Privacy notice

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is: VeloWatt UG (haftungsbeschränkt) Hoher Weg 3, 26605 Aurich Germany Represented by: Niels Meereboer, Managing Director Email: support@ridevelowatt.com

For any question about your data, contact us at support@ridevelowatt.com.

2. Scope, and what we do not do

This notice covers this website (ridevelowatt.com), the account service used by the app and the account pages (api.ridevelowatt.com), the VeloWatt Pro app, riding with other people, and the training services you can link. VeloWatt Pro is intended for people aged 18 and over.

We do not:

• sell your data or share it for advertising; disclosures for payments, training services you link and shared rides are described below;
• show advertising, or use tracking on this website or in the app;
• store your heart rate on our servers (section 6);
• profile you, or combine your data with data from other sources;
• read or record what you watch while riding over a video.

3. This website

This website sets no cookies, uses no analytics and loads no content from third parties; fonts, images and videos are served from our own server. The account page at api.ridevelowatt.com sets one cookie to keep you signed in (section 4).

To deliver a page, the server processes the technical data every request carries (IP address, time, requested page, browser). It does not keep an access log. Legal basis: our legitimate interest in delivering the website (Art. 6(1)(f) GDPR).

**Contact form.** If you write to us through the contact form (https://api.ridevelowatt.com/contact), we process your email address, your message, its topic and, if you give it, your name, to answer you. The message is passed to our mailbox through Mailgun, and we answer from there; nothing is sent to the address you typed. Legal basis: where your message concerns a contract with us or entering into one, performance of the contract (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering you (Art. 6(1)(f) GDPR). The form is protected in the same way as signing in (section 4).

4. Your account

**Account data.** You sign in with your email address and a one-time code we send to it; your first sign-in creates the account. We store your email address, the name you ride under, the type of each device you are signed in on (such as "Mac" or "Windows PC") and when it was last used. We also store which version of the terms you accepted and when, your confirmation that you are 18 or older and, if you subscribe, your request that the subscription start immediately. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). You are not obliged to provide this data, but we cannot create an account without an email address.

**Staying signed in.** The app keeps a sign-in token in your system keychain, and the account page sets one cookie in your browser. Both are strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). Your settings and rides are stored on your device and leave it only as this notice describes.

**Sign-in and contact form protection.** Before the account page emails a code, and before the contact form passes on a message, Cloudflare Turnstile checks that the request comes from a person. It runs in your browser, evaluates technical signals such as your IP address and browser characteristics, and sets no cookie; we receive only the result. Legal basis: our legitimate interest in preventing sign-in codes from being sent to other people's addresses and the contact form from being used by machines (Art. 6(1)(f) GDPR); the access to your browser is strictly necessary for the sign-in or the message you requested (§ 25(2) no. 2 TDDDG).

**Limiting attempts.** To stop codes from being requested or guessed in bulk, and the contact form and the cancellation and withdrawal forms from being used in bulk, we count requests per IP address and per email address for up to one day. For sign-in codes we also pass your IP address to Supabase, which sends them, for the same purpose. Legal basis: our legitimate interest in protecting accounts and the service from abuse (Art. 6(1)(f) GDPR).

5. Trial, subscription and payment

**Trial.** So that each person uses the trial once, we keep a keyed hash of your email address (not the address itself) for up to two years. Legal basis: our legitimate interest in preventing repeated trials (Art. 6(1)(f) GDPR).

**Subscription.** We sell the subscription; Stripe handles the payment on our behalf as merchant of record, takes your payment and issues the invoice. Stripe collects your payment details and billing address directly and processes them as an independent controller under its own privacy policy (https://stripe.com/privacy); we never see your card details. We give Stripe your email address and a reference to your account, and receive from Stripe the status of your subscription and which periods are paid. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

**New prices and early ends.** When we ask you to accept a new price, we keep your answer, when and where you gave it (the account page or the app) and the words you were shown, as proof of what you agreed to. When a yearly subscription ends early with a refund, we keep what the refund was worked out from (the period, the payment and the months used) and the refund itself. Both are kept while your account exists; a refund still owed to you is paid before your account is deleted. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in being able to prove it (Art. 6(1)(f) GDPR).

**Statutory records.** Records we must keep under tax and commercial law are kept for the period the law requires (Art. 6(1)(c) GDPR), also after your account is deleted.

6. Rides, workouts, heart rate and your profile

**Rides and workouts.** Your rides and workouts are stored on your device. If you turn on backups, in the app or on the account page, we also store your finished rides (what the ride recorded, such as time, position in the virtual world, speed, power, cadence and elevation, your weight and your bike's on the day, where the power came from (the device that measured it), when the ride was paused, the version of the app, a random technical identifier, the workout ridden, and the name and notes you give it) and your workouts, so that you can restore them on another device. Backups are off by default. Turning them off stops new backups; deleting existing backups is a separate action. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

**Heart rate.** Heart rate is health data (Art. 9 GDPR). If you connect a heart-rate sensor, the app records your heart rate in your rides on your device. We do not store it on our servers: rides that are backed up or passed on are stored without it.

