Privacy Policy - Stride Run Club Bengaluru

Effective Date: 13/07/2026

This Privacy Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000, and constitutes the notice required under Section 5 of the DPDP Act.

1. Introduction

This Privacy Policy describes how Stride Run Club Bengaluru ("we," "us," or "our") collects, uses, and discloses your personal information when you use our software as a service (the "Service").

We are committed to protecting your personal information and your right to privacy. When you visit our software as a service and use our products, you trust us with your personal information. We take your privacy very seriously. In this Privacy Policy, we seek to explain to you in the clearest way possible what information we collect, how we use it, and what rights you have in relation to it.

This Privacy Policy applies to all information collected through our software as a service, as well as any related services, sales, marketing, or events.

Please read this Privacy Policy carefully as it will help you understand what we do with the information we collect.

2. Definitions

To help explain things as clearly as possible in this Privacy Policy, every time any of these terms are referenced, they are strictly defined as:

• Cookie: a small file placed on your device to enable certain features and functionality.
• Company: when this policy mentions "Company," "we," "us," or "our," it refers to Stride Run Club Bengaluru.
• Country: where Stride Run Club Bengaluru or the owners/founders of Stride Run Club Bengaluru are based, in this case India.
• Customer: refers to the company, organization, or person that signs up to use the Stride Run Club Bengaluru Service.
• Device: any internet-connected device such as a phone, tablet, computer, or any other device that can be used to visit Stride Run Club Bengaluru and use the services.
• Personal Data: any information that directly, indirectly, or in connection with other information allows for the identification of a natural person.
• Service: refers to the software as a service provided by Stride Run Club Bengaluru as described in the relative terms and on this platform.
• Third-party service: refers to advertisers, contest sponsors, promotional and marketing partners, and others who provide our content or whose products or services we think may interest you.
• Website: Stride Run Club Bengaluru's site, which can be accessed via https://www.strideclub.in/.
• You: a person or entity that is registered with Stride Run Club Bengaluru to use the Services.

3. Information We Collect

We collect several different types of information for various purposes to provide and improve our Service to you.

3.1 Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Address, State, Province, ZIP/Postal code, City
• Cookies and Usage Data

3.2 Tracking Technologies and Cookies

Our use of cookies and similar technologies is limited to what is strictly necessary to operate the Service. A complete description of every cookie we set, its purpose, and its lifetime is set out in Section 5 (Cookie Policy) of this Privacy Policy. We do not use advertising cookies, and we do not permit third parties to place tracking or advertising cookies through our Service.

4. How We Use Your Information

Stride Run Club Bengaluru uses the collected data for various purposes:

• To provide and maintain our Service
• To notify you about changes to our Service
• To allow you to participate in interactive features of our Service when you choose to do so
• To provide customer support
• To gather analysis or valuable information so that we can improve our Service
• To monitor the usage of our Service
• To detect, prevent and address technical issues
• To fulfill any other purpose for which you provide it
• To provide you with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless you have opted not to receive such information
• In any other way we may describe when you provide the information
• For any other purpose with your consent

5. Cookie Policy

This Section describes every cookie and similar storage mechanism used by the Service. We use cookies solely to provide you with a functional, secure, and better user experience. We use only strictly necessary cookies. We do not use advertising, profiling, or cross-site tracking cookies of any kind, and no third party is permitted to place such cookies through our Service.

The cookies we set are:

• Authentication session cookies (sb-*): first-party cookies set by our authentication provider (Supabase) to keep you securely signed in and to refresh your session. These are essential — without them, sign-in and every account feature of the Service would not function.
• Sign-in redirect cookie (stride_next): a first-party cookie that remembers the page you were on when you began signing in with Google, so we can return you there afterwards. It expires automatically within ten (10) minutes and is deleted as soon as it is used.
• Security state cookie (strava_oauth_state): a first-party cookie used solely to protect the optional Strava connection flow against cross-site request forgery (CSRF) attacks. It expires automatically within ten (10) minutes and is deleted as soon as it is used.

In addition to cookies, the Service uses your browser's session storage (which is erased when you close the tab) for minor interface conveniences, such as preventing a sign-in confirmation message from appearing twice. We also use Vercel Analytics and Vercel Speed Insights, which are cookieless services that collect aggregated, anonymised page-performance and usage statistics; they do not set cookies, do not build user profiles, and do not track you across other websites.

Because every cookie we set is strictly necessary for the operation and security of the Service, they are deployed on the legal basis of providing the Service you have requested. You may instruct your browser to refuse cookies; however, if you do so, you will not be able to sign in or use account features of the Service. Should we ever introduce cookies that are not strictly necessary, we will seek your prior consent in accordance with the DPDP Act before setting them.

6. Retention of Your Personal Data

Stride Run Club Bengaluru will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

6.2 Erasure of Inactive Accounts

In accordance with the data-retention limitations of the DPDP Act, we do not retain Personal Data indefinitely. If your account remains inactive for a continuous period of three (3) years — meaning that within that period you have not signed in, updated your profile, registered for an event, or checked in at an event — your account and all Personal Data associated with it will be permanently and irreversibly erased from our systems by an automated process. This erasure encompasses your profile, photographs, event registrations, run history, and sign-in credentials. Any activity on your account within the three-year period resets this retention clock.

6.3 Erasure upon Account Deletion

When you delete your account (see Section 12), your Personal Data is erased immediately and permanently from our production systems. We do not retain anonymised or archival copies of your profile.

Stride Run Club Bengaluru will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of our Service, or we are legally obligated to retain this data for longer time periods.

6.1 Data Retention for Physical Goods

For orders involving physical goods, we retain your shipping and billing information, including your name, address, and contact details, as necessary to fulfill your order, process returns, manage warranty claims, and comply with tax, legal, and regulatory obligations. This information may be retained for a longer period than other personal data to ensure proper delivery of goods and to handle any post-purchase issues that may arise.

