Privacy Policy

Organiser enquiries and website activity

When you request an organiser demo, we use your name, email, organisation and optional notes to respond. Supabase processes the request and Resend sends it to the Suru team inbox, with a confirmation to you. Campaign source and the page action that led to the enquiry may accompany the request. This does not subscribe you to marketing. We use a hashed email value for request limits. Email correspondence remains in our email systems until deleted under our retention practices; contact sean@surusports.com to request deletion.

We count organiser page loads, product-preview actions, demo and email link clicks, and accepted demo requests by UTC date and page placement. This reporting sends no contact details, URL parameters or IP address and uses no tracking cookies or persistent visitor identifiers. Browser reporting respects Do Not Track and Global Privacy Control. Random event receipts prevent duplicate counts and are removed after seven days during subsequent collection; daily aggregate counts remain. Hosting providers may process network metadata in operational logs. Counts indicate activity, not unique people, meetings or sales.

Personal race shortlists

When you request a personal shortlist, we use your race preferences and email address to prepare and reply to that request. The request passes through Supabase and our email provider, Resend, to the Suru team inbox. This does not subscribe you to race alerts or marketing. We use a hashed email value for an hourly request limit; the request endpoint does not store a runner profile. Email correspondence remains in our email systems until deleted under our retention practices. Contact sean@surusports.com to request deletion.

Shared shortlist links contain race preferences and the sender’s notes in the link itself. Anyone with the complete link can read, copy or change those details. We do not add the request email address to these links. Keep names, contact details and sensitive information out of shared notes. Shortlist drafts are not saved when you leave the preparation page. Saved race favourites continue to use local browser storage.

Registration-link reporting

When reporting is enabled, we count clicks on official registration links by race, provider and UTC date. We send a random per-click identifier to prevent duplicate requests; it is not a persistent visitor identifier. Receipt identifiers are removed after seven days during subsequent collection. Aggregate counts may be shared with organisers. Our reporting code sends no email address, search terms or IP address and uses no tracking cookies. Hosting providers may process network metadata in operational logs. These counts measure interest, not completed registrations.

My races and race updates

Your race preferences, optional race-day age, saved categories, entered notes and preparation checklists are stored on this browser. They do not sync with the Suru app or other devices. Use Clear this browser’s race data on My races to remove them. Clearing browser data does not cancel a booking or email subscription.

If you explicitly request updates for a race and confirm your email, Supabase stores your email, race, selected category, consent and confirmation times, private management token and delivery records. Resend delivers confirmation emails and verified change or deadline notices. Each race needs separate consent. We do not share your email with organisers. A management link in your emails lets you change the email category or unsubscribe; anyone with that link can do so. Unsubscribing removes that race subscription and its delivery records. Unconfirmed requests expire after 24 hours. The hourly maintenance run removes expired requests and subscriptions seven days after the listed event end. Delivery providers may retain their operational logs.

Website race alerts

If you opt in to race alerts, we store your email, chosen location and sport, confirmation status and consent date to send matching weekly emails. Supabase stores these records and Resend processes email delivery. We do not share subscriber email addresses with race organisers. Confirm your email before receiving a digest. Unsubscribe using the link in any digest to remove your subscription, or contact sean@surusports.com. Expired unconfirmed requests are removed by the daily maintenance job. Delivery services may retain their operational logs under their own retention policies.

1. Introduction

Welcome to SURU SPORTS ("we", "our", "us"). We respect your privacy and are committed to protecting your personal data.

SURU SPORTS is a platform that helps athletes manage their entire journey in one place by:

• Registering for events
• Buying sports products
• Accessing services and advantages
• Connecting with vendors and partners

We collect data only to make sport easier, more accessible, and better value for our users.

2. Information We Collect

2.1 Information You Provide

Personal Information

• Name
• Email
• Phone number
• Address (for billing and shipping)

Account & Profile

• Login credentials
• Sport preferences
• Order and registration history

Demographic Data (if required)

• Age or date of birth
• Gender (optional)

Payment Data

We do not store full card details. Payments are processed by secure payment providers (e.g. Stripe).

2.2 Information Collected Automatically

• Device and browser data
• App usage data
• Crash and error logs
• Cookies and similar technologies

Used to improve stability and user experience.

3. Why We Use Your Information

Main goal: To help athletes access everything they need for sport in one place.

We use your data to:

• Create and manage your account
• Process event registrations
• Process product purchases
• Enable shipping and delivery
• Provide discounts and advantages
• Communicate with you
• Improve the platform
• Detect technical problems
• Comply with legal obligations

We do not sell your data.

4. Legal Basis (GDPR)

We process data based on consent and contractual necessity.

5. Sharing Your Information

5.1 With Race Organizers

If you register for an event, we may share:

• Name
• Age or category
• Gender (if required)
• Contact info

5.2 With Vendors

If you buy a product, we may share:

• Name
• Delivery address
• Contact details
• Order information

Only what is necessary to fulfil the order.

5.3 With Service Providers

Including:

• Payment processors
• Hosting providers
• Analytics & crash reporting tools

All are GDPR-compliant and act under our instructions.

6. International Transfers

If data is processed outside the EU, we apply GDPR safeguards.

7. Data Retention

We keep your data while your account is active and as long as necessary for the purposes set out in this privacy policy, unless a longer retention period is required or permitted by law.

8. Security

We use appropriate technical and organisational measures to protect your data.

9. Your Rights (GDPR)

You have the right to:

• Access your data
• Correct inaccurate data
• Delete your data
• Limit processing
• Object to processing
• Request data portability
• Withdraw consent

Contact: contact@surusports.com

10. Children

Not intended for users under 16 without parental consent.

11. Changes

We may update this policy and notify you if changes are significant.

12. Contact