1. Who is responsible
In short Leg Up is responsible for your data, and you can write to us at any time.
The data controller is Leg Up, [FORME JURIDIQUE, CAPITAL, RCS, SIREN], with its registered office at [ADRESSE].
For any question about your data: bonjour@legup.run, or the "Leg Up" section of your account.
This policy covers legup.run and everyone who uses it: runners, brands and visitors.
2. The data we collect
In short What the service needs, plus what you choose to add.
- Account: email address, password hash (never the password itself), language, sign-up date, date and version of the terms you accepted.
- Runner profile: first and last name (public as first name + initial), date of birth (to check you are an adult, never public), city, club, bio, photo.
- Brand profile: name, sector, logo, description, links to its website and social networks.
- Optional sports profile: sex, height, build, level. You declare them only if you want to; they are never public and are only used by brands' filters.
- Postal address: private (see who sees your data).
- Races and zones: races you signed up for, distance, bib number, target time, zones rented out and their price, brand sectors you refuse.
- Campaigns: offers received, commitments, applications, waiting lists, withdrawals, campaign contracts accepted (exact text, date, language and fingerprint).
- Proofs: photos (without the device metadata, location included, except the date taken), bib number, post link.
- Payments: amounts paid, paid out and refunded, invoices and credit notes. Your bank details stay with Stripe.
- Messages and requests: campaign messages, conversations with Leg Up, notifications, attachments (for example a medical certificate for a last-minute withdrawal).
- Social networks: handles, declared follower counts, whether you accept to post and the fee you ask.
- Training: running activities from Strava or from imported files (date, distance, duration, activity name). The imported files themselves are not kept.
- Gallery: photos, captions, linked races.
- Moderation: reports made or received, warnings and decisions, with their reasons. A visitor without an account can report a profile: we only keep the reason and its comment.
- Technical data: server logs (IP address, date and time, pages requested).
Opening list and contact: before the site opens, you can join the opening list. We then keep your first name (for a brand: your name, the company, its website and your project), your email address, your city, the races you are aiming for, your language and the name of the link that brought you (for example "instagram"), without any cookie. The contact form keeps your name, your email address, the topic and your message.
3. Why, and on what legal basis
In short Mostly to run the service; your consent for the optional extras.
- Performing the contract (terms of use, brand terms of sale): creating and managing your account, checking you are an adult, showing profiles, offering campaigns to the runners who match the filters, getting tattoos to runners, receiving and approving proofs, paying out and refunding, running messages and requests, sending you the service emails.
- Legal obligation: issuing and keeping invoices, reporting the amounts runners earn to the tax authorities each year, answering requests from the authorities.
- Legitimate interest: keeping the site secure, preventing fraud (especially on proofs), moderating the platform, handling reports and answering messages sent through the contact form.
- Consent, which you can withdraw at any time: the optional sports profile (clear the fields in "My details"), training shown on your profile (hide the section), connecting Strava and importing runs (disconnect Strava or delete your runs), the opening list (leave it with the link in every email). Withdrawing does not affect what was done before.
A medical certificate attached to a request is health data. You only send it if you want to (explicit consent); only the Leg Up team sees it, to handle your request.
4. Who sees your data
In short The public sees public profiles, brands what they need, our providers what the service requires.
- Everyone: a runner's public profile (first name and initial, city, club, bio, photo, networks and followers, post fee, available zones, gallery, race history with sponsors, and training if the runner shows it), and brands' public profiles. Runner profiles are not indexed by search engines.
- Brands: for their campaigns, the committed runners, their proofs and their messages; the full name and postal address of selected runners, once the campaign is confirmed and only for home delivery. Never the sports profile, date of birth or runs: their filters use them without showing them.
- People in a campaign: your messages in its thread, if the brand lets runners write.
- The Leg Up team: what it needs to run the service, handle your requests and moderate.
- Our providers, acting on our instructions:
- website hosting, file storage and backups: OVH SAS;
- sending emails: Resend;
- payments: Stripe (Stripe Payments Europe, Limited). For payout accounts, Stripe also checks runners' identity and processes some data on its own behalf, under its own privacy policy.
