Privacy notice

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is: VeloWatt UG (haftungsbeschränkt) Hoher Weg 3, 26605 Aurich Germany Represented by: Niels Meereboer, Managing Director Email: support@ridevelowatt.com

For anything about your data, write to support@ridevelowatt.com.

2. What this notice covers, and what we never do

This website (ridevelowatt.com), the account service the app and the account pages talk to (api.ridevelowatt.com), the VeloWatt Pro app, riding together with other people, and the training services you can link. VeloWatt Pro is for people aged 18 and over, and is not directed at children.

Whatever else this notice says, we never:

• sell your data, or give it to anybody for their own purposes;
• show advertising, or let anybody track you on this website or in the app;
• use your rides, your heart rate or anything a linked service gives us to train machine-learning or AI models;
• build a profile of you, or combine your data with data from other sources;
• read, record or send anything about what you watch while riding over a video.

3. This website

The website sets no cookies, runs no analytics and loads nothing from other companies: fonts and images come from this server. Your browser remembers whether you chose the light or dark theme, on your device only; that is storage you asked for and that the page needs to do what you asked (§ 25(2) no. 2 TDDDG).

The server receives the technical data every web request carries (IP address, time, page, browser) in order to answer it, and keeps no access log of it. Legal basis: our legitimate interest in delivering the website you asked for (Art. 6(1)(f) GDPR).

4. Your account

To use VeloWatt Pro you sign in with your email address and a one-time code we send to it; signing in the first time makes the account. We store your address, the name you ride under, the machines you are signed in on (by kind -- "Mac", "Windows PC" -- never the computer's own name) and when each was last seen, which version of the terms you accepted and when, that you confirmed you are 18 or older, and, when you subscribed, that you asked for the subscription to start straight away. Legal basis: the contract with you (Art. 6(1)(b) GDPR). No law obliges you to give us any of this, but without an email address we cannot make you an account.

To keep you signed in, the app keeps a sign-in token in your system's keychain and the account page keeps one cookie in your browser. Both are strictly necessary for the service you asked for and used for nothing else (§ 25(2) no. 2 TDDDG). The app also keeps your settings and your rides on your machine; they are yours and are not sent anywhere unless this notice says so.

When you sign in on the account page in a browser, the page first asks Cloudflare Turnstile to check that a person is asking, before a code is emailed. Its script runs in your browser, reads technical signals from it (such as your IP address and the browser itself) and sets no cookie; we receive only whether the check passed. We do this so nobody can have sign-in codes sent to other people's addresses, and the information is used for nothing else. Legal basis: our legitimate interest in protecting the service and other people's inboxes from abuse (Art. 6(1)(f) GDPR); the access to your browser is strictly necessary for the sign-in you asked for (§ 25(2) no. 2 TDDDG). Signing in from the app does not use it.

5. Trial, subscription and payment

The trial lasts 14 days and needs no card. So that it is used once per person, we keep a keyed fingerprint of the address (not the address itself) for up to two years. Legal basis: our legitimate interest in the trial not being repeated (Art. 6(1)(f) GDPR).

Subscriptions are sold and charged by Stripe as the reseller (merchant of record). Stripe receives your payment details and billing address directly and processes them as a controller in its own right, under its own privacy notice (https://stripe.com/privacy); we never see your card. We give Stripe your email address and your account's reference so the subscription belongs to your account, and from Stripe we receive the state of your subscription and which periods are paid for. Legal basis: the contract with you (Art. 6(1)(b) GDPR).

Records we are required to keep under tax and commercial law are kept for as long as that law requires (Art. 6(1)(c) GDPR), independent of your account: deleting the account does not delete them.

6. Rides, workouts, heart rate and your profile

**Backups are off until you turn them on.** A finished ride stays on your machine. Nothing about your riding is kept on our servers unless you ask for it, in the app or on the account page. When you do, finished rides are kept so they are not lost with a machine -- time, position in the virtual world, speed, power, cadence -- and your workouts are kept the same way. Legal basis: the contract with you, which includes the backups you asked for (Art. 6(1)(b) GDPR). Turning backups off stops new ones; erasing what was kept is a separate button beside it, so that turning a switch off cannot destroy a season of riding by accident.

**Heart rate is health data** (Art. 9 GDPR), and it reaches us only with your explicit consent (Art. 9(2)(a) GDPR). When a heart-rate strap is connected, the app saves its readings in the ride on your own machine, which is yours and which we never see. Whether heart rate leaves your machine -- with a backup kept here, and from here to a training service you linked -- is its own switch, "Send my heart rate", apart from backups and off until you turn it on; the app asks when a strap connects while your rides go anywhere. Without it, a ride that leaves your machine has every heart-rate reading taken out first, and we refuse one that carries any. With it, heart rate travels with your rides wherever you have asked them to go. We record when you gave and withdrew it, under which version of this notice.

