Velopit

Privacy Policy

Velopit - Michael Kufner

Language of this document. This English version is provided for your convenience. The German version at velopit.app/datenschutz is the legally binding one; where the two differ, the German text prevails.

Privacy at a glance

Velopit processes personal data to operate the website and the apps and to provide the features you use. This includes in particular account and bicycle record data, technical connection data and, where you choose to use them, data for AI, Strava, payments, notifications, workshop features, public shares, public partner profiles and the referral programme.

The controller is Michael Kufner. Depending on the feature, technical, payment, communication and integration service providers, selected workshops, holders of a link and, for indexed shares and partner profiles, search engines and the public receive data. Details are in Account and bicycle record, AI features, Payments and messages, Strava and Workshop, shares and partner profiles.

You can generally deactivate or not use optional features. Public shares are accessible to anyone who holds the link, without signing in; AI features transmit your input and the automatically compiled context described below to Gemini. Your data protection rights and contact options are in section 12.

1. Controller and data protection contact

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection law is:

Michael Kufner
Schwaigerstraße 8
82362 Weilheim in Oberbayern
Germany
E-mail: michael.kufner@velopit.app
Telephone: +49 176 6081 2091

You can also reach us at this e-mail address for data protection enquiries and to exercise your rights.

2. Scope, data sources and provision

This policy applies to the public pages at velopit.app, the web app and progressive web app, the Android app, the iOS app, workshop features, public shares and public partner profiles. We receive data from you, your browser or device and, when you connect or use a corresponding feature, from Google Sign-In, Sign in with Apple, Stripe, the Apple App Store for purchases in the iOS app, Strava or a workshop. In addition, status and usage information derived from your use arises. You obtain the apps through Google Play or the Apple App Store; Google and Apple process installation and account data in their own responsibility under their privacy policies. Purchases in the iOS app are described in section 5.2.

Technical connection data is required to deliver and secure the service. For an account we need at least contact, sign-in and profile details. Bicycle, component and service data are only required to the extent you want to use the respective management features. AI, Strava, push, optional e-mails, workshop check-ins, uploads, public shares and partner profiles are optional additional features. Without the information required in each case, we can only not provide, or not fully provide, the feature concerned.

3. Technical operation, account and bicycle record

3.1 Technical operation

When you access the website, app and interfaces, we process connection and log data such as IP address, time, requested resource, browser, device and language information, and response, error and security data. For signed-in operations, an account identifier may be added. This serves delivery, availability, troubleshooting and the prevention of misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are secure and reliable operation and the investigation of faults and attacks.

For technical operation we use Google Cloud and Firebase as service providers. Application and request logs are generally stored for 30 days. Certain required Google audit logs may be stored for up to 400 days. Extracts secured in the event of a security incident remain stored, with restricted access, until the incident is resolved and the relevant limitation period has expired.

On our marketing pages we count page views, clicks on buttons and scroll depth without cookies and without an identifier. These events contain neither IP address nor device identifier and are stored as an application log for 30 days.

When fonts that are currently provided externally are retrieved, Google receives connection data. The purpose is a consistent display. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a consistent and efficient provision of the user interface.

The Android and iOS apps check on start and when returning to the foreground whether an updated version of the app interface is available. The app transmits platform, operating system and app version details, the version of the update module and a randomly generated installation identifier to our server; update packages are loaded from our Google Cloud infrastructure. We do not store the installation identifier and only log platform, reported version and the decision whether an update was offered. The legal basis is Article 6(1)(b) GDPR; securing the distribution channel is based on Article 6(1)(f) GDPR with the interest of delivering only verified versions.

3.2 Account and sign-in

For registration and account use we process contact, sign-in, profile, settings, plan and permission data as well as required usage and security information. With Google Sign-In we receive the profile data you have released from Google. With Sign in with Apple we receive from Apple an account identifier, the e-mail address you have released and, at the first sign-in, the released name. If you use Apple's option to hide your e-mail address, we receive a relay address generated by Apple; Apple then forwards our e-mails to your actual address and processes the delivery data required for this in its own responsibility. When an account is deleted, we initiate the revocation of the Apple sign-in to the extent Apple technically provides for this.

The purposes are account creation, sign-in, performance of the contract, permission checks, support and protection against misuse. The legal basis is Article 6(1)(b) GDPR. Security measures are additionally based on Article 6(1)(f) GDPR with the interest of protecting accounts and the service from unauthorised access.

3.3 Bicycle record and files

For the core features we process the bicycle, component, inventory, consumables, activity, service, purchase, warranty and maintenance data you enter, as well as notes, photos and documents. From this we calculate in particular mileage, maintenance status and reminders. For uploaded files we process the technical metadata required for storage and retrieval. In the apps we access the camera or photo library only after your release in the operating system and only for the image you select.

