Privacy notice

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is: VeloWatt UG (haftungsbeschränkt) Hoher Weg 3, 26605 Aurich Germany Represented by: Niels Meereboer, Managing Director Email: support@ridevelowatt.com

For any question about your data, contact us at support@ridevelowatt.com.

2. Scope, and what we do not do

This notice covers this website (ridevelowatt.com), the account service used by the app and the account pages (api.ridevelowatt.com), the VeloWatt Pro app, riding with other people, and the training services you can link. VeloWatt Pro is intended for people aged 18 and over.

We do not:

• sell your data, or disclose it to anyone for their own purposes;
• show advertising, or use tracking on this website or in the app;
• use your data to train machine-learning or AI models;
• store your heart rate on our servers (section 6);
• profile you, or combine your data with data from other sources;
• read or record what you watch while riding over a video.

3. This website

This website sets no cookies, uses no analytics and loads no content from third parties; fonts, images and videos are served from our own server. The account page at api.ridevelowatt.com sets one cookie to keep you signed in (section 4).

To deliver a page, the server processes the technical data every request carries (IP address, time, requested page, browser). It does not keep an access log. Legal basis: our legitimate interest in delivering the website (Art. 6(1)(f) GDPR).

4. Your account

**Account data.** You sign in with your email address and a one-time code we send to it; your first sign-in creates the account. We store your email address, the name you ride under, the devices you are signed in on (by type, such as "Mac" or "Windows PC", never by device name) and when each was last used. We also store which version of the terms you accepted and when, your confirmation that you are 18 or older and, if you subscribe, your request that the subscription start immediately. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). You are not obliged to provide this data, but we cannot create an account without an email address.

**Staying signed in.** The app keeps a sign-in token in your system keychain, and the account page sets one cookie in your browser. Both are strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). Your settings and rides are stored on your device and leave it only as this notice describes.

**Sign-in protection.** Before the account page emails a code, Cloudflare Turnstile checks that the request comes from a person. It runs in your browser, evaluates technical signals such as your IP address and browser characteristics, and sets no cookie; we receive only the result. Legal basis: our legitimate interest in preventing sign-in codes from being sent to other people's addresses (Art. 6(1)(f) GDPR); the access to your browser is strictly necessary for the sign-in you requested (§ 25(2) no. 2 TDDDG). Signing in from the app does not use Turnstile.

**Limiting sign-in attempts.** To stop codes from being requested or guessed in bulk, we count requests per IP address and per email address for up to one day, and pass your IP address to Supabase, which sends the codes, for the same purpose. Legal basis: our legitimate interest in protecting accounts and the service from abuse (Art. 6(1)(f) GDPR).

5. Trial, subscription and payment

**Trial.** So that each person uses the trial once, we keep a keyed hash of your email address (not the address itself) for up to two years. Legal basis: our legitimate interest in preventing repeated trials (Art. 6(1)(f) GDPR).

**Subscription.** Subscriptions are sold by Stripe as reseller (merchant of record). Stripe collects your payment details and billing address directly and processes them as an independent controller under its own privacy policy (https://stripe.com/privacy); we never see your card details. We give Stripe your email address and a reference to your account, and receive from Stripe the status of your subscription and which periods are paid. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

**Statutory records.** Records we must keep under tax and commercial law are kept for the period the law requires (Art. 6(1)(c) GDPR), also after your account is deleted.

6. Rides, workouts, heart rate and your profile

**Rides and workouts.** Your rides and workouts are stored on your device. If you turn on backups, in the app or on the account page, we also store your finished rides (what the ride recorded, such as time, position in the virtual world, speed, power, cadence and elevation, the workout ridden, and the name and notes you give it) and your workouts, so that you can restore them on another device. Backups are off by default. Turning them off stops new backups; deleting existing backups is a separate action. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

**Heart rate.** Heart rate is health data (Art. 9 GDPR). If you connect a heart-rate sensor, the app records your heart rate in your rides on your device. We do not store your heart rate on our servers: rides that are backed up or passed on are stored without it, and a ride restored to another device has none.

**Sending your heart rate to training services.** Only if you have linked a training service (section 8) and turned on "Send my heart rate", which is off by default, does the app send the heart rate of each finished ride to us. We pass it on directly to the services you linked, without storing it. If it cannot be passed on within 24 hours, for example because your computer is offline, the ride is sent without it. Legal basis: your explicit consent (Art. 9(2)(a) GDPR). We record when you gave or withdrew your consent, and under which version of this notice.

