Privacy Policy

Last updated: June 2026

1. Who we are

Tortoise Endurance is the data controller for personal information collected through this website. We provide specialist coaching, training plans, and race readiness assessments for endurance athletes.

Contact: support@tortoiseendurance.com

2. What data we collect

Account information

Your email address and name when you create an account or make a purchase.

Purchase information

Records of what you have purchased, the amount paid, and the date. Payment card details are processed directly by Stripe and are never stored by us.

Athlete details

For race readiness reports, we collect information you provide about your running history, goal races, and training background. This is used solely to prepare your report.

Training activity data

If you connect your Strava account or upload training files (Garmin FIT files), we process your activity data to provide coaching insights and plan analysis. You can disconnect Strava at any time from your account settings.

Usage data

If you consent to marketing cookies, Google Analytics collects information about pages you visit, time spent on site, and general traffic patterns. Meta Pixel collects information about actions you take (such as adding a product to your cart or completing a purchase). Microsoft Clarity records anonymised session replays and heatmaps to help us understand how visitors use the site. See our Cookie Policy for details.

3. How we use your data

PurposeLegal basisRetention
Processing your order and delivering your productContract performance7 years (legal/tax requirement)
Sending order confirmation and service emailsContract performance7 years
Managing your account and loginContract performanceUntil you delete your account
Preparing race readiness reportsContract performance2 years after report delivery
Analysing training data you uploadContract performance / Legitimate interestUntil you remove the data
Measuring site traffic and user behaviour via Google Analytics (with your consent)ConsentUntil you withdraw consent
Showing relevant ads on Meta platforms (with your consent)ConsentUntil you withdraw consent
Recording anonymised session replays and heatmaps via Microsoft Clarity (with your consent)ConsentUntil you withdraw consent
Improving our products and servicesLegitimate interestAggregated/anonymised — indefinitely

4. Third parties we share data with

Stripe Privacy policy ↗

Payment processing. Stripe handles all card data directly and is PCI DSS compliant. We share your email address and order amount with Stripe to process payments.

Supabase Privacy policy ↗

Database and authentication. Your account data and purchase records are stored on Supabase infrastructure, hosted in the EU.

Google Analytics Privacy policy ↗

Website traffic analysis, only with your consent. Google Analytics collects anonymised data about pages visited, session duration, and traffic sources. No personally identifiable information is sent to Google.

Meta (Facebook) Privacy policy ↗

Advertising and conversion tracking, only with your consent. Your email address is hashed (one-way encrypted) before being sent to Meta via their Conversions API.

Microsoft Clarity Privacy policy ↗

Session recording and heatmaps, only with your consent. Clarity records anonymised replays of user sessions and aggregated click/scroll heatmaps to help us improve the site experience. Microsoft may process this data on servers outside the UK/EEA under Standard Contractual Clauses.

Resend Privacy policy ↗

Transactional email delivery. We use Resend to send order confirmations and service notifications.

Strava Privacy policy ↗

Activity data, only if you connect your account. We read your training activities to provide coaching analysis. We do not write to your Strava account.

Vercel Privacy policy ↗

Website hosting. Your requests are processed through Vercel's infrastructure. IP addresses may be logged temporarily for security purposes.

We do not sell your personal data to any third party.

5. International transfers

Some of the third parties listed above may process data outside the UK or EEA. Where this occurs, we rely on Standard Contractual Clauses or equivalent safeguards to ensure your data is protected to UK GDPR standards.

6. Your rights

Under UK GDPR you have the right to:

  • ✓Access — Request a copy of the personal data we hold about you.
  • ✓Rectification — Ask us to correct inaccurate or incomplete data.
  • ✓Erasure — Ask us to delete your data, subject to legal retention requirements.
  • ✓Restriction — Ask us to limit how we use your data while a dispute is resolved.
  • ✓Portability — Receive your data in a structured, machine-readable format.
  • ✓Object — Object to processing based on legitimate interest, including direct marketing.
  • ✓Withdraw consent — Where processing is based on consent (e.g. marketing cookies), withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email support@tortoiseendurance.com. We will respond within 30 days.

You also have the right to lodge a complaint with the ICO (ico.org.uk), the UK supervisory authority for data protection.

7. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords, and role-based access controls. Payment data is never stored on our servers — it is handled entirely by Stripe.

8. Changes to this policy

We may update this policy from time to time. When we make significant changes we will update the date at the top of this page. Continued use of the site after changes constitutes acceptance of the updated policy.

9. Contact

For any privacy-related questions or requests, contact us at support@tortoiseendurance.com.