The purposes are the management, documentation, synchronisation, reminders and exports you request. The legal basis is Article 6(1)(b) GDPR. Content remains stored until you delete it, delete your account or until a period stated for the respective feature expires, unless statutory obligations prevent this. Service entries marked as deleted may remain stored as a correction history until the account is deleted.

3.4 Local storage and device backups

For sign-in, security, settings, features you explicitly call up and offline use, we use cookies or comparable storage techniques on the device. Where access is strictly necessary for the service you request, it is based on section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); for optional push identifiers, section 5 applies. The subsequent processing of personal data follows the legal basis of the respective feature. The persistent offline storage may keep account content on the device after you sign out. On shared devices you should therefore additionally delete the app or website data.

Android and iOS may include local app data in a device backup you have activated, for example in your Google account or in iCloud. You control the scope and deletion of this backup through the operating system or your Google or Apple account.

3.5 Referral programme

You can recommend Velopit with a personal referral code and a referral link. The code is generated when you open the Refer a friend page in the app or publicly share a service record, a maintenance plan, a checklist or a workshop session template; the referral link, your shared pages and a public partner profile contain the code. Velopit does not send invitations; you pass on the link or code yourself. Codes can also be issued to Velopit partners; the attribution described below then works in the same way.

If a person enters your code when registering or within two weeks afterwards, we store the code, an identifier of your account and the time of the attribution at their account; at your account we count how many accounts were created with your code and how many of them are active. An account counts as active once it has created a bicycle and recorded a ride or a service entry; our server performs this check on the basis of the bicycle record. From the number of active referrals we derive a level that can be shown in the app and, together with a name you choose to publish, on your public shares. You only see numbers, no names or e-mail addresses of the referred persons; the app shows referred persons no information about your account. An attribution cannot be changed afterwards.

The purposes are running the programme, recognising referrals and measuring our referral channels. The legal basis is Article 6(1)(b) GDPR to the extent you use the feature or enter a code, otherwise Article 6(1)(f) GDPR with the legitimate interest of making the service known without advertising e-mails and detecting misuse. Attribution and counters remain stored until the account is deleted; if you delete your account, we remove the reference to your account from the accounts of the persons you referred. Logs of the programme contain neither code nor account identifier.

4. AI features and Google Gemini

When you use Crew Chief, we transmit your input, where applicable an image, relevant parts of the previous conversation and automatically selected information from your bicycle record to the Google Gemini API. This includes bicycle, component, setup, service and stock information including notes stored there. For the most recent matching cycling activity, date, distance and activity type are included, but not heart rate or route data. On your request, further bicycle record data you ask about may be included. The context is compiled automatically and cannot be selected field by field.

With AI import or component scan, the image or document you select is transmitted to Gemini. It may contain contact, order, product and price data. We store permanently in the bicycle record only the results you confirm; the original is not stored permanently by the analysis feature. Please do not transmit health data, data of uninvolved third parties or other sensitive content that is not required.

The purposes are answering your request, research and extraction of selected information. The legal basis for ordinary personal data is Article 6(1)(b) GDPR to the extent the processing is necessary for the AI service you request. The recipient is Google Cloud EMEA Limited with affiliated companies and subcontractors.

Chat content and sources remain stored at Velopit until you delete them manually or delete your account; there is currently no general calendar-based deletion period. Google may generally store transmitted content for abuse monitoring for up to 55 days; flagged content may be reviewed by authorised persons. For a request supported by Google Search, Google stores the request, the context and the output for 30 days. Under the contractual terms applicable to our plan, Google does not use the content to improve general models. Further information: Gemini API Terms and Gemini Usage Policies.

5. Payments, e-mail, CRM and push

5.1 Payments via Stripe

For paid plans we transmit contact details, an account identifier and the selected plan to Stripe Payments Europe, Limited. In the checkout, Stripe processes in particular billing, payment, device and fraud prevention data. We receive customer, transaction, subscription and payment status data, but no complete card or bank account data.

The purposes are checkout, subscription management, billing, reversal and fraud prevention. The legal bases are Article 6(1)(b) GDPR, Article 6(1)(c) GDPR for statutory retention and Article 6(1)(f) GDPR. Our legitimate interests are secure payment processes, prevention of misuse and the defence of claims. Stripe may itself be the controller for its own regulatory and security purposes.