**Sending your heart rate to training services.** Only if you have linked a training service (section 8) and turned on "Send my heart rate", which is off by default, does the app send us the heart rate of each finished ride; we pass it straight on to the services you linked without storing it. Legal basis: your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time with the same switch in the app or on the account page; from then on, rides are sent without heart rate. Withdrawal does not affect processing before it (Art. 7(3) GDPR). We record when you gave or withdrew your consent, and under which version of this notice.

**Rider profile.** Your display name, threshold power (FTP), weight, bike and kit, and language are synchronised across your devices whether or not backups are on, because the app needs them on every device and calculates your speed from your power and weight. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Your profile is deleted with your account.

**Progress.** What your riding has earned in the app is kept with your account and synchronised across your devices whether or not backups are on, so that a lost or new device never takes it away: your experience and level, lifetime totals (distance, metres climbed, time riding and number of rides), the segments, routes and worlds you have ridden and how often each segment, badges and the day each was earned, and your best time on each segment and on each lap of the app's own routes, with the day it was set, and random identifiers that keep each of your devices' counts apart. It holds no ride itself: no position, speed, power or heart rate, and none of the routes you draw. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). It is deleted with your account; erasing your backups leaves it.

7. Riding with others

In a shared world, the riders in your room receive your display name, your rider's appearance, your position and direction in the virtual world, speed, power, distance ridden and weight, together with rider and bike characteristics used to simulate riding together and technical identifiers used to distinguish riders and deliver their updates. They do not receive your heart rate, cadence, email address or sign-in credentials. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). The positions are in the virtual world, not your physical location. Other riders see your display name, so choose one you are comfortable sharing.

Riding together runs through our own relay server in Frankfurt, over an encrypted connection. The relay keeps none of what you send once a ride ends. To protect the service from abuse, its logs keep a shortened IP address, never the full one, for 14 days. Legal basis: our legitimate interest in a service that works and cannot be misused (Art. 6(1)(f) GDPR).

8. Training services you link

Where the app offers it, you can link VeloWatt Pro to Strava and to intervals.icu, so that your rides are uploaded automatically and, with intervals.icu, so that you can add planned workouts to its calendar. Nothing is sent to a service unless you have linked it.

**Access we request.** You grant access on the service's own page. We request only what the link needs: from Strava, permission to upload and edit activities (activity:write) and to read activities, including private ones (activity:read_all), which we use to read nothing: Strava requires it before we may rename an activity we uploaded that you keep private ("Only Me"); from intervals.icu, permission to upload activities, to write to your calendar and to set your threshold power in your settings (ACTIVITY:WRITE, CALENDAR:WRITE, SETTINGS:WRITE).

**Data we send.** Rides you finish after linking, as FIT files: time, power, speed, cadence, distance, route, elevation, calories and your threshold power, and heart rate only with your consent (section 6). The name of each ride, so that renaming it in the app renames it at the service. To intervals.icu, the workouts you add to its calendar, and your threshold power, indoors and out, when you press Send; never on its own. Rides finished before you linked, and rides imported from a file, are not sent unless you ask. The positions in a ride lie on the real map a virtual world is built from; they are not where you were.

**Rides passed on without backups.** If backups are off, a ride is stored with us only so that it can be passed on, and deleted once every linked service has received it, after seven days at the latest. A short record that it was sent remains, so that the app can show it and the ride is not sent twice.

**Data we receive and keep.** Only your athlete ID at the service and, for each ride we sent, the service's ID for it and whether it arrived. We do not read your profile, your name, your other activities or your followers. From intervals.icu the app also shows the rides planned on your calendar for the coming days, with the threshold power they are planned at: we read them when the app asks and pass them straight on, keeping none of it. intervals.icu tells us when your calendar or settings change, so that the app can read them again; we keep nothing of these notices.

**Restrictions on use.** Data we receive from a service, or hold in order to send to one, is used only to provide the link you asked for. It is not sold or shared, not used for advertising, analytics or profiling, not combined with other data, and not used in any AI or machine-learning application: not to train, test or run one, and not as input to one.

**Ending a link.** You can disconnect in the app, revoke access in the service's own settings, or delete your account. We then revoke our access at the service where it allows us to, and delete the access and all data we hold from or for that service: at once when you disconnect or delete your account and, if you revoke access at the service, as soon as we learn of it. Database backups that still contain it are kept no longer than section 14 states and are used only to restore the service.

**Legal basis.** Your consent, given by linking the service (Art. 6(1)(a) GDPR, and Art. 9(2)(a) GDPR for heart rate); disconnecting withdraws it. Once a ride has arrived at a service, that service processes it as an independent controller under its own privacy policy, and deleting it from VeloWatt Pro does not delete it there. Section 13 states where the services are based.

