Privacy policy
Last updated 11 November 2026.
1. Controller
Tomáš Knespl, trading as progrunners, Pardubice, Czech Republic, company ID (IČO) 14398150, info@progrunners.com.
2. What we keep and why
- Customers: e-mail, name if you give it at checkout, plan, zones, battery size, API key, the number of API requests per day and the time of the last request, payment records from Stripe (amount, date, Stripe customer and subscription IDs). We never see your card details. Sign-in links and sessions are stored only as one-way hashes. Purpose: providing the service (contract, Art. 6(1)(b) GDPR) and accounting (legal obligation, Art. 6(1)(c)).
- Partners: the application (name, company, e-mail, country, website, how you will recommend us), clicks per partner code per day (no personal data), customers and commission. Purpose: running the partner programme (contract).
- Requests sent through our forms: name, e-mail, zone, battery size and your message. Purpose: replying (pre-contract steps).
- Security: for rate limits we keep a salted hash of your IP address in memory only; the salt changes every day. Purpose: protecting the service (legitimate interest, Art. 6(1)(f)).
3. Cookies and similar storage
| Name | Purpose | Duration |
|---|---|---|
| pr_cs | your customer session (HttpOnly, only sent to our API) | 30 days |
| pr_cu | says “signed in” so a zone page loads your full forecast; contains only “1” | 30 days |
| pr_ps | partner session (HttpOnly) | 14 days |
| pr_ccsrf, pr_csrf | security token against forged requests | 2 hours |
| pr_ref | the partner code from a partner link, so the partner gets the commission | 90 days |
These are first-party cookies needed for the service or for the partner programme you came through; we use no advertising cookies.
4. Measurement
Our own measuring script (/mereni/m.js, on our server) records page views and a few named events — calculator used,
plan opened, checkout button clicked, partner application sent, sign-in — with the page address, referrer, screen size, language, scroll depth, time on page
and campaign (UTM) parameters. It sets no cookie; it keeps a random session ID in your browser’s session storage until you close the tab. We do not store your
IP address: we keep a one-way hash of the IP address and browser, and the approximate location and network derived from the IP address with the ip-api.com
service. Events never contain your e-mail, name or API key. Purpose: improving the website (legitimate interest).
5. Who else processes data
- Stripe (Stripe Payments Europe, Ltd., Ireland) handles payments, invoices and, once available, the billing portal. What you enter on Stripe’s checkout is also covered by Stripe’s privacy policy.
- Zoho delivers our e-mails (Zoho Mail, EU data centre).
- Google Fonts: pages load fonts from Google, which receives your IP address.
- Server hosting: Hetzner Online GmbH, data centre in Falkenstein, Germany (EU).
Some of these providers may transfer data outside the EU under the safeguards required by the GDPR.
6. How long
- Account data: while your plan is active and 12 months after it ends.
- Payment and invoice records: as long as tax and accounting law requires.
- Form requests: up to 24 months after our last contact.
- Measurement data: 14 months.
7. Your rights
You can ask for access, correction, deletion, restriction, a copy of your data (portability), and object to processing based on legitimate interest — write to info@progrunners.com. You can also complain to the Czech Office for Personal Data Protection (uoou.gov.cz).