Privacy Policy

Last updated: October 2026

VéloPeak ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and what rights you have.

Who we are

VéloPeak is a cycling coaching platform powered by artificial intelligence. VéloPeak is a brand of VÉLO TECHNOLOGY, UNIPESSOAL LDA, the data controller responsible for your personal data.

• Legal name: VÉLO TECHNOLOGY, UNIPESSOAL LDA
• Legal form: Sociedade Unipessoal por Quotas (Portugal)
• Tax ID (NIPC): 518257754
• Share capital: 1.000,00 EUR
• Registered office: Praceta José Luís Nunes, nº 104, CY, Paranhos, 4200-605 Porto, Portugal
• Legal representative: Getúlio Strapazzon (Founder)
• Email: support@velo-peak.com

Data we collect

Account data

When you create an account, we collect your name, email address, and a hashed password (if you register with email). If you sign in with a third-party provider (Google), we receive your name and email from that provider.

Profile data

To personalise your training, we collect and store information you provide: date of birth, biological sex, body weight, FTP (Functional Threshold Power), preferred language, and your coach profile text.

Strava integration

If you connect Strava, we receive and store your Strava athlete ID, access and refresh tokens, and your activity data (distance, duration, elevation, power, heart rate, cadence, GPS streams, and other metrics). We may also post comments on your Strava activities on your behalf, if you enable that feature.

Training platform integration

If you connect a third-party training platform, we store your API credentials and athlete ID to read your fitness metrics (Fitness, Fatigue, Form) and push workouts to your calendar.

Device integrations

If you connect a supported training device or platform, we store the OAuth tokens required to push workouts to your device. We do not read activity data from these integrations.

Health data (Apple Health and Health Connect)

The VéloPeak mobile app can read health data from Apple Health on iOS and from Health Connect on Android. This is opt-in — you enable it in the app and grant access in the system prompt — and it is read-only: VéloPeak never writes anything back to either.

When enabled, we read these data types on iOS: heart rate variability (SDNN), resting heart rate, respiratory rate, blood oxygen saturation, sleeping wrist temperature, body temperature, VO2 max, step count, active energy burned and sleep analysis. On Android the list is the same, except that Health Connect exposes a single skin temperature type in place of the two iOS temperature types.

On your device, these readings are reduced to one value per calendar day, plus one sleep session per night — its bedtime, wake time and sleep stages. That is what is sent to VéloPeak's servers, where it is used to compute your daily readiness score. The app may also register for background delivery, which only wakes it to run that same daily sync.

When you use the AI coach, a short summary of this data — your recovery score, how your HRV and resting heart rate compare to your baseline, and last night's sleep — is included in the context sent to our AI inference provider, so the coach can take your recovery into account. This is the same provider listed under Sub-processors below, it receives only that summary, and your data is not used to train AI models.

Beyond that, health data is never used for advertising or marketing, never shared with any other third party, never sold, and never written to iCloud or any other cloud storage.

You can revoke access at any time — on iOS in Settings › Privacy & Security › Health, on Android in the Health Connect app — or by disconnecting the health source in VéloPeak. Doing so stops any further reading immediately.

Polar integration

If you connect your Polar account, we receive and store your Polar user ID and an access token, and read data from your Polar account (Polar Flow) through Polar's official API. This is read-only: VéloPeak never writes training or health data to Polar.

Activities. We read the exercises you record with your Polar device: sport, start time, duration, distance, calories, average and maximum heart rate and training load.

Health data. VéloPeak can also read these data types from Polar: sleep (when you fell asleep and woke up, the time in each sleep stage, interruptions, heart rate during the night and Polar's own sleep scores), Nightly Recharge (overnight heart rate variability (RMSSD), average heart rate and breathing rate, and Polar's recovery status), daily activity (steps, calories and active time), continuous heart rate, cardio load, SleepWise alertness and bedtime periods, and the physical information in your Polar account (weight, height, date of birth, sex, maximum and resting heart rate, heart rate thresholds, VO2 max, training background, typical day and sleep goal). We do not request skin or body temperature, skin contact, blood oxygen or ECG data from Polar.

From this data we keep one value per calendar day (sleep duration and stages, heart rate variability, overnight heart rate, breathing rate, steps and active energy) plus one sleep session per night, and use them to compute your daily readiness score, in the same way as the health data described above. Your Polar weight is used only if you have not given us a weight yourself. The records Polar returns are also stored as received.

The same rules apply as for the health data above: only the short recovery summary reaches our AI inference provider when you use the AI coach, and this data is never used for advertising or marketing, never shared with any other third party and never sold. Where VéloPeak shows health data that comes from Polar, it credits Polar Flow as the source.

