Privacy Policy

This Privacy Policy for Tandem Run LLC ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at tandemrun.app, which is the primary platform for delivering our Services, or any website of ours that links to this Privacy Policy
• Engage with us in other related ways, including any marketing or events.

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. By creating an account or otherwise affirmatively using our Services, you acknowledge that you have read and agree to be bound by these policies and practices. If you still have any questions or concerns, please contact us at hello@tandemrun.app.

1. What information do we collect?

Personal information you disclose to us

In Short: we collect personal information that you provide to us. Some digital information is collected automatically when you visit our Services.

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you use the Services, when you participate in activities on the Services, or otherwise when you contact us. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use.

Non-sensitive personal information we collect may include the following:

• names
• email addresses
• age
• Gender identity attestations (e.g., attestations related to eligibility for gender-specific features of the Services)
• Preferred meet-up areas (e.g., neighborhood), but not your address or geolocation
• Preferred schedules and calendar/scheduling data for meet-ups
• Self-reported running styles (e.g., pace)
• Profile photos
• Messaging for meet-up proposals.

Sensitive Personal Information we collect may include the following:

• Government-issued identification document or card
• Personal identity data via Persona, a SOC2-compliant, third-party service.

We rely on personal information that you provide to us and are entitled to trust that all of it is true, complete, and accurate. You must notify us of any changes to such personal information.

Information automatically collected

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, including:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.

This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Cookies

We use cookies on our website, including HubSpot cookies that support our marketing and help us understand site usage. We do not load non-essential cookies until you consent via our cookie banner. See Section 8 for details.

2. How do we process your information?

In Short: we process your information to provide our Services and to improve and administer our Services, communicate with you, preserve security, prevent fraud, and comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To deliver and facilitate delivery of Services. We may process your information to provide you with the requested Services.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested Services.
• To provide customer support. Any information manually exchanged with users required for identification, troubleshooting, and providing other support services, as well as automatically collected information about service usage (activity logs, service usage tracking information), is processed for the purpose of providing customer support.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time. For more information, see Section 7 ("What are your privacy rights?") below.
• To deliver targeted advertising to you. We may in the future process your information to deliver targeted advertising; if we do, we will update this policy and provide any required opt-out process. We do not share your personal information with third parties for targeted advertising purposes in a manner that constitutes a "sale" or "sharing" under applicable privacy laws.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To evaluate and improve our Services, products, marketing, and your experience. We may process your information when we believe it is necessary to identify usage trends, determine the effectiveness of our promotional campaigns, and to evaluate and improve our Services, products, marketing, and your experience.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To comply with our legal obligations. We may process your information to comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.
• We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

3. When and with whom do we share your personal information?

In Short: we may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

• Other users of the Services. We share your personal information with other users of the Services in order to coordinate meet-ups and follow-up communications, such as:
  • Scheduling: run times, dates, availability, neighborhood, first name
  • Meeting location/planned or suggested route
  • The pairing itself: who met whom and when
  • Attendance, check-ins, safety confirmation (e.g., a user shares what color shirt she's wearing)
  • Post-run feedback via survey (optional)
• Third-Party software and services. We may use third-party software and/or services ("Sub-processors") in order to collect and/or process your personal information. Such Sub-processors are bound contractually to comply with obligations at least as protective of your personal information as this Privacy Policy. We use commercially reasonable efforts to ensure the compliance of our Sub-Processors with the terms of this Privacy Policy.
• Other third parties. We may disclose personal information collected through the Services to hold and/or manage your personal information through our authorized affiliates and third party service providers, solely in connection with the Services and subject to confidentiality agreements not less stringent than our obligations under this Privacy Policy, and to satisfy any applicable law, regulation, order, legal process, subpoena or governmental request.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. In such transactions, personal information will be among the assets transferred, and the receiving entity will be subject to privacy commitments no less protective than those in this Privacy Policy.
• Will your information be shared with anyone else? We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We do not sell or share personal information belonging to website visitors, users, and other consumers.

4. How long do we keep your information?

In Short: we keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. On deletion of your account, we delete the information you submitted but retain the digital information that was automatically gathered when you used the Services. We may also retain messages in pseudo-anonymized form (using universally unique identifiers (UUIDs)), or as otherwise required for safety, legal compliance, or the protection of other users' rights. However, some data will not be deleted and will be kept in an pseudo-anonymized manner. Some metadata and statistical information concerning the use of the Services are not subject to the deletion procedures in this policy and may be retained by us. Some data may also be retained on our third-party service providers' servers until deleted in accordance with their privacy policies.

5. How do we keep your information safe?

In Short: we protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. We implement, enforce, and maintain security policies to prevent unauthorized or accidental access to, or destruction, loss, modification, use, or disclosure of personal information, and we monitor compliance with such security policies on an ongoing basis. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will use reasonable efforts to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

6. Do we collect information from minors?

In Short: we do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at hello@tandemrun.app.

7. What are your privacy rights?

In Short: you may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent, depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section 11 "How can you contact us about this policy?" below.

However, please note that this will not affect the lawfulness of the processing of personal information before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking the unsubscribe link in our emails or by contacting us using the details provided in the section 11 "How can you contact us about this policy?" below. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

If you have questions or comments about your privacy rights, you may email us at hello@tandemrun.app.

8. Controls for Do-Not-Track features

We use cookies and similar tracking technologies on our website. Specifically, we use HubSpot, which sets cookies to support our marketing and to understand how visitors use our site. When you first visit our website, you will be presented with a consent banner allowing you to accept or decline non-essential cookies. We do not load these tracking cookies until you have given consent.

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals. You can manage your cookie preferences at any time through our consent banner.

9. Your rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal information
• Right to access your personal information
• Right to correct inaccuracies in your personal information
• Right to request the deletion of your personal information
• Right to obtain a copy of the personal information you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal information if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal information, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling").

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal information being processed
• Right to obtain a list of the categories of third parties to which we have disclosed personal information
• Right to obtain a list of specific third parties to which we have disclosed personal information (as permitted by applicable law)
• Right to review, understand, question, and depending on where you live, correct how personal information has been profiled (as permitted by applicable law)
• Right to limit use and disclosure of sensitive personal information
• Right to opt out of the collection of sensitive data and personal information collected through the operation of a voice or facial recognition feature (as permitted by applicable law).

How to exercise your rights

To exercise these rights, you can contact us by emailing us at hello@tandemrun.app. Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

California Online Privacy Protection Act

Because we value your privacy, we have taken the necessary precautions to be in compliance with the California Online Privacy Protection Act. We therefore will never distribute your personal information to outside parties without your consent.

California "Shine The Light" Law

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section 11 "How can you contact us about this policy?"

10. Do we update this policy?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Policy. If we make material changes to this Privacy Policy, we will notify you by posting the updated Privacy Policy on our website. We may also, at our discretion, notify you by other means such as sending you a notification. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your information.

11. How can you contact us about this policy?

If you have questions or comments about this notice, you may contact our Data Protection Officer, Emily Lachtara, by email at hello@tandemrun.app; or by postal mail at 217 Hanover St, #130019, Boston, MA 02113, attention Legal Department.

12. How can you review, update, or delete the data we collect from you?

If you want to access, correct, amend, or delete personal information we collect from you, you should direct your query to Tandem Run LLC as the data controller. Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please contact: hello@tandemrun.app.