**Withdrawing your consent.** You can withdraw your consent at any time, with the same switch in the app or on the account page. From then on, rides are sent without heart rate, including any still waiting to be sent. Withdrawal does not affect the lawfulness of processing before it (Art. 7(3) GDPR). A training service that has already received your heart rate processes it under its own privacy policy.

**Rider profile.** Your display name, threshold power (FTP), weight, bike and kit, and language are synchronised across your devices whether or not backups are on, because the app needs them on every device and calculates your speed from your power and weight. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Your profile is deleted with your account.

7. Riding with others

In a shared world, the riders in your room receive your display name, your rider's appearance, your position, and your speed, power and weight while you ride. They do not receive your heart rate, your cadence or any other account data. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Other riders see your display name, so choose one you are comfortable sharing.

Riding together runs through our own relay server in Frankfurt, over an encrypted connection. The relay keeps none of what you send once a ride ends. To protect the service from abuse, its logs keep a shortened network address (the first three blocks of an IP address) for 14 days. Legal basis: our legitimate interest in a service that works and cannot be misused (Art. 6(1)(f) GDPR).

8. Training services you link

Where the app offers it, you can link VeloWatt Pro to Strava and to intervals.icu, so that your rides are uploaded automatically and, with intervals.icu, so that you can add planned workouts to its calendar. Nothing is sent to a service unless you have linked it.

**Access we request.** You grant access on the service's own page. We request only what the link needs: from Strava, permission to upload and edit activities (activity:write) and to read activities, including private ones (activity:read_all), which we use to read nothing: Strava requires it before we may rename an activity we uploaded that you keep private ("Only Me"); from intervals.icu, permission to upload activities and to write to your calendar (ACTIVITY:WRITE, CALENDAR:WRITE).

**Data we send.** Rides you finish after linking, as FIT files: time, power, speed, cadence, distance, route, elevation, calories and your threshold power, and heart rate only with your consent (section 6). The name of each ride, so that renaming it in the app renames it at the service. To intervals.icu, the workouts you add to its calendar. Rides finished before you linked, and rides imported from a file, are not sent unless you ask. The positions in a ride lie on the real map a virtual world is built from; they are not where you were.

**Rides passed on without backups.** If backups are off, a ride is stored with us only so that it can be passed on, and deleted once every linked service has received it, after seven days at the latest. A short record that it was sent remains, so that the app can show it and the ride is not sent twice.

**Data we receive and keep.** Only your athlete ID at the service and, for each ride we sent, the service's ID for it and whether it arrived. We do not read your profile, your name, your other activities or your followers.

**Restrictions on use.** Data we receive from a service, or hold in order to send to one, is used only to provide the link you asked for. It is not sold or shared, not used for advertising, analytics or profiling, not combined with other data, and not used to train machine-learning or AI models.

**Security.** The access a service grants is stored encrypted, with a key kept separate from the database. It is never sent to the app; only our server uses it, over encrypted connections.

**Ending a link.** You can disconnect in the app or on the account page, revoke access in the service's own settings, or delete your account. We then revoke our access at the service where it allows us to, and delete the access and all data we hold from or for that service: at once when you disconnect or delete your account and, if you revoke access at the service, as soon as we learn of it (Strava tells us straight away; otherwise we learn of it the next time we try to reach the service). Database backups that still contain it are kept no longer than section 15 states and are used only to restore the service.

**Legal basis.** Your consent, given by linking the service (Art. 6(1)(a) GDPR, and Art. 9(2)(a) GDPR for heart rate); disconnecting withdraws it. Once a ride has arrived at a service, that service processes it as an independent controller under its own privacy policy, and deleting it from VeloWatt Pro does not delete it there. Section 14 states where the services are based.

9. Emails

We email you only about your account: sign-in codes, a change of your email address (also to the previous address), payment problems and the end of access, the end of a trial or subscription, acknowledgements and confirmations of cancellations and withdrawals, changes to the terms, and the deletion of your account. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). We send no newsletters and no marketing emails.

10. Updates and worlds

The app checks for updates through Cloudflare. An update check carries nothing that identifies you or your account beyond the IP address every request carries. Legal basis: our legitimate interest in keeping the app up to date and secure (Art. 6(1)(f) GDPR).

Worlds are downloaded while you are signed in, so that only riders with access receive them. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). The app sends no analytics and no crash reports.

11. Processors

The following providers process data on our behalf, only on our instructions and under a data processing agreement (Art. 28 GDPR). If this list changes, we update this notice.

