Privacy Policy

longrunshoes.ai (“we”, “us”, “our”) is an AI-powered running shoe recommendation service accessible at longrunshoes.ai. We are the data controller for the personal data you provide when using this service.

This policy applies to users in the European Union (EU GDPR 2016/679) and the United Kingdom (UK GDPR as retained in UK law). Where both apply, references to “GDPR” cover both regimes.

For any questions about this Privacy Policy or to exercise your rights, contact us via our contact form.

We collect the following categories of personal data:

• Account data: First name, last name, email address — provided when you register or update your profile.
• Authentication data: A one-time verification code sent to your email, and a session token stored in your browser after successful login. We do not use passwords.
• Behavioural preferences: Running shoes and articles you mark as favourites, synced to our servers and tied to your account.
• AI assistant prompts and profile: Free-text prompts you enter in the AI assistant, together with the generated preference profile (pace, cushioning, rebound, stability, brand, drop) and a textual summary. This constitutes automated profiling of your running preferences — see §12 for details.
• Contact messages: Topic and text of messages sent via the “Write Us” form. This form does not require login — messages may be anonymous if you are not signed in.
• IP address and server logs: Your IP address is recorded in server logs on every request to api.longrunshoes.ai and in AWS access logs for the CloudFront image CDN. These logs may also include request timestamps, HTTP method, and User-Agent string.
• Browser-only usage data: The last page you visited before navigating to your profile, and shoe comparison selections — stored only in your browser (sessionStorage) and never sent to our servers.
• Analytics data: If you consent: page views, session duration, clicks, and device/browser type — collected by Google Analytics and Microsoft Clarity.

We process your data on the following legal bases (GDPR Art. 6):

Authentication on longrunshoes.ai is passwordless. When you register or log in, we send a one-time verification code to your email address via smtp.gmail.com (Google SMTP service).

These emails contain only the verification code. We do not send marketing emails. Google processes the email in transit as a data processor under its GDPR-compliant terms. Sent messages are not stored by us beyond what is needed to complete authentication.

We use two analytics tools, activated only with your consent (see §3):

Both tools are currently disabled and will be activated only after you have given consent via the cookie banner.

The following actions are processed locally in your browser and never sent to our servers:

• Shoe comparison: Shoes added to Compare are stored in sessionStorage only. No comparison data is transmitted to the backend.
• Filter preferences: Article and brand filter selections (articles-filters-local-storage, brands-filters-local-storage) are stored locally to remember your preferences between visits and are never sent to our servers.
• Navigation history: The last non-profile page you visited is stored in sessionStorage and cleared when you close the tab.

We retain your data only as long as necessary:

• Account & profile data: Until you request account deletion, then removed within 30 days.
• AI assistant results: Until you delete them from your profile, or upon account deletion.
• Favourites: Until you remove them or delete your account.
• Contact messages: Up to 12 months from receipt, then permanently deleted.
• Server logs (IP, User-Agent, timestamps): 90 days, then automatically purged.
• Authentication token: Stored in browser localStorage until you log out or clear browser data. No server-side session is kept.
• Google Analytics data: 14 months (GA4 default).
• Microsoft Clarity data: 30 days (Clarity default).
• Inactive accounts: Accounts with no login activity for 2 years will receive an email notice. If no response is received within 30 days, the account and all associated data will be permanently deleted.

We use browser storage to operate the service. The table below lists everything we store, organised by whether it requires consent.

Essential (no consent required)

Analytics (requires consent)

Analytics cookies are only set after you click “I agree” in the cookie banner.

We work with the following third-party processors. Where data leaves the UK/EU, transfers are covered by Standard Contractual Clauses (SCCs) under GDPR Art. 46.

We do not sell your personal data to any third party.

Under EU GDPR (2016/679) and UK GDPR you have the following rights. To exercise any of them, contact us via our contact form with subject GDPR Request: [type] and include the email address linked to your account. We will respond within 30 days. For complex or multiple requests we may extend this by a further 2 months (Art. 12(3)) and will notify you within the initial 30 days if an extension is needed.

You also have the right to lodge a complaint with your local supervisory authority — in the EU at edpb.europa.eu, in the UK at ico.org.uk.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, as required by GDPR Art. 33.

If the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay (GDPR Art. 34) using the email address linked to your account.

The AI assistant accepts free-text prompts describing your running needs. Your prompt is sent to our backend, processed by an AI model, and the result is saved to your account.

What is stored: the original prompt, a generated preference profile (pace, cushioning, rebound, stability, preferred brand, heel-to-toe drop), a textual summary, a timestamp, and the number of matching shoes returned.

Profiling disclosure (Art. 13(2)(f)): the AI assistant performs automated profiling of your running characteristics. This profiling is used solely to rank shoe recommendations and does not produce any legal or similarly significant effects. You are not subject to any automated decision-making under Art. 22(1).

Service improvement: anonymised prompts (stripped of any account linkage) may be reviewed internally to improve recommendation quality. The legal basis is legitimate interests (Art. 6(1)(f)).

Important: do not include sensitive personal data (medical conditions, injuries, health history) beyond what is directly relevant to shoe selection.

You can delete individual AI results at any time from your profile page.

All data is transmitted over HTTPS. Authentication is passwordless — we send a one-time verification code by email instead of storing passwords. Session tokens are stored in browser localStorage and are not transmitted as cookies.

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or disclosure.

This service is not directed at children under 16. We do not knowingly collect data from minors. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. For material changes we will notify registered users by email or via an in-app notice before the change takes effect.