5.2 Purchases through the Apple App Store

If you buy the Ride plan in the iOS app, Apple handles ordering, payment, renewal, cancellation and refunds. Apple processes in particular your Apple ID and purchase and payment data as an independent controller under its privacy policy; for purchases in Germany, Austria and Switzerland the responsible entity is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. About the purchase we receive from Apple neither your payment method data nor the name or e-mail address of your Apple ID.

So that we can assign a purchase to your account, our server generates a random purchase identifier that the app passes to Apple at the time of purchase. From Apple we receive, for the subscription, a transaction identifier, the purchased product, the environment (test or production), the type of acquisition, the subscription status, expiry and renewal details, the end of a current grace period, details of a withdrawal or refund by Apple, and the type and time of the notifications. We receive this information when the app confirms, restores or reconciles a purchase, through notifications from Apple to our server and through regular queries of the subscription status at Apple. At your account we store from this the plan, status and expiry for display in the app. On your request we can assign a subscription to a different Velopit account.

The purposes are activating and displaying the plan, assigning the purchase to your account, avoiding duplicate subscriptions across website and app, and support. The legal basis for assigning the purchase and activating the plan is Article 6(1)(b) GDPR. For avoiding duplicate subscriptions, the regular reconciliation with Apple and the information remaining after account deletion, the legal basis is Article 6(1)(f) GDPR; our legitimate interests are avoiding duplicate payments, displaying the plan correctly and being able to answer further notifications from Apple about a subscription.

We store this information until the account is deleted. Deleting the account does not cancel a subscription with Apple; cancel it in the subscription settings of your Apple ID. After account deletion we keep, for each subscription, only the transaction identifier, the environment and the time of deletion, without reference to an account. This allows us to answer further notifications from Apple about this subscription without storing subscription details again, and to assign a subscription you restore with a new account to that account. Apple can link the transaction identifier to your purchase. We delete this information at the latest 13 months after the last notification from Apple about this subscription; each further notification extends the period accordingly.

5.3 E-mail and CRM via Brevo

For required account and service messages and for optional weekly reviews and maintenance alerts we use Brevo SAS. Contact, delivery and the content data required for the respective message are processed. Required contractual messages are based on Article 6(1)(b) GDPR, statutory confirmations on Article 6(1)(c) GDPR. Optional e-mails may only be sent on the basis of your consent under Article 6(1)(a) GDPR; it can be withdrawn with effect for the future in the notification settings.

For customer care we also regularly synchronise contact, account and plan data, the status of connected services, details of participation in the referral programme (origin of the account, number of active referrals and level) and summarised information on the use of the bicycle record, service and AI features with Brevo and form general usage groups. This serves appropriate service, onboarding and product communication including reactivation, and the evaluation and improvement of our own features. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are structured customer care, the avoidance of unsuitable communication and the further development and promotion of the service. We send promotional messages only under the statutory conditions. The grouping has no legal or similarly significant effect. You can object to this CRM processing and the associated profiling at any time via the contact address in section 1.

5.4 Push notifications

If you enable push notifications, we process your setting, a device or installation identifier, delivery data and the message content. Notifications may contain bicycle or maintenance details and may be visible on the lock screen. Recipients are Google Firebase Cloud Messaging, on iOS additionally the Apple Push Notification Service, and the respective browser or operating system provider.

The purpose is the reminder you request. The legal basis is your consent under Article 6(1)(a) GDPR; access to optional device identifiers is additionally based on section 25(1) TDDDG. After deactivation we end delivery and remove the push identifier stored at Velopit. Technical installation data at the platform provider may persist under its own deletion and backup periods.

6. Strava integration

If you voluntarily connect Strava, we process the required authorisation data and the profile, bicycle and activity data provided by Strava. The data source and independent controller for the Strava service in the EEA is Strava Ireland Limited. Depending on the response, further device, location, performance or fitness details may be processed temporarily. We store permanently only the information required for cycling activities and their assignment to bicycles. Heart rate and route data are not stored permanently; Velopit does not use the integration for medical assessments.

The purposes are the activity synchronisation you request, assignment to bicycles and components, mileage calculation and maintenance reminders. The legal basis for ordinary personal data is your consent under Article 6(1)(a) GDPR. The integration is not intended for health data or other special categories of personal data.

When you disconnect, we delete the access data stored at Velopit and end future retrievals. Disconnecting in Velopit does not revoke the authorisation at Strava; revoke it additionally in the Strava settings. Cycling activities already imported remain stored as part of your bicycle record until you delete them or your account. A technical identifier of already imported activities may persist until account deletion as protection against a repeated import. Further information: Strava Privacy Policy.