7. Transfer of Your Personal Data

Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

If you are located outside India and choose to provide information to us, please note that we transfer the data, including Personal Data, to India and process it there.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

Stride Run Club Bengaluru will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.

8. Disclosure of Your Personal Data

Business Transactions

If Stride Run Club Bengaluru is involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Disclosure for Law Enforcement

Under certain circumstances, Stride Run Club Bengaluru may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Legal Requirements

Stride Run Club Bengaluru may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of Stride Run Club Bengaluru
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

9. Photographs and Profile Images

This Section describes how we process photographs and other images associated with your account.

9.1 Sources of Your Profile Photograph

When you sign in to the Service using your Google account, we receive, with your consent, the profile photograph associated with that Google account, together with your name and email address, and we display that photograph as your profile image. You may also choose to upload a photograph of your own at any time; uploaded photographs are processed (resized and converted) and stored on our secure storage infrastructure. We use your photograph solely to represent you within the Service — on your profile, in club leaderboards, and in club administration tools — and for no other purpose. We do not use your photograph for advertising, facial recognition, or automated profiling, and we do not sell or license it to any third party.

9.2 Your Control over Your Photograph

You have, at all times, the following controls over your profile photograph:

• Replacement: you may upload a new photograph at any time, which permanently replaces the previous one.
• Deletion: you may permanently delete your photograph at any time from your profile. Upon deletion, the image file is removed from our storage and a neutral placeholder displaying only the initials of your name is shown in its place.
• Public visibility: you may, by means of a visibility control on your profile, direct that your photograph not be displayed on any publicly accessible surface of the Service (including your public profile, link previews, and leaderboards). When you do so, your photograph remains visible only to you and to club administrators for legitimate club-operation purposes (such as event check-in verification).

9.3 Erasure

Your photograph and all uploaded images are permanently erased when you delete your account, as described in Sections 6 and 12.

10. Security of Your Personal Data

The security of your Personal Data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

11. Children's Privacy

In accordance with Section 9 of the DPDP Act, we process the Personal Data of a child (a person who has not completed eighteen (18) years of age) only with the verifiable consent of the child's parent or lawful guardian. We do not undertake tracking or behavioural monitoring of children, nor do we direct any advertising at children.

If you are a parent or guardian and you become aware that a child in your care has provided us with Personal Data without your consent, please contact us using the details in Section 16. If we become aware that we have collected Personal Data from a child without verifiable parental or guardian consent, we will take immediate steps to erase that information from our systems.

12. Your Data Protection Rights

Depending on your location and applicable laws, you may have certain rights regarding your personal information, including rights to access, correct, delete, or restrict use of your information. We honor these rights regardless of your location and are committed to providing reasonable access to the information that you have shared with us.

12.1 General Data Access & Deletion Rights

Regardless of your location, you can make the following requests regarding your personal data:

• Access Your Data: You can request a copy of the personal information we have about you. We will provide this information in a structured, commonly used, and machine-readable format.

• Delete Your Data: You can request that we delete your personal information from our systems. We will comply with this request unless there is a legal requirement for us to keep certain information.

To submit a data access or deletion request, please contact us using the contact information provided at the end of this Privacy Policy. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

12.2 Self-Service Right to Erasure (Account Deletion)

In accordance with Section 12 of the DPDP Act, you may exercise your right to erasure directly and at any time, without contacting us, by using the "Delete account" control on your profile page. Exercising this right effects an immediate, permanent, and irreversible erasure of all Personal Data associated with your account from our production systems, including:

• your profile and all details contained in it (name, email address, biography, contact details, social links, and preferences);
• all photographs and images you have uploaded or that were obtained from your Google account;
• all of your event registrations and attendance history;
• your sign-in credentials, so that the account can no longer be accessed.

Erased data cannot be recovered. If you later wish to use the Service again, you must create a new account, which will not be linked to any previously erased data.

Sole administrator: where the person seeking deletion is the only administrator of the club platform, the deletion will not proceed until administrative responsibility has been transferred by designating another member as administrator. This safeguard exists solely to ensure continuity of the Service's operation and does not otherwise limit the right to erasure.

12.3 Withdrawal of Consent

You may withdraw your consent to our processing of your Personal Data at any time with the same ease with which it was given. Withdrawal is effected by deleting your account as described above. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

12.6 Other Jurisdictions

Many countries around the world have adopted comprehensive data protection laws that provide various rights to individuals regarding their personal data. Even if we haven't specifically listed your country's laws, we're committed to respecting your rights to access and delete your personal information wherever you are located.

If you have any questions about exercising your data rights, please contact us using the information provided in the "Contact Us" section below.

13. Service Providers

We may employ third-party companies and individuals to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services or to assist us in analyzing how our Service is used.

These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

14. Links to Other Sites

Our Service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

15. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update the "effective date" at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

16. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• By email: striderunclubbengaluru@gmail.com
• By visiting this page on our website: https://www.strideclub.in/contact-us/
• By phone number: +91 8368877289

17. Grievance Redressal

In accordance with the DPDP Act and applicable Indian law, if you have any grievance regarding the processing of your Personal Data, the exercise of your rights under this Privacy Policy, or any other aspect of our handling of your information, you may contact our Grievance Officer:

• Name: Sidharth Yadav, Founder — Stride Run Club Bengaluru
• Email: striderunclubbengaluru@gmail.com
• Phone: +91 8368877289

We will acknowledge your grievance within forty-eight (48) hours of receipt and endeavour to resolve it within fifteen (15) days. If you are not satisfied with our response, you have the right to escalate your grievance to the Data Protection Board of India in the manner prescribed under the DPDP Act.