**Strava.** Strava may collect and use data about how VeloWatt Pro uses its API, including the requests made for your Strava account, for its own business purposes and under its own privacy policy (https://www.strava.com/legal/privacy). You can see and withdraw our access to your Strava account at any time at https://www.strava.com/settings/apps.

9. Emails

We email you only about your account: sign-in codes, a change of your email address (also to the previous address), your trial, your subscription and its payments (including cancellations and withdrawals, a new price and an early end), changes to the terms, and the deletion of your account. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). We send no newsletters and no marketing emails.

10. Updates and worlds

The app checks for updates through Cloudflare. An update check carries nothing that identifies you or your account beyond the IP address every request carries. Legal basis: our legitimate interest in keeping the app up to date and secure (Art. 6(1)(f) GDPR).

Worlds are downloaded while you are signed in, so that only riders with access receive them. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). The app sends no analytics and no crash reports.

11. Processors

The following providers process data on our behalf, only on our instructions and under a data processing agreement (Art. 28 GDPR).

• Akamai Technologies (Linode), servers in Frankfurt, Germany: the website, the account service and the relay.
• Supabase, database and sign-in, in Frankfurt, Germany; it also sends the sign-in codes.
• Mailgun (Sinch), sending emails, from its EU region; it also passes contact form messages to our mailbox.
• Namecheap (Private Email): our mailbox, which holds the emails and contact form messages you send us, such as support questions, withdrawals and data requests.
• Cloudflare: storage of ride backups, downloads and database backups (R2), delivery of the app and its worlds, and the check on the account page's sign-in and the contact form (Turnstile).

12. Security

We protect the data we hold with technical and organisational measures appropriate to the risk (Art. 32 GDPR), such as encryption of every connection and of the database and stored rides, and access limited to the people who run the service. They are described at https://ridevelowatt.com/security/.

13. Transfers outside the EU

Our servers, the relay and the database are located in Frankfurt, Germany. Some of our processors, or companies in their groups, are based in the United States and may access data from there, for example for support or to keep their service running. Such transfers are based on the EU-U.S. Data Privacy Framework where the recipient is certified under it (Art. 45 GDPR), and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can ask us for a copy.

Training services: for users in the EU, Strava is provided by Strava Ireland Limited. Strava states that it stores data in the United States and protects such transfers with standard contractual clauses. intervals.icu is operated by Intervals.icu Ltd in the United Kingdom, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR), and states that it processes data in Germany and Finland. Each service describes its own transfers in its privacy policy.

14. Retention periods

• Account data: until you delete your account. The account page's sign-in cookie: 30 days.
• Counts of sign-in attempts, contact form messages, cancellations and withdrawals (IP address and email address): one day.
• Backed-up rides and workouts: until you delete them or your account.
• Heart rate: not stored. While a ride waits for its heart rate, we keep only the fact that it is waiting, for at most 24 hours.
• Rides passed on to a training service without backups: until every linked service has received them, at most seven days. The record that a ride was sent: until you delete the ride or your account.
• Data from a linked training service (your athlete ID there and the IDs of the rides sent): until the link ends.
• Trial hash: up to two years.
• Cancellations and withdrawals you send us: up to three years, as proof of receipt (Art. 6(1)(f) GDPR).
• Your answers to a new price, and the working of an early end's refund: while your account exists, and a refund owed to you until it is paid (section 5).
• Messages you send us by email or through the contact form, and our answers: up to two years after the conversation has ended. A contact form message waiting to be passed to our mailbox: at most seven days.
• Records of actions on your account (terms accepted, consents given and withdrawn, free access we gave you, cancellations reviewed): while your account exists, and up to three years after it is deleted, as proof (Art. 6(1)(c) with Art. 7(1) GDPR for consents, otherwise Art. 6(1)(f) GDPR).
• Technical records that keep the service running, such as pending tasks, notifications from Stripe and the training services about your subscription or a link, and lists of what you deleted so that your other devices delete it too: up to 400 days.
• Server logs of the account service and the relay: up to 14 days.
• Database backups: up to 30 days; monthly copies up to 12 months.
• Records required by tax and commercial law: as long as the law requires, up to ten years. Stripe keeps the invoices it issues as merchant of record; when you delete your account, we cancel your subscription and remove the reference to your account from Stripe's customer record.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21, see section 16). You can withdraw any consent at any time with effect for the future (Art. 7(3)); heart rate and linked services are switches you can turn off yourself.

You can download a copy of your data and delete your account on the Account screen in the app and on the account page (https://api.ridevelowatt.com/account); for anything else, contact us.

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the EU or EEA member state where you live, work or where the alleged infringement took place; you do not have to contact us first (Art. 77). The authority responsible for us is the Data Protection Commissioner of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, https://www.lfd.niedersachsen.de.

17. No automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Art. 22 GDPR).

18. Changes to this notice

We update this notice before our processing changes; each version carries a date. The app tells you when the notice has changed; you do not need to accept it. Where a change requires your consent, we ask for it first.