You can withdraw your consent at any time, with the same switch in the app or on the account page. From then on rides leave your machine without heart rate, and none is kept here or sent on; what happened before stays lawful (Art. 7(3) GDPR). Heart rate already kept here stays until you erase your backups or delete your account, and you can do either at any time. A ride backed up without heart rate is not sent again with it when you consent later.

Your rider profile -- the name you ride under, your threshold power (FTP), your weight, your bike and kit, and the language you read -- is synced whether or not backups are on: another machine needs it, and so does the physics that turns your power into speed. Legal basis: the contract with you (Art. 6(1)(b) GDPR). It stays when you erase your backups and goes with your account.

When you ride over a video, the app shows its panel above your other windows and registers its own few keyboard shortcuts with the system, which tells it only when one of those is pressed. It does not read your other keys, and it does not capture or record your screen or what is playing on it, and nothing about it leaves your computer.

7. Riding with others

In a shared world, the riders in your room see the name you ride under, how your rider looks, where you are, and your speed, power and weight while you ride -- because riding together is drafting and climbing beside each other. They never see your heart rate or cadence, and nothing else about your account. Legal basis: the contract with you (Art. 6(1)(b) GDPR). Choose a name you are happy for strangers to see.

The relay that carries this is ours, runs in Frankfurt, and its connection is encrypted. It keeps nothing after the ride; its logs keep a shortened network address for 14 days to protect the service from abuse. Legal basis: our legitimate interest in a service that works and cannot be misused (Art. 6(1)(f) GDPR).

8. Training services you link

You can link VeloWatt Pro to a training service, so that your rides arrive there by themselves and, where the service has a calendar, so that you can put planned workouts on it. The services that can be linked are Strava and intervals.icu, each once it is available in the app. Nothing is linked unless you link it, and nothing goes to a service until you have.

**What we ask a service for.** When you link one, you are sent to the service itself to grant VeloWatt Pro access, and we ask only for what the link needs: from Strava, permission to upload and rename activities (activity:write) and to read activities (activity:read_all), which we use only to find the activities we uploaded; from intervals.icu, permission to upload activities and to write to your calendar (ACTIVITY:WRITE, CALENDAR:WRITE).

**What we send.** Rides you finish after linking, as FIT files: time, power, speed, cadence, distance and the route, and heart rate only while you consent to it (section 6). The name you give a ride, so that renaming it here renames it there. And, to intervals.icu, the workouts you choose to put on its calendar. Rides you finished before linking are never sent, and linking again after disconnecting counts from then. A ride you imported from a file is not sent unless you ask.

**What we read and keep from a service.** Only what the link needs: your athlete number there, and for each ride we sent, the service's own number for it and whether it arrived. We do not read your profile, your name, your other activities, your followers or anything else in your account there.

**What we never do with it.** Data we receive from a service, and data we hold to send to one, is used for one purpose only: carrying out the link you asked for. It is not sold, not shared with anybody else, not used for advertising, analytics or profiling, not combined with other data, and not used to train machine-learning or AI models.

**How it is protected.** The access a service grants is stored encrypted, with a key kept apart from the database, and is never sent to the app on your computer: only our server uses it, over encrypted connections, to talk to the service.

**How a link ends.** Disconnect in the app or on the account page, withdraw VeloWatt Pro's access in the service's own settings, or delete your account. Each ends the link. We then withdraw the access at the service where it lets us, and delete the access and everything we kept from or for that service from our systems at once: straight away when the service tells us you withdrew it (Strava does), and otherwise the next time we try to reach it. Database backups that still contain it are kept no longer than section 15 says, are used for nothing but restoring the service, and a deletion is applied again to any backup we restore.

With backups off, a finished ride is sent to us only to be passed on: it is not kept as a backup, and its recording is deleted once every service you linked has it, or after seven days at the latest. A short record that it was sent stays with your account, so the app can say so and the same ride is not sent twice.

Legal basis: your consent, given by linking (Art. 6(1)(a) GDPR, and Art. 9(2)(a) for heart rate); disconnecting withdraws it. Once a ride has arrived at a service, that service handles it as a controller in its own right, under its own privacy notice, and deleting it here does not delete it there. Where a service is outside the EU, section 14 says on what basis it is sent there. The positions in a ride are points in the real place a virtual world is built on, not where you were.

9. Emails

We write to you only when something has happened to your account: a sign-in code, a failed payment, a cancellation or withdrawal and its confirmation, a trial about to end, a change to the terms, a deleted account. Legal basis: the contract with you (Art. 6(1)(b) GDPR). There is no newsletter and no marketing email.

10. Updates and worlds

The app checks for updates and downloads worlds from our servers, through Cloudflare. An update check carries nothing that names you or your account, and nothing about you beyond what every request carries (your IP address); the number the app uses to time its checks stays on your machine. Legal basis: our legitimate interest, and our duty, in keeping the app you use up to date and secure (Art. 6(1)(f) GDPR, § 327f BGB). The app sends no analytics and no crash reports.