7. Workshop features, public shares and partner profiles

7.1 Workshop data and transfer links

Workshops can provide bicycle, component, service, purchase and customer reference data for a workshop entry. This data comes from the respective workshop and may concern persons who do not yet have a Velopit account. The workshop is responsible for the original collection and its own records; Velopit provides the technical transfer. With your voluntary transfer, the selected information becomes part of your bicycle record on the basis of Article 6(1)(b) GDPR.

A transfer link can be opened by anyone who holds it, without signing in. The transfer does not end its availability. The link remains reachable until a set expiry or its deletion; without a set expiry, until deletion. The workshop entry is not removed by expiry or account deletion alone and may persist independently of the user account until it is deleted by the workshop or Velopit.

7.2 Workshop check-in

For a voluntary check-in we process the selected bicycle and workshop, the desired release period, the optional reason for the visit, the release status and required access and evidence data. During the displayed period, the selected workshop receives the released bicycle, component, maintenance and service data. Service notes are only transmitted with a separate release.

The purpose is preparing and carrying out the workshop visit. The legal basis is Article 6(1)(b) GDPR; optional notes are based on Article 6(1)(a) GDPR. The workshop processes the retrieved data for its advice and services in its own responsibility. The release can be withdrawn in the app. Access ends with the withdrawal or the expiry of the chosen period; the reason for the visit may persist until the visit document is deleted. For this document, deletion is scheduled 24 months after the check-in; execution may be technically delayed.

7.3 Public service records, maintenance plans, checklists and workshop session templates

If you share a service record, a maintenance plan, a checklist or a workshop session template, we create a public copy of bicycle, component, service, maintenance plan, checklist or session data. Anyone who holds the link can open and pass it on without signing in. The copy may also contain costs, notes, correction or status details and technical identifiers. For a workshop session template, the title, check items and material details are taken over without stock quantities; your note on the session only if you select this when sharing. An optionally included bicycle photo is provided via a separate file address. Shared pages contain your referral code under section 3.5; from a certain level, your level in the referral programme is shown next to a name you choose to publish. For maintenance plans, checklists and workshop session templates we count, per share, the number of adoptions and show it on the shared page and in partner profiles. So that an adoption counts only once, we do not store the account identifier of the adopting account but a pseudonymised checksum of this identifier and the share. This checksum is not visible to users, not even to the sharing person. It remains stored until the sharing person deletes their account, even if the adopting account is deleted beforehand. Logs of the count contain no account identifier.

With search engine indexing, a maintenance plan, a checklist or a workshop session template can become findable worldwide. The legal basis of the requested share is Article 6(1)(b) GDPR; for a name you choose to publish and for search engine indexing, consent under Article 6(1)(a) GDPR is required. Public access remains until withdrawal or deletion. The share document, inactive after that, remains stored until actual deletion or account deletion. Copies already retrieved and search engine records may persist. A previously retrieved photo address may continue to work until the photo is replaced or deleted or until account deletion.

7.4 Public partner profiles

Partners with a partner agreement can, if they wish, publish a public profile at velopit.app. The partner controls publication, changes and withdrawal in the app; a profile only becomes public when the partner expressly publishes it. Public are the stated name, a profile slogan, an introductory text, up to five links, a voluntarily uploaded photo, up to three bicycles as a frozen copy with name, brand, model, model year, category, the e-bike indication, mileage and the fitted parts with type, brand, model and mileage, the bicycle photo stored there as a copy, an optional text of the partner's own about each bicycle, the public shares under section 7.3 selected by the partner with the number of adoptions, and the referral code under section 3.5. Frame numbers, prices, purchase data, receipts, notes, documents and identifiers of third parties are not taken over. Photos are provided via a separate file address that only responds while the profile is published or while it is retrieved via a time-limited preview link generated by the partner. The preview link is valid for 60 minutes; whoever receives it from the partner within that time can view the profile before it is published.

A published profile can be opened by anyone without signing in and is intended for search engine indexing; it can become findable worldwide. The bicycle copies are a snapshot at the time of their creation; the partner updates them. The legal basis is Article 6(1)(b) GDPR on the basis of the partner agreement; for the photo, consent under Article 6(1)(a) GDPR is required, which you give by uploading it and withdraw by removing the photo. If you withdraw the profile, the photo is no longer publicly retrievable. It remains stored, however, until you remove it or delete your account, and reappears if you publish the profile again.

With the withdrawal, the page is no longer reachable. Velopit can block a profile, for example after a report via the Report content link on every profile page. The profile, no longer public after that, remains stored until the account is deleted. When an account is deleted, the profile with all content and photos is deleted. Copies already retrieved and search engine records may persist.