• Akamai Technologies (Linode), servers in Frankfurt, Germany: the website, the account service and the relay.
• Supabase, database and sign-in, in Frankfurt, Germany; it also sends the sign-in codes.
• Mailgun (Sinch), sending emails, from its EU region.
• Cloudflare: storage of ride backups, downloads and database backups (R2), delivery of the app and its worlds, and the sign-in check on the account page (Turnstile).

12. Security

We protect the data we hold with technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:

• encryption of every connection to this website, the account service and the relay;
• encryption at rest by the providers who store the data, and additional encryption, with a key of our own kept separate from the database, of the access a linked training service grants;
• sign-in by one-time code, so there is no password of yours that could be stolen from us;
• no IP addresses in the account service's logs, only a shortened one in the relay's, and deletion of all logs after 14 days;
• access to servers and the database limited to the people who run the service, with two-factor authentication on every administrative account;
• retention periods (section 15) enforced by the software, and deletions applied again to any backup we restore.

13. Data breaches

If a security breach affects personal data, we notify the supervisory authority within 72 hours of becoming aware of it where the law requires (Art. 33 GDPR), inform you without undue delay where it is likely to result in a high risk to your rights (Art. 34 GDPR), and inform any training service whose data is affected. To report a vulnerability, see https://ridevelowatt.com/security/.

14. Transfers outside the EU

Our servers, the relay and the database are located in Frankfurt, Germany. Some of our processors, or companies in their groups, are based in the United States and may access data from there, for example for support or to keep their service running. Such transfers are based on the EU-U.S. Data Privacy Framework where the recipient is certified under it (Art. 45 GDPR), and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can ask us for a copy.

Training services: for users in the EU, Strava is provided by Strava Ireland Limited. Strava states that it stores data in the United States and protects such transfers with standard contractual clauses. intervals.icu is operated by Intervals.icu Ltd in the United Kingdom, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR), and states that it processes data in Germany and Finland. Each service describes its own transfers in its privacy policy.

15. Retention periods

• Account data: until you delete your account. The account page's sign-in cookie: 30 days.
• Sign-in attempt counts (IP address and email address): one day.
• Backed-up rides and workouts: until you delete them or your account. Lists of what you deleted or erased, so that your other devices delete it too and an erasure is applied again to a restored backup: 400 days.
• Heart rate: not stored. While a ride waits for its heart rate, we keep only the fact that it is waiting, for at most 24 hours.
• Rides passed on to a training service without backups: until every linked service has received them, at most seven days. The record that a ride was sent: until you delete the ride or your account.
• Data from a linked training service (your athlete ID there and the IDs of the rides sent): until the link ends.
• Trial hash: up to two years.
• Cancellations and withdrawals you send us: up to three years, as proof of receipt (Art. 6(1)(f) GDPR).
• Records of actions on your account (terms accepted, consents given and withdrawn, free access we gave you, cancellations reviewed): while your account exists, and up to three years after it is deleted, as proof (Art. 6(1)(c) with Art. 7(1) GDPR for consents, otherwise Art. 6(1)(f) GDPR).
• Notifications from Stripe and the training services about your subscription or a link: 30 days.
• Pending tasks of the service, such as sending an email or confirming a saved workout: up to 30 days after completion, 90 days if they fail.
• Server logs of the account service and the relay: up to 14 days.
• Database backups: up to 30 days; monthly copies up to 12 months.
• Records required by tax and commercial law: as long as the law requires, up to ten years. Stripe, as the seller, keeps its own invoices; when you delete your account, we cancel your subscription and remove the reference to your account from Stripe's customer record.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21, see section 17). You can withdraw any consent at any time with effect for the future (Art. 7(3)); heart rate and linked services are switches you can turn off yourself.

You can download a copy of your data and delete your account on the Account screen in the app and on the account page (https://api.ridevelowatt.com/account); for anything else, contact us. The copy is a single zip file containing your account, your subscription, your linked services, the records kept about your account, every ride and workout backed up with us, and every workout you added to a training calendar, in common file formats.

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the EU or EEA member state where you live, work or where the alleged infringement took place; you do not have to contact us first (Art. 77). The authority responsible for us is the Data Protection Commissioner of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, https://www.lfd.niedersachsen.de.

18. No automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Art. 22 GDPR).

19. Changes to this notice

We update this notice before our processing changes; each version carries a date. The app tells you when the notice has changed; you do not need to accept it. Where a change requires your consent, we ask for it first.