Run with Ali

Get my analysis

Privacy Policy

Last updated: 5 November 2026.

This Privacy Policy explains what personal data I process when you visit runwithali.com, order an analysis or get in touch with me. It explains why I process it and what your rights are. It is based on the EU General Data Protection Regulation (GDPR) and Czech data protection law.

The short version

  • I’m responsible for your data: Alexandra (Ali) Bartková, the person behind Run with Ali.
  • I use your data to provide your analysis, take payment, keep you updated about your order and meet my legal obligations.
  • I use information about your health (such as injuries and pain) only with your explicit consent.
  • Your videos are private. Only I watch them, and they’re deleted automatically 90 days after your report.
  • I don’t sell your data. I analyse your videos myself, and I don’t use your videos or answers to train AI.
  • Analytics and marketing cookies are used only if you agree.
  • You can download your data or delete your account at any time in your account settings.

Who is responsible for your data

The controller of your personal data is:

I haven’t appointed a data protection officer, because the law doesn’t require one for a business of my size. For anything about your data, contact me directly.

What data I process and why

For each situation below you’ll find what data I use, why, on what legal basis under the GDPR, and how long I keep it.

Your account

  • Data: your first and last name, email address and WhatsApp number; your password, stored only as a secure hash so that I can never see it; whether your email address and WhatsApp number are confirmed; one-time codes and sign-in links, stored as hashes and deleted after use or expiry.
  • Why: to create your account, let you sign in and contact you about your orders.
  • Legal basis: performance of our contract and steps before it (Art. 6(1)(b) GDPR).
  • How long: until you delete your account.

Your orders and payments

  • Data: what you ordered, the price, any discount code, the dates and status of your order, the payment confirmation and Stripe reference numbers. Where available, also how you found my site: campaign tags in the link (such as utm_source), a partner code, the first page you visited and the website you came from.
  • Card details: you enter them directly on Stripe’s checkout page. I never see or store your full card number. In Stripe I may see limited details, such as the card type and the last four digits.
  • Why: to process your order and payment, handle refunds and complaints, keep accounting records, prevent fraud, and see which channels bring customers (including settling partner commissions).
  • Legal basis: our contract (Art. 6(1)(b)); my legal obligation to keep accounting and tax records (Art. 6(1)(c)); my legitimate interests in preventing fraud, defending legal claims and knowing which marketing works (Art. 6(1)(f)).
  • How long: while your account exists. Accounting and tax records are kept for as long as Czech law requires, which for tax documents is usually up to 10 years. If you delete your account, your orders stay on my website only in anonymised form.

Your videos

  • Data: the four videos you upload (plus an optional extra video) and their details (file name, size and upload time). The videos show you and how you move. They may also reveal something about your health, such as an injury.
  • Why: to analyse your running technique, prepare your report and, if needed, ask you to re-film a video.
  • Legal basis: our contract (Art. 6(1)(b)). Any health information the videos reveal is covered by your explicit consent (Art. 9(2)(a)).
  • Who sees them: only me. They’re kept in private storage and opened only through short-lived secure links. They’re never published. The only exception is short edited clips, and only if you gave the separate consent (see “Educational clips” below).
  • If the upload doesn’t work: you can choose to send me the videos on WhatsApp instead. They then also pass through WhatsApp, under its own terms. I download them for your analysis, keep them like uploaded videos and delete them from the chat once your report is delivered.
  • How long: they’re deleted automatically 90 days after your report is delivered, or 90 days after an order is cancelled or refunded. If you delete your account, they’re deleted straight away.

Your questionnaire answers

  • Data: your answers, for example your age, running experience, training, goals, races, shoes and what you’d like me to focus on. This includes information about current and past injuries and pain, which is health data.
  • Why: to tailor the analysis to you and keep my advice safe.
  • Legal basis: our contract (Art. 6(1)(b)). For health data, your explicit consent (Art. 9(2)(a)).
  • How long: while your account exists.

