…
Last updated: 2026-10-22
This policy explains how we process the personal data of customers, riders and shops using Runnr, under Regulation (EU) 2016/679 (GDPR). Controller: Prinno Technologies OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia (17396953). Contact: info@therunnr.com.
Account data: name, email, phone, language.
Order data: products, amounts, delivery address and drop-off point, notes for the rider, order status.
Location: for customers, the location used to show nearby shops and the delivery address (only if you allow it); for riders, their location while online and during deliveries.
Payments: card details are processed by Stripe. We only keep the Stripe customer ID and — to show your saved cards — the card brand, last 4 digits and expiry.
Shops and riders receiving payouts: bank and identity details are collected and verified by Stripe; we keep the Stripe account ID, its status and the last 4 digits of the bank account.
Technical data: access and security logs.
Providing the service and handling orders, deliveries, payments and support: performance of a contract (art. 6(1)(b) GDPR).
Tax and accounting obligations: legal obligation (art. 6(1)(c)).
Fraud prevention and platform security: legitimate interest (art. 6(1)(f)).
Marketing messages: only with your consent (art. 6(1)(a)), which you can withdraw at any time. We currently send no marketing messages.
The shop you order from and the rider delivering it — only what the order needs (name, address, phone, notes).
Providers that help us run the service, as processors: Supabase (database and authentication), Vercel (hosting), Cloudflare (network and security), Stripe (payments; an independent controller for some activities), Google (AI used only for shops' product catalogues and photos, never customer data), komoot/Photon and OpenStreetMap (address search and maps).
Public authorities when the law requires it.
Some providers are based in the United States. Those transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Account data until the account is deleted. Order and payment data for as long as tax rules require (up to 10 years). Rider location is updated in real time and we don't keep a history of routes.
You can ask for access, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interest, by writing to info@therunnr.com.
You can complain to the Italian data protection authority (www.garanteprivacy.it) or the supervisory authority of your country.
Runnr is not intended for anyone under 18.