- Strava, only if you connect your account: Strava sends us your runs.
- The tax authorities, for the yearly report of the amounts runners earn.
We do not sell your data and use no advertising trackers (see the cookies page).
5. Transfers outside the European Union
In short Some payment data and the emails we send may leave the European Union, with safeguards.
Stripe may transfer some data outside the European Union. These transfers are covered by the safeguards provided by Stripe ([TO BE CHECKED]). The website, its files and its backups stay in France, with OVH SAS. The site's emails go through Resend, a US company that keeps the recipient's address, the content of the emails and their delivery tracking in the United States. This transfer is covered by its certification under the EU-U.S. Data Privacy Framework and by the European Commission's standard contractual clauses.
6. How long we keep it
In short As long as your account exists, then we delete it, except what the law requires us to keep.
- Account data: as long as the account exists.
- Account never confirmed: deleted 7 days after sign-up.
- No sign-in for 3 years: we send you a warning email, then delete the account 30 days later, unless you are committed to a campaign or money is still due.
- Proof photos: deleted 12 months after the race.
- Attachments to requests sent to Leg Up: deleted 30 days after the request is closed.
- Notifications: deleted after 12 months.
- Invoices and credit notes: kept for 10 years (accounting obligation), even after the brand account is deleted.
- Strava runs: deleted when you disconnect Strava.
- Opening list: an unconfirmed sign-up is deleted after 7 days; a confirmed one is deleted 90 days after the invitation email sent at opening, and at the latest 2 years after confirmation.
- Messages sent through the contact form: deleted after 12 months.
- Backups: kept for 30 days. Deleted data therefore leaves the backups within 30 days.
- Technical logs: [DURATION] at our host.
7. Your rights
In short You can view, correct, download and erase your data, and object to some uses.
- Access and portability: "Download my data", in "My account", gives you a ZIP file with your data and your files.
- Rectification: edit your information in "My details" (runners) or in your brand profile.
- Erasure: delete your account in "My account". You can't while you are committed to an unfinished campaign or money is still due.
- Restriction and objection: you can ask us to pause a processing, or object to a processing based on our legitimate interest.
- Withdrawing consent, at any time, for what depends on it (see why, and on what legal basis).
- Instructions for after your death: you can tell us what to do with your data.
- Opening list: the "Leave the opening list" link in every email removes you from it straight away.
To exercise these rights, email bonjour@legup.run. We answer within one month, and may ask you to prove your identity if in doubt.
If you think your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
8. Security
In short Encrypted connection, passwords never stored in clear, private files kept private.
- The whole site runs over HTTPS.
- Passwords are stored as a hash, never in clear. An account is locked for 15 minutes after 5 failed sign-in attempts.
- Strava access tokens are encrypted.
- Private files are stored out of public reach and served by the site only to authorised people: a proof to its runner, the campaign's brand and the Leg Up team; an attachment to its sender and the team.
- Photo metadata, including location, is removed on upload.
9. Minors
In short Leg Up is for adults only.
You must be 18 or over to create an account. If we learn that an account belongs to a minor, we may suspend or delete it.
10. Automated decisions
In short A few automatic rules keep campaigns running, but no sanction is decided by a machine.
Some steps are automatic:
- a campaign is only offered to runners who match the filters chosen by the brand (race, zone, price, sports profile, networks, training activity);
- an application or a proof left unanswered by the brand within the set time is approved automatically;
- a campaign is confirmed or cancelled depending on the number of sign-ups on its deadline.
These rules apply how the service works, as described in the terms of use. Beyond them, Leg Up takes no decision with legal effects on you based solely on automated processing. Moderation measures are decided by a person on the Leg Up team, and you can dispute them.
11. Changes
In short If this policy changes, so does the date at the top of the page.
We may change this policy as the service or the law evolves. The date of the last update is shown at the top of the page. For significant changes: [HOW USERS ARE INFORMED TO BE DEFINED].