11. Who processes data for us

Each works only on our instructions under a data processing agreement (Art. 28 GDPR). The list below is the one in use; if it changes, this notice changes with it.

• Akamai Technologies (Linode), servers in Frankfurt, Germany: the website, the account service and the relay.
• Supabase, database and sign-in in the EU (Frankfurt), which sends the sign-in codes.
• Mailgun (Sinch), sending emails from its EU region.
• Cloudflare, storage for ride backups, downloads and database backups (R2), delivery of the app and its worlds, and the check that a sign-in on the account page comes from a person (Turnstile).

12. How your data is protected

We protect what we hold with technical and organisational measures appropriate to it (Art. 32 GDPR). In particular:

• every connection to this website, the account service and the relay is encrypted;
• stored data is encrypted at rest by the providers who hold it, and the access a linked training service grants is encrypted again with a key of our own, kept apart from the database;
• sign-in is by a one-time code, so there is no password of yours for anybody to steal from us;
• the account service keeps no IP addresses in its logs, the relay keeps only a shortened one, and logs are deleted after 14 days;
• access to the servers and the database is limited to the people who run the service, with two-factor authentication on every administration account;
• the retention periods in section 15 are enforced by the software, and a deletion is applied again to any backup we restore.

13. If something goes wrong

If a breach of security affects personal data, we report it to the supervisory authority within 72 hours of learning of it where the law requires (Art. 33 GDPR), tell you without undue delay where it puts your rights at high risk (Art. 34 GDPR), and tell any training service whose data is affected as our agreement with it requires. To report a vulnerability, see https://ridevelowatt.com/security/.

14. Transfers outside the EU

Our processors keep your data in the EU where they offer it. Some of them, or companies in their groups, are based in the United States, and may reach data from there -- for support, or to keep their service running. Where that happens, the transfer rests on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework for a company certified under it (Art. 45 GDPR), and otherwise on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which are part of our agreement with each. You can ask us for a copy.

The training services you can link are based outside the EU: Strava in the United States, and intervals.icu outside the EU. Where a service is certified under the EU-U.S. Data Privacy Framework, sending your rides to it rests on that adequacy decision (Art. 45 GDPR). Otherwise there may be no adequacy decision for its country, and its protection of your data may not match the EU's; the app says so before you link, and sending rests on your explicit consent, given by linking after being told (Art. 49(1)(a) GDPR), and on its being necessary to do what you asked us to (Art. 49(1)(b) GDPR). It happens only because you linked the service (section 8).

15. How long we keep it

• Your account and everything in it: until you delete the account.
• Rides and workouts kept here: while backups are on, and until you erase them or delete the account. Turning backups off stops new ones.
• Heart rate kept in those rides: the same, and no new heart rate once you withdraw your consent.
• What a training service you linked told us (your account number there, and its number for each ride sent): until you disconnect it, here or in the service's own settings.
• A ride only passed on to a training service, with backups off: until every service you linked has it, seven days at most; the record that it was sent, until you delete the ride or the account.
• Database backups: up to 30 days, with monthly copies up to 12 months. An erasure is applied again to any copy restored from before it.
• The trial fingerprint: up to two years.
• A cancellation or withdrawal you send us: up to three years, to show it arrived.
• Server logs of the account service and the relay: up to 14 days. The relay's keep only a shortened network address.
• Records of what was done with your account (terms accepted, consents given and withdrawn, access granted by support, a cancellation reviewed): while the account exists, and for up to three years after it is deleted, to show what you agreed to.
• Work the service still has to do, such as sending an email: up to 30 days once done, 90 days if it failed.
• Records we must keep under tax and commercial law: as long as that law requires, up to ten years. Stripe, as the seller, keeps its own invoices; when you delete your account we cancel the subscription and remove the link from its customer record to your account.

16. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), to have it erased (Art. 17), to have its processing restricted (Art. 18), to receive it in a machine-readable form and have it passed to someone else (Art. 20), and to object (Art. 21, section 17). Where we rely on your consent you may withdraw it at any time, without affecting what was done before (Art. 7(3)): heart rate and the training services are switches you can turn off yourself.

A copy of your data and deleting your account are buttons on the Account screen in the app and on the account page (https://api.ridevelowatt.com/account); for anything else, write to us. The copy is one zip: your account, your plan, the services you linked, the records kept about your account, every ride and workout backed up here and every workout you put on a training calendar, as files any program can read.

Without prejudice to any other remedy, you have the right to complain to a data protection supervisory authority, in particular in the EU or EEA country where you usually live, where you work, or where you believe the infringement took place; you do not have to contact us first (Art. 77). The authority responsible for us is the Data Protection Commissioner of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, https://www.lfd.niedersachsen.de.

18. No automated decisions

We make no decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Art. 22 GDPR).

19. Changes to this notice

When what we do with your data changes, this notice changes first, under a new version date. The app tells you when it has; there is nothing to accept. Where a change needs your consent, we ask for it and do nothing until you have given it.