Important. These materials describe how The Long Run Group (“TLR”) presents its website and related services, based on the current implementation in this project. They are not legal advice and are not represented as final or binding until a verified contracting party, applicable law, and counsel review are completed. Where a statement depends on corporate registration, hosting region, or contractual arrangements TLR has not published, the text explains the limitation instead of assuming facts.
This Privacy Policy explains how The Long Run Group (“TLR,” “we,” “us”) may collect, use, disclose, and protect personal information when you visit thelongrun.group, submit forms, sign in for early access, or otherwise interact with this public website. Processing under Runner production workspaces or customer agreements may be described separately in those agreements and in the Data Processing Agreement.
1. Scope and who this policy applies to
This policy applies to personal data TLR processes as controller in connection with the marketing and informational site in this repository: static HTML, CSS, and JavaScript pages, TLR-specific bundles for login and forms, and backend services they call. It covers visitors, form submitters, newsletter signups, sales inquiries, and users of early-access login. It does not replace contractual privacy terms for Runner customers processing their own end users’ data. If you interact with TLR only as an employee or contact of a customer organization, your organization’s policies may also apply.
Related documents: Cookie Policy, Terms of Service, Subprocessors, Security Overview, AI Transparency & Limitations.
2. Controller and contacts
Controller identity not yet published. The operator reports that the TLR brand is not registered as a legal entity for publication. TLR uses the public brand “The Long Run Group.” Privacy enquiries: contact@thelongrun.group, company contact, or request demo / sales. Monitoring of these channels must be confirmed operationally. A data protection officer or EU/UK representative, if required, will be listed here once confirmed.
3. How the public site is built (technical context)
The site is primarily static HTML, CSS, and JavaScript with TLR-specific bundles for login and forms. Form and login flows call a Supabase project using a publishable (anon) key in client configuration—not a service-role key. Repository documentation and Supabase project configuration describe verified RPC surfaces. This technical description helps you understand processing; it is not a commitment that every deployment matches every detail until production is verified.
4. Personal data we may collect
The categories below reflect forms and flows verified in this repository. TLR must confirm lawful bases, notices shown at collection, and any additional collection (logs, product telemetry, advertising) before publication.
| Source | Typical fields | Storage / processing (repo-verified) | Lawful basis |
|---|---|---|---|
Contact and company contact (wf-form-Contact-Form) | Name, email, phone, message; terms checkbox where shown | RPC submit_site_form with type contact → table site_form_submissions (JSON payload). Optional async email via Edge Function notify-site-form (internal alert + submitter confirmation) when those integrations are deployed. | |
Demo form (wf-form-Demo-Form) | First/last name, email, phone, company, role, job level, interest, message | Same RPC with type demo; email notifications when configured (best-effort). | |
Sales inquiry (wf-form-Sales-Inquiry-Form) | Fields defined in the sales form and validated client-side | RPC type sales → site_form_submissions . | |
Footer subscribe (wf-form-Footer-Subscribe-Form) | RPC type newsletter when configured; whether stored emails are used for marketing must be confirmed operationally before any marketing send. | To be documented before final publication | |
| Login / early access | Email for magic link; session identifiers | Supabase Auth; after sign-in, RPC complete_early_access_signup may insert email into early_access_signups. | |
| Hosting, CDN, and server logs | IP address, user agent, request metadata | the hosting or CDN provider used for production deployment and its log practices. No third-party analytics script was verified in a repository review of primary pages at drafting time; production may differ after deployment. |
5. How form submissions are handled
- The browser validates required fields (see
scripts/lib/site-form-payload.mjs). - The client calls
submit_site_form; honeypot submissions may return success without database insert. - Valid rows are inserted into
site_form_submissions; duplicate email per form type within two minutes may be rejected server-side. - For
contactanddemotypes, email to staff and submitter is asynchronous and best-effort via Resend when the Edge Function is deployed; failures are logged and do not roll back the database insert. - Newsletter submissions are stored; the notification function does not send marketing email for that type per repository documentation.
Field-level validation may apply server-side in migrations. User-facing notices must match actual processing once verified .
6. Purposes of processing
- Respond to contact, demo, and sales inquiries.
- Operate newsletter or similar communications if TLR uses stored emails for that purpose and consent or lawful basis is documented .
- Authenticate users requesting early access and record signup interest.
- Secure and operate the site (abuse prevention, rate limiting, troubleshooting).
- Comply with law and enforce terms.
7. Legal bases (UK GDPR / EU GDPR)
Where UK GDPR or EU GDPR applies, TLR must document a lawful basis for each purpose above—for example consent, contract, legitimate interests, or legal obligation . Marketing email requires appropriate consent or soft opt-in where applicable . You may withdraw consent where processing is consent-based without affecting lawfulness before withdrawal.
8. Sharing and recipients
TLR does not sell personal data. We may share data with service providers that process data on our instructions (processors), professional advisers, authorities when required by law, and parties in a corporate transaction subject to appropriate safeguards . Infrastructure providers referenced in repository documentation (for example Supabase for database and authentication, Resend for transactional email when configured) must be confirmed on the Subprocessors page before being treated as published subprocessors.
9. International transfers
Personal data may be processed in countries other than your own depending on hosting, Supabase project region, and email provider locations . TLR will implement appropriate safeguards as required by applicable law once verified.
10. Retention
TLR retains personal data only as long as necessary for the purposes described or as required by law . When retention periods expire, TLR will delete or anonymize data according to operational procedures .
11. Security
TLR implements technical and organizational measures appropriate to the risk, including patterns described in the Security Overview (RPC-only writes, row-level security, webhook secrets for Edge Functions). No security measure is perfect; see the Security Overview for limitations and reporting channels.
12. Your rights
Depending on your location, you may have rights to access, rectify, erase, restrict, object to, or port personal data, and to lodge a complaint with a supervisory authority where applicable. TLR has not published a fixed statutory response time on this site.
How to submit a privacy request
Email contact@thelongrun.group with the subject line Privacy request and include:
- Your name and the email address used with TLR (or on a form submission)
- The type of request (access, correction, deletion, restriction, objection, or other)
- Enough context to locate your data (approximate date, form type, or early-access login email)
- Proof of identity proportionate to the request (TLR may ask for additional verification)
There is no automated self-service privacy portal in the current product. Account self-service deletion is not implemented; deletion requests are handled manually after verification, subject to legal retention obligations and technical limits (including backups and provider-side copies).
13. Account and session data
Magic-link login uses Supabase Auth. Session tokens may persist in browser storage or cookies per Supabase defaults . Early access signup may call complete_early_access_signup to store email in early_access_signups, separate from marketing form rows in site_form_submissions. Auth email templates and SMTP configuration are independent of marketing form notifications when those integrations are deployed.
14. Cookies and similar technologies
See the Cookie Policy. A complete cookie inventory requires a technical audit of production hosting and third-party embeds before publication.
15. Children
The Site is not directed at children below the age required to enter a binding contract in the user’s jurisdiction. TLR does not knowingly collect personal data from children without appropriate consent where required. Contact contact@thelongrun.group if you believe a child has provided data.
16. Automated decision-making
TLR does not describe automated decision-making with legal or similarly significant effects on the public marketing site . AI-assisted features in Runner are subject to the AI Transparency page and customer agreements.
17. Changes to this policy
TLR may update this Privacy Policy by posting a revised version with a new effective date. Material changes will be communicated as appropriate .
18. Contact
Privacy: contact@thelongrun.group · Forms: company contact · request demo