DRAFT PENDING LEGAL REVIEW
This text is provisional: a lawyer hasn't reviewed it yet and it may change before launch.
Privacy policy
Version privacy-2026-11
What data we process, why, for how long and how to exercise your rights.
Controller
Miquel Gomis Pazos (Runpic), hola@runpic.es. For an event's runner list and photos, the controller is the event organiser and we process that data on their behalf.
What data we process
Runners: bib number, name and email if the organiser provides them, the photos you appear in and, only if the event turns it on, your face to find them. Buyers: email, order and payment (payment is handled by Stripe). Organisers and photographers: account details, uploaded photos and payout details.
Face recognition
It's off by default. It's only used in events whose organiser declares that runners consented when they signed up, always with the alternative of searching by bib number. Search selfies aren't stored. Face data is deleted when sales end.
Why
To find your photos and tell you they're ready, to sell and deliver them, to split the revenue and to meet our legal and tax obligations.
For how long
Unsold photos and faces: until sales end. Purchased photos: until the download period ends. Orders and money movements: as long as tax law requires.
Who with
Vercel (hosting), Supabase (database, in the EU), Stripe (payments), Resend (emails) and the provider of the vision model that reads bib numbers. All under data processing agreements.
Your rights
You can request access, rectification, erasure, objection, restriction and portability using the privacy form on the website. We reply within a month. You can also complain to the Spanish Data Protection Agency (aepd.es).