Privacy Policy

Runner Geeks is committed to protecting your personal data. We built our AI-powered photo search platform with privacy by design principles. Our four core commitments:

1. Data Minimization — We only collect data that is strictly necessary to provide face photo search services.
2. No Data Selling — We never sell your personal data to third parties.
3. No Targeted Advertising — We do not use personal data for behavioral advertising.
4. Full Transparency — Every data processing activity is clearly explained in this policy.

2.1 Data You Provide

2.2 Automatically Collected

2.3 Face Recognition Pipeline Data

Runner Geeks uses a face recognition pipeline to find your photos in race event collections. Here is the processing flow:

What IS stored:

• Face data from your photo (used for search)
• Face ID reference photos (5 angles) and their embeddings, while the Face ID is active
• Face data from event collection photos (created during indexing)
• Bounding box and face landmarks (for result previews)
• Photo metadata (source URL, event, timestamp)

What is NOT stored: We never store your original photos — only numerical face templates.

• Original event collection photos — platform only stores source URLs
• One-off search photos after embedding is created (deleted from system)
• Raw biometric data — data is a numerical representation, not an image

Face ID & auto-surfacing:

Once a Face ID is saved, event pages run the search with the face data we already have on our servers. Your face photos are not re-uploaded from your browser. While a Face ID is active, this automatic search always runs on event pages.

2.4 Data from Event Organizers

Race event organizers may upload photo collections to the platform. Data received from organizers includes:

• Large volumes of event photos (thousands to millions)
• Photo metadata (timestamp, location, BIB number if available)
• Event name, date, and location

Organizers warrant that they have the legal right or permission to upload such photos.

2.5 Role Request Data

When you apply for the photographer or event organizer role, we store the following application data:

• Application reason
• Portfolio URL (portfolio_url) — for photographers
• Organization name (organization_name) and organization website (website) — for event organizers
• Terms of service acceptance (accepted_terms)
• Admin notes (admin_notes) and processing time (processed_at) after review
• Creation time (created_at)

Role request data is stored for as long as your account is active and is deleted automatically together with your account (ON DELETE CASCADE).

We process your personal data under the following legal bases pursuant to the UU PDP:

We process your personal data for the following purposes:

Primary Purposes:

• Providing face recognition-based photo search services
• Automatically surfacing the User's photos on event pages (auto-surface) based on Face ID
• Displaying Face ID stats: matches found, events scanned, and profiles waiting for processing
• User account registration and management
• Displaying relevant search results
• Sending search result notifications (email)
• Processing photo purchases, payments, fund settlement, and balance withdrawal

Supporting Purposes:

• Internal analytics to improve service quality
• Platform security and abuse prevention
• Compliance with legal obligations
• Audit logs for accountability

What we DON'T do:

• No targeted advertising
• No selling data to third parties
• No marketing profiling
• No sharing of face data between users

We retain your data only as long as necessary for the stated purposes. Retention periods are as follows:

After account deletion, all related data will be deleted or anonymized within 90 days. Exception: transaction history (orders, payments, and wallet balances) is retained to meet bookkeeping and tax requirements.

The UU PDP grants you the following rights as a data subject:

6.1 Right of Access

You have the right to know what personal data we process. Send requests to privacy@runnergeeks.id. We will respond within 3×24 hours.

6.2 Right to Rectification

You may correct inaccurate data via account settings or by contacting support@runnergeeks.id.

6.3 Right to Erasure

You may request deletion of your account and personal data via the Accounts → Privacy → Request deletion page, or email privacy@runnergeeks.id. The request is reviewed by our team before it is processed.

6.4 Right to Restriction

Under certain conditions, you may request restriction of data processing. Contact privacy@runnergeeks.id.

6.5 Right to Data Portability

You have the right to receive your personal data in a commonly used structured format. Send requests to privacy@runnergeeks.id.

6.6 Right to Withdraw Consent

You may withdraw consent at any time without affecting the lawfulness of prior processing. Do so via account settings or email privacy@runnergeeks.id.

6.7 Right to Complain

If you believe your rights have been violated, you may file a complaint with the Ministry of Communication and Digital Affairs (Kominfo) at kominfo.go.id.

We use minimal cookies for functional platform purposes:

What we DON'T use:

• No third-party tracking cookies
• No advertising cookies
• No profiling cookies

Internal tracking:

We use a self-hosted tracking system to collect anonymous page visit data. This data is stored in our own database — it is not shared with third parties. We do not use Google Analytics, Facebook Pixel, or any other third-party analytics services.

We limit international data transfers to the maximum extent possible. The following services may involve data transfers:

Local AI Processing:

All face recognition processing (detection, embedding, vector search) runs 100% on our own servers. No facial data is sent to third-party APIs for AI processing. AI models run locally with no external connection.

We share your personal data only in the following limited situations:

What IS shared:

• Email provider (SendGrid) — For notification emails. Data: email address.
• Cloudflare — For CDN and edge security. Data: anonymized IP address.
• Event organizers — Only photo metadata and search results belonging to the requesting user, upon user request.
• Third-party payment provider (e.g., Midtrans) — To process photo purchase payments. Data: order number, payment amount, payment method.
• Organizers & photographers (settlement) — For disbursing photo sale revenue. Data: photo sale summary, withdrawal destination account.

What is NOT shared:

• We never share face data with third parties.
• We never share data with advertising companies.
• We never share data with government entities unless required by law.
• We never share data between users.
• Full payment data (card number, etc.) — only handled by the payment provider, never stored by us.

We implement technical and organizational security measures to protect your personal data:

AI Model Security:

Face recognition models run on our servers with no outbound internet connection. No facial data is sent to external cloud AI services. Models are downloaded once during deployment and run fully offline.

Security Incident Procedure:

In the event of a data breach affecting personal data, we will:

1. Identify and secure the breach source within 1×24 hours
2. Notify affected data subjects within 3×24 hours
3. Report to Kominfo as required by UU PDP
4. Conduct forensic investigation and remediation

Runner Geeks services are not intended for children under 13. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 13 without parental consent, we will delete such data promptly. If you believe your child has provided us with personal data, contact privacy@runnergeeks.id.

This privacy policy may be updated from time to time. We will notify users of material changes via email or platform announcement.

Minor changes: Do not require special notice (e.g., grammar fixes, added examples).

Material changes: Requires 14 days notice before effective date.

Change History

13.1 Contact Us

If you have questions, concerns, or wish to exercise your rights, contact us:

Address: Runner Geeks, Indonesia

13.2 Complaint Procedure

1. Contact our DPO at dpo@runnergeeks.id — we will respond within 24 hours.
2. We will investigate and provide a written response within 7 business days.
3. If unsatisfied with our response, you may contact support@runnergeeks.id for escalation.
4. If still unresolved, you have the right to file a complaint with Kominfo: kominfo.go.id

13.3 Data Protection Officer

We have appointed a Data Protection Officer (DPO) who can be contacted for all privacy and personal data related inquiries:

Email: dpo@runnergeeks.id