8. Support and statutory online forms

When you contact us, give feedback or make a support request, we process contact, message, attachment and required technical diagnostic data. Screenshots may contain visible account, app or third-party data. The purposes are processing, support, troubleshooting and protection against misuse. The legal basis is Article 6(1)(b) GDPR for contract-related matters, otherwise Article 6(1)(f) GDPR with the interest of handling requests efficiently and fixing errors.

A request to become a Velopit partner made from the app (More, Become a partner) is handled like a support request. You submit the display name you would like, the addresses of your public channels and a message; the technical details of a support request are added. We review the request and reply by e-mail to the address of your account. The legal basis is Article 6(1)(b) GDPR (initiation of a partner agreement). The request is retained like support data.

At velopit.app/vertrag-widerrufen (in German) you can withdraw electronically from a contract concluded at a distance. At velopit.app/konto-loeschen (in German) you can request the deletion of your account if you can no longer sign in. We process the contact, contract and message data you provide and the required connection, receipt and processing details. To protect other people's accounts we verify your authorisation. The legal bases are Article 6(1)(c) GDPR, for the withdrawal function in conjunction with section 356a BGB, and Article 6(1)(f) GDPR for the prevention of misuse.

Support data is retained until processing is complete and then until the regular limitation period expires, to the extent a documented purpose of evidence, prevention of misuse or legal defence exists. For withdrawal and deletion requests, the statutory retention and limitation periods applicable to the type of document apply.

9. Recipients and transfers to third countries

Depending on the feature used, in particular the following recipients or categories of recipients receive data:

Google, Apple, Stripe, Brevo, Strava and their subcontractors may also process data in the USA or other countries outside the European Economic Area. Public shares are by their nature retrievable worldwide. Depending on the actual recipient, we base third-country transfers on an adequacy decision of the European Commission, in particular the EU-US Data Privacy Framework for correspondingly certified US recipients, or on standard contractual clauses and required supplementary measures.

You can request information on the safeguards used or a copy of the relevant standard contractual clauses under section 1. Further information: Google Cloud Data Processing Addendum, Stripe Privacy Center, Brevo Privacy Policy and Apple Privacy Policy.

10. Retention and account deletion

We store personal data only for as long as the respective purpose, a statutory obligation or a legitimate interest in the defence of claims exists. In particular, the following periods and criteria apply:

You can have your account deleted in the settings or via the page named in section 8. To protect against misuse we verify your authorisation. The deletion process is designed to delete or anonymise the account-related app, authentication, file, support, check-in, share and partner profile data and to initiate deletion at the service providers involved. Statutory retention obligations, independent obligations of payment service providers or workshops, the workshop entries and adoption checksums named in section 7, the details of purchases through the Apple App Store named in section 5.2, and time-limited backups and security logs remain unaffected. A subscription through the Apple App Store is not cancelled by the account deletion. Execution at external services may be delayed; on request we check the status.

A minimal log of the deletion request may remain as evidence of processing and for checking technical residues. It is not used for advertising or profiling and is retained only as long as a specific purpose of evidence or legal defence exists. Fully anonymised statistics may be retained permanently.

11. Profiling and automated decisions

Velopit makes no decisions based solely on automated processing with legal or similarly significant effect within the meaning of Article 22 GDPR. The CRM profiling described in section 5 serves customer care and has no such effect.

12. Your rights

Within the statutory conditions you have the right of access under Article 15 GDPR, to rectification under Article 16 GDPR, to erasure under Article 17 GDPR, to restriction of processing under Article 18 GDPR, to data portability under Article 20 GDPR and to object under Article 21 GDPR. Where processing is based on your consent, you can withdraw it at any time with effect for the future under Article 7(3) GDPR. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Objection under Article 21 GDPR: You can object at any time, without giving reasons, to direct marketing and the associated profiling. Where other processing is based on Article 6(1)(f) GDPR, you can object on grounds relating to your particular situation. We then continue to process the data concerned only if compelling legitimate grounds or the establishment, exercise or defence of legal claims allow this.

Please send requests, withdrawals and objections to the contact address in section 1. Only where there are reasonable doubts about your identity may we request the additional information necessary to confirm it. You can also lodge a complaint with a data protection supervisory authority. For the controller, the competent authority is regularly the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany: www.lda.bayern.de.

13. Data security and changes

We use appropriate technical and organisational measures to protect your data.

We update this policy when data flows, recipients or the legal situation change. The published version with its date is available at velopit.app/en/privacy; the binding German version at velopit.app/datenschutz. We inform you of material changes in an appropriate form before a new processing begins, where this is required by law. Where a changed processing requires consent, we obtain it in advance.

Last updated: