **13/07/2026.** Added the Cookie Policy, photograph controls, inactive-account and deletion retention rules, self-service erasure, withdrawal of consent, and the guardian-consent rules for children.