Privacy Policy

We use the data we collect to:

• • Provide and operate the VeloWhere Service
• • Personalize your user experience
• • Enable authentication with third-party services you choose to connect
• • Analyze usage to improve the Service
• • Validate and restore Pro membership, manage promotional access and subscription changes, and provide purchase support
• • Analyse subscription performance
• • Communicate with you about updates, features, or important notices

If you are located in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• • Your consent (when you authorize integrations or provide personalization data)
• • Performance of a contract (to provide you with the VeloWhere Service, including validating and restoring membership, managing promotional access and subscription changes, and providing purchase support)
• • Our legitimate interests (to improve the Service and ensure its security, including analysing subscription performance to understand and improve our membership offering)
• • Compliance with legal obligations (where applicable)

You can withdraw your consent at any time by disconnecting third-party services or contacting us.

We work with the following categories of processors and service providers to operate the Service:

• • Authentication providers — process account details and sign-in identifiers to authenticate users. Our account authentication service processes data in the United States. Optional sign-in providers also operate in the EEA and United States. Transfers from the EEA use the EU–US Data Privacy Framework for certified services, or standard contractual clauses, depending on the service.
• • App usage analytics providers — process device and usage data to help us understand and improve the Service. Our provider operates in the EEA and United States and processes data on global infrastructure, including in the United States. EEA-to-US transfers rely on the EU–US Data Privacy Framework; its terms provide standard contractual clauses for transfers not covered by that framework or another applicable adequacy decision.
• • Cloud hosting and storage providers — host the Service and store account data, imported activities, routes, and files. Our provider operates in the EEA and United States. Our production account databases are located in Norway and Sweden, and file storage is located in Norway. Website delivery uses a global network. Support, security and service operations can involve processing outside the EEA, including in the United States, covered by standard contractual clauses in the provider's data protection terms.
• • Subscription management providers — process account identifiers and subscription data on our behalf for membership validation and restoration, promotional access, purchase support, and subscription analytics. Our provider is based in the United States and processes this data there. Transfers from the EEA are covered by standard contractual clauses in our data processing agreement.
• • App stores — process payments and manage store subscriptions under their own terms and privacy policies. Store operators have entities in the EEA and United States and process data internationally, including in the United States. Their transfer arrangements use standard contractual clauses or the EU–US Data Privacy Framework for certified recipients, depending on the store.
• • Connected fitness data providers — services you choose to connect so we can import your activities and routes, under their direct relationship with you. These providers operate in the EEA and United States, with processing in the United States and, depending on the provider, the United Kingdom, Australia and other countries. They act as independent controllers. Their international transfer arrangements differ by connection and include standard contractual clauses; their own privacy notices describe these arrangements. Contact us for details about your connection.

Standard contractual clauses are data-protection terms approved by the European Commission. The EU–US Data Privacy Framework is an adequacy framework for participating US organisations; it does not cover every US provider. You can contact us using the form below to request the specific recipients of your data and a copy of applicable transfer safeguards.

You can delete your account at any time, from either the app or the web:

• • In the app: Account → Delete account. This removes your profile, sign-in, provider connections, imported activities, and cloud-saved data, subject to the limited retention described below.
• • On the web: use our account deletion page (for when you no longer have the app). We verify the request by replying to your sign-in email and delete within 7 days of your request.

Deletion also revokes our access to your connected fitness-provider accounts. Your activities at those providers are yours and are never touched.

Some connected fitness providers allow historical data to be downloaded only once per provider account. If you delete your VeloWhere account and later return, previously imported history from those providers cannot be imported again.

Routes and files saved only on your device are not part of the account and remain until you remove them yourself.

We also request deletion of your customer profile with our subscription management provider. If cleanup at a service provider fails, it may require follow-up to complete. Deleting your VeloWhere account does not cancel an app store subscription or erase the store's transaction records. Cancel renewal in the store where you subscribed.

Our main account and file storage is in the EEA, but authentication, subscription processing and other services involve international transfers as described above. Data processed outside the EEA may be subject to different data protection laws. The transfer arrangements above apply to those services; simply using VeloWhere is not treated as consent to an international transfer.

How long we keep data: Account, provider-connection and subscription data is kept while needed to operate your account and membership. Imported activities and routes are kept until you delete them in the app or delete your account. Account deletion removes this data as described above; app stores retain their own transaction records under their policies.

After deletion, we retain a limited record containing account identifiers, the deletion date, who requested the deletion (which may include your sign-in identifier), and which provider connections were removed. This record is used to prevent deleted account identifiers from being reused and to verify that deletion was carried out. We retain it for as long as those identifiers could otherwise be reused, which may be indefinitely. It does not contain your profile, activities, purchase history, or provider credentials.

App usage analytics events are retained by our analytics provider for a maximum of 14 months. Messages you send us are kept while needed to handle your request and for follow-up, then deleted.

You have the right to:

• • Request access to the personal data we hold about you
• • Request the identities of the recipients of your personal data
• • Request correction of inaccurate data
• • Request deletion of your data (where legally permissible)
• • Withdraw consent to data processing where applicable
• • Object to processing based on legitimate interests
• • Request portability of your data (where applicable under GDPR)

To exercise any of these rights, please contact us using the form below.

If you are located in the EEA, you also have the right to lodge a complaint with your local data protection authority.

The VeloWhere Service is intended for users who are 16 years of age or older.

If you are under the age of 16, you may only use the Service if you have obtained consent from your parent or legal guardian.

We do not knowingly collect personal data from users under the age of 16 without such consent. If we become aware that we have collected personal data from a user under the age of 16 without the necessary parental consent, we will take steps to delete the data.