Your report and my notes

  • Data: your PDF report, my message to you, and my notes on your order (for example why I asked for a new video, or whether the video call took place).
  • Why: to deliver the analysis, keep it available to you and answer your follow-up questions.
  • Legal basis: our contract (Art. 6(1)(b)).
  • How long: while your account exists. You can download your report at any time.

Emails and WhatsApp

  • Data: your email address and WhatsApp number, the messages we exchange, and a log of the emails the site sends you (which email, when, and whether it was delivered). The log never contains the codes or sign-in links from those emails.
  • Why: to send you messages about your order (confirmation, verification codes, reminders to upload your videos, “your report is ready”), to answer your questions, and to ask you once for a review after your report is delivered.
  • WhatsApp: you can confirm your number by sending me a WhatsApp message with a code. I send WhatsApp messages myself, for example when your report is ready. If you’d rather hear from me only by email, just tell me. WhatsApp is provided by WhatsApp Ireland Limited (part of Meta), and its own privacy policy applies to your use of WhatsApp.
  • Legal basis: our contract (Art. 6(1)(b)); for reminders and the review request, my legitimate interest in helping you finish your order and getting feedback (Art. 6(1)(f)). You can opt out of these at any time.
  • How long: while your account exists, unless I need a message for longer to deal with a complaint or a legal claim.

The video call (add-on)

  • Data: your name and email address, the time you book and what you share during the call.
  • Why: to schedule and hold the call.
  • Legal basis: our contract (Art. 6(1)(b)).
  • Tools: Google Meet or a WhatsApp video call, and a booking tool (such as Calendly or Cal.com) only if I send you a booking link. I don’t record calls.
  • How long: I delete bookings within 12 months of the call.

Reviews

  • Data: your star rating, your review and the name you choose to show with it, linked to your order.
  • Why: to show your review on runwithali.com.
  • Legal basis: your consent (Art. 6(1)(a)), which you give by ticking the box in the review form.
  • How long: until you withdraw your consent, ask me to remove the review or delete your account.

“Work with me” enquiries

  • Data: your name, email address, what you’re interested in and your message.
  • Why: to reply to you and discuss working together.
  • Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b)), and my legitimate interest in answering enquiries (Art. 6(1)(f)).
  • How long: 12 months after our last contact, unless we start working together.

Educational clips (optional)

  • Data: short clips from your videos, edited so that your face isn’t shown and your name isn’t used. I never connect a clip with your name or your health information.
  • Why: educational content about running technique on my website and social media, such as Instagram.
  • Legal basis: your consent (Art. 6(1)(a)), which you give separately when you order. It’s optional and doesn’t affect your analysis.
  • How long: until you withdraw your consent. Clips I’ve made are stored separately, so they aren’t deleted with your original videos after 90 days. If you withdraw your consent, I’ll stop using your clips in new content and remove the posts on my own channels that contain them.
  • When I post on Instagram or other social media, the platform also processes the clip under its own terms.

Marketing emails (optional)

  • Data: your name, email address and your consent.
  • Why: to send you occasional running tips and offers.
  • Legal basis: your consent (Art. 6(1)(a)).
  • How long: until you unsubscribe. You can do that at any time with the unsubscribe link in each email or by replying. After that, I keep only a note that you unsubscribed, so that I don’t email you again.

Records of your consents

  • Data: which consent you gave, the version of its text, the date and time, and a hashed (irreversibly scrambled) form of your IP address.
  • Why: to be able to prove that you gave your consent.
  • Legal basis: my legal obligation to be able to demonstrate consent (Art. 6(1)(c) together with Art. 7(1) GDPR).
  • How long: as long as I need to prove your consent, normally while your account exists.