You can disconnect Polar at any time in VéloPeak under Settings › Connections & Apps. This stops any further reading immediately, asks Polar to remove VéloPeak's access, and deletes the records stored as received from Polar. The daily values already calculated stay in your history until you delete your account or ask us to delete them.

Bluetooth sensors

During a workout, the app connects over Bluetooth to your own equipment — smart trainer, power meter, cadence sensor, heart-rate strap — and records their readings: power, cadence, heart rate and speed. These form the activity you save at the end of the session.

Bluetooth is used only to read from these sensors. The app does not collect your location, on iOS or Android.

Payment data

Payments are processed by a certified payment processor. We store your customer ID and subscription status. We never store card numbers or payment details — those remain with the payment processor.

Usage data

We collect standard server logs including IP address, browser type, pages visited, and timestamps, for security and performance purposes.

Error monitoring

To maintain service stability and quality, we use an active error monitoring service that automatically captures technical data when failures or unexpected behaviour occur. This may include error messages, stack traces, page URLs, browser type and version, operating system, and IP addresses. This data is used exclusively to detect, diagnose, and resolve technical issues — it is not linked to your identity and is never used for marketing or profiling purposes. The legal basis for this processing is our legitimate interest in providing a reliable and secure service (Article 6(1)(f) GDPR).

AI interactions

When you use the VéloPeak coach chat, your messages and activity context are sent to a third-party AI provider to generate responses. We do not use your data to train AI models.

How we use your data

We do not sell your personal data. We use analytics and marketing cookies only with your consent, and marketing cookies only to measure and improve our own advertising campaigns.

Third-party services

We use third-party sub-processors to operate the platform. These include providers for:

• Database hosting — EU-based infrastructure
• Application hosting and CDN — EU-based infrastructure
• AI model inference — US-based provider (data processed for response generation only; not used for model training)
• Payment processing — US-based provider (PCI-DSS compliant)
• Transactional email delivery — US-based provider
• Strava — activity data integration (US-based)
• Polar: activity and health data integration (Finland, EU). We only receive data from Polar; we send it none of your training or health data
• Error and performance monitoring — third-party provider (technical error data only; retained for 90 days; used exclusively for fault detection and resolution)
• Web analytics: Google (Google Analytics 4 and Google Tag Manager), loaded only after you consent to analytics cookies
• Marketing measurement: Google and Meta (Facebook/Instagram) advertising tools, loaded only after you consent to marketing cookies

Health data is shared with only one of the sub-processors above: the AI model inference provider, and only as the short recovery summary described under "Health data". No other sub-processor on this list receives it.

Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or equivalent).

You may request the full list of sub-processors by contacting us at support@velo-peak.com.

Data retention

• Account data: retained for as long as your account is active, and up to 30 days after deletion
• Activity data: retained for as long as your account is active
• Health and sensor data: retained for as long as your account is active, and deleted with it. The records stored as received from Polar are also deleted when you disconnect Polar
• Payment records: retained for 7 years for legal and tax compliance
• Server logs: retained for 90 days
• Error monitoring data: retained for 90 days

Your rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your data in a portable format
• Restrict or object to certain processing
• Withdraw consent at any time (for consent-based processing)

To exercise any of these rights, contact us at support@velo-peak.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

Cookies

We use cookies and similar technologies in three categories:

• Strictly necessary: required for the site to work (authentication, security, keeping you signed in). Always active, and cannot be disabled.
• Analytics: help us understand how the platform is used (pages visited, features used, session duration) so we can improve it. We use Google Analytics 4, loaded through Google Tag Manager.
• Marketing: let us measure and improve our own advertising campaigns (for example, which campaign brought a visitor to us). We use Google and Meta tools for this.

Non-essential cookies are off by default. On your first visit we show a cookie banner and load these technologies in a consent-denied state (Google Consent Mode). Nothing is sent to analytics or marketing providers until you consent. You choose per category: accept all, reject non-essential, or manage each category individually.

You can review or withdraw your consent at any time via the "Cookie settings" link in the site footer. Withdrawing consent is as easy as giving it, and declining non-essential cookies never affects your access to the platform.

The legal basis for non-essential (analytics and marketing) cookies is your consent (Article 6(1)(a) GDPR and the ePrivacy rules). Strictly necessary cookies rely on our legitimate interest in operating a secure service.

Children

VéloPeak is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you by email. The date at the top of this page reflects the most recent update.

Contact

For any privacy questions or requests, contact us at support@velo-peak.com.