Security and technical data

  • Data: IP address, browser and device information and the time of each request, in my hosting provider’s server logs. To limit repeated attempts (for example failed logins), a hashed form of your IP address or your account ID. If bot protection is switched on, the signals Cloudflare Turnstile uses to check that a form is filled in by a human (such as IP address and browser information).
  • Why: to keep the website and your account secure and to prevent spam, fraud and abuse.
  • Legal basis: my legitimate interest in a secure website (Art. 6(1)(f)).
  • How long: the counters for repeated attempts expire automatically within an hour. Server logs and backups are kept by my hosting provider for a limited time (usually up to 30 days).

Cookies, analytics and ads

Necessary cookies keep the site working. Google Analytics and the Meta Pixel are used only if you agree in the cookie banner, and only from that moment on.

  • Google Analytics 4 shows me how the site is used: pages visited, device and browser type, approximate location and a random ID. When you pay for an order, it also receives the order number, value and items, but never your name or email address. I keep Google Analytics data for 14 months.
  • The Meta Pixel helps me measure and improve my ads on Instagram and Facebook. Meta receives information about your visit, for example that you viewed a page or completed an order (without your name or email address). Meta may link it to your Instagram or Facebook account. For collecting this data and sending it to Meta, Meta and I are joint controllers under Meta’s Controller Addendum. Meta alone is responsible for what it does with the data afterwards (see Meta’s Privacy Policy).
  • Legal basis: your consent (Art. 6(1)(a) GDPR and § 89(3) of the Czech Electronic Communications Act). You can withdraw it at any time through “Cookie settings” in the footer.

You’ll find the full list of cookies in the Cookie Policy.

Legal claims and obligations

I may keep the data I need to establish, exercise or defend legal claims for as long as such a claim could be raised (usually until the limitation period ends). I also give data to authorities when the law requires it. Legal basis: my legitimate interest (Art. 6(1)(f)) and my legal obligations (Art. 6(1)(c)).

Your health information

Information about injuries and pain in your questionnaire, and anything your videos reveal about your health, is a special category of personal data. I process it:

  • only with your explicit consent (Art. 9(2)(a) GDPR), which you give when you order
  • only to prepare your analysis and keep my advice safe
  • only myself. It’s stored on my hosting server, I don’t share it with anyone else, and I never use it for marketing.

You can withdraw your consent at any time by emailing hello@runwithali.com. This doesn’t affect anything I did before you withdrew it. If you withdraw it before your report is delivered, I’ll delete your health information and finish the analysis without it. If that isn’t safe or possible, we’ll agree on cancelling your order with a proportionate refund.

Do you have to give me your data?

  • To order and receive the analysis, you need to give me your account details, your videos and your questionnaire answers, and consent to my use of your health information. Without them I can’t provide the analysis safely.
  • Your WhatsApp number is required when you sign up. Confirming it is optional.
  • Marketing emails, educational clips, reviews and analytics or marketing cookies are optional. Saying no has no effect on your analysis.

Where your data comes from

Mostly from you. I also receive payment information from Stripe (for example whether a payment went through) and booking details from the booking tool.

Who I share your data with

I share your data only with providers that help me run the service, and only as much as they need. Unless stated otherwise below, they process it on my behalf and on my instructions (as processors).

  • Hostinger International Ltd. (61 Lordou Vironos Street, 6023 Larnaca, Cyprus): web hosting, database, private storage of videos and reports, backups and email. Server location: European Union.
  • Stripe Payments Europe, Limited (Ireland): payment processing. Stripe is also an independent controller for some purposes, such as fraud prevention and meeting its own legal obligations. See Stripe’s Privacy Policy.
  • WEDOS Internet, a.s. (Czech Republic): domain registration and DNS only. WEDOS doesn’t receive your account or order data.
  • Cloudflare, Inc. (USA), only if switched on: storage of videos and reports (Cloudflare R2) and bot protection for forms (Turnstile). For Turnstile, Cloudflare also uses the signals as a controller to improve its bot detection. See the Turnstile Privacy Addendum.
  • Google Ireland Limited (Ireland): Google Analytics, only with your consent. See Google’s Privacy Policy.
  • Meta Platforms Ireland Limited (Ireland): Meta Pixel, only with your consent (joint controllers, see above).
  • WhatsApp Ireland Limited (Ireland): WhatsApp messages, and your videos if you choose to send them on WhatsApp.
  • Calendly LLC (USA) or Cal.com, Inc. (USA): booking the video call, only if you bought it.
  • Google Ireland Ltd. (Google Meet) or WhatsApp: the video call, only if you bought it.
  • My accountant (an external bookkeeping service): bookkeeping and tax. They receive payment and invoicing data, never your videos or questionnaire answers.
  • Authorities and courts: only when the law requires it.

Transfers outside the EU and EEA

Some providers are based in the USA (Cloudflare, Calendly, Cal.com) or belong to groups based there (Google, Meta, Stripe), so your data may be transferred to the USA. These transfers rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the standard contractual clauses approved by the European Commission. You can ask me for more information.

How long I keep your data

  • Account: until you delete it.
  • Videos: deleted automatically 90 days after your report is delivered (or 90 days after an order is cancelled or refunded).
  • Questionnaire answers, report and messages: while your account exists.
  • Payment and accounting records: as long as Czech tax and accounting law requires, usually up to 10 years for tax documents.
  • Consent records: as long as I need to prove your consent, normally while your account exists.
  • Reviews: until you ask me to remove them or delete your account.
  • Educational clips: until you withdraw your consent.
  • Marketing emails: until you unsubscribe.
  • “Work with me” enquiries: 12 months after our last contact.
  • Video call bookings: 12 months after the call.
  • Security counters: up to 1 hour. Server logs and backups: usually up to 30 days.

When you delete your account, I delete your account, videos, answers, reports, consent records, email logs, reviews and enquiries straight away. Your orders stay only in anonymised form, and the payment records the law requires stay with Stripe and my accountant. Deleted data can remain in backups until they’re overwritten.

How I protect your data

  • The site uses an encrypted connection (HTTPS).
  • Videos and reports are kept in private storage that isn’t publicly accessible, and they open only through short-lived signed links.
  • Passwords, verification codes and sign-in links are stored only as hashes.
  • Only I have access to your videos and answers. My admin account is protected with two-factor authentication.
  • My providers are bound by data processing agreements.

Your rights

You have the right to:

  • access your data and get a copy (Art. 15)
  • have inaccurate data corrected (Art. 16)
  • have your data erased (Art. 17)
  • restrict how your data is processed (Art. 18)
  • get your data in a portable format (Art. 20)
  • object to processing (Art. 21, see below)
  • withdraw any consent at any time, without affecting what happened before (Art. 7(3))
  • not be subject to decisions based solely on automated processing (Art. 22). I don’t make any such decisions.

Your right to object: you can object at any time, on grounds relating to your situation, to processing based on my legitimate interests. I’ll then stop, unless I have compelling legitimate grounds or need the data for legal claims. You can object to direct marketing at any time, and I’ll stop.

Do it yourself in your account

  • Download my data gives you a ZIP file with your account details, consents, orders, questionnaire answers and reports. Videos aren’t included, because you have the originals.
  • Delete my account deletes your account and data as described above.

For anything else, email hello@runwithali.com. I’ll reply within one month. For complex requests this can be extended by two more months, and I’ll tell you if that happens. I may ask you to confirm your identity.

Complaints

If you think I handle your data unlawfully, please tell me first so that I can put it right. You also have the right to complain to a supervisory authority, in particular in the EU country where you live, work or where the problem happened. In the Czech Republic, this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

Children

The service is for adults. If the runner is under 18, a parent or legal guardian must place the order and give the consents on the runner’s behalf.

Changes to this policy

I may update this policy. The current version is always on this page, with its date at the top. If a change affects you significantly, I’ll tell you by email.

Questions about your data? Email hello@runwithali.com. See also the Terms & Conditions and the Cookie Policy.