Privacy Policy

Last updated: August 2026

VéloPeak ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and what rights you have.

Who we are

VéloPeak is a cycling coaching platform powered by artificial intelligence. VéloPeak is a brand of VÉLO TECHNOLOGY, UNIPESSOAL LDA, the data controller responsible for your personal data.

• Legal name: VÉLO TECHNOLOGY, UNIPESSOAL LDA
• Legal form: Sociedade Unipessoal por Quotas (Portugal)
• Tax ID (NIPC): 518257754
• Share capital: 1.000,00 EUR
• Registered office: Praceta José Luís Nunes, nº 104, CY, Paranhos, 4200-605 Porto, Portugal
• Legal representative: Getúlio Strapazzon (Founder)
• Email: support@velo-peak.com

Data we collect

Account data

When you create an account, we collect your name, email address, and a hashed password (if you register with email). If you sign in with a third-party provider (Google), we receive your name and email from that provider.

Profile data

To personalise your training, we collect and store information you provide: date of birth, biological sex, body weight, FTP (Functional Threshold Power), preferred language, and your coach profile text.

Strava integration

If you connect Strava, we receive and store your Strava athlete ID, access and refresh tokens, and your activity data (distance, duration, elevation, power, heart rate, cadence, GPS streams, and other metrics). We may also post comments on your Strava activities on your behalf, if you enable that feature.

Training platform integration

If you connect a third-party training platform, we store your API credentials and athlete ID to read your fitness metrics (Fitness, Fatigue, Form) and push workouts to your calendar.

Device integrations

If you connect a supported training device or platform, we store the OAuth tokens required to push workouts to your device. We do not read activity data from these integrations.

Health data (Apple Health and Health Connect)

The VéloPeak mobile app can read health data from Apple Health on iOS and from Health Connect on Android. This is opt-in — you enable it in the app and grant access in the system prompt — and it is read-only: VéloPeak never writes anything back to either.

When enabled, we read these data types on iOS: heart rate variability (SDNN), resting heart rate, respiratory rate, blood oxygen saturation, sleeping wrist temperature, body temperature, VO2 max, step count, active energy burned and sleep analysis. On Android the list is the same, except that Health Connect exposes a single skin temperature type in place of the two iOS temperature types.

On your device, these readings are reduced to one value per calendar day, plus one sleep session per night — its bedtime, wake time and sleep stages. That is what is sent to VéloPeak's servers, where it is used to compute your daily readiness score. The app may also register for background delivery, which only wakes it to run that same daily sync.

When you use the AI coach, a short summary of this data — your recovery score, how your HRV and resting heart rate compare to your baseline, and last night's sleep — is included in the context sent to our AI inference provider, so the coach can take your recovery into account. This is the same provider listed under Sub-processors below, it receives only that summary, and your data is not used to train AI models.

Beyond that, health data is never used for advertising or marketing, never shared with any other third party, never sold, and never written to iCloud or any other cloud storage.

You can revoke access at any time — on iOS in Settings › Privacy & Security › Health, on Android in the Health Connect app — or by disconnecting the health source in VéloPeak. Doing so stops any further reading immediately.

Bluetooth sensors

During a workout, the app connects over Bluetooth to your own equipment — smart trainer, power meter, cadence sensor, heart-rate strap — and records their readings: power, cadence, heart rate and speed. These form the activity you save at the end of the session.

Bluetooth is used only to read from these sensors. The app does not collect your location, on iOS or Android.

Payment data

Payments are processed by a certified payment processor. We store your customer ID and subscription status. We never store card numbers or payment details — those remain with the payment processor.

Usage data

We collect standard server logs including IP address, browser type, pages visited, and timestamps, for security and performance purposes.

Error monitoring

To maintain service stability and quality, we use an active error monitoring service that automatically captures technical data when failures or unexpected behaviour occur. This may include error messages, stack traces, page URLs, browser type and version, operating system, and IP addresses. This data is used exclusively to detect, diagnose, and resolve technical issues — it is not linked to your identity and is never used for marketing or profiling purposes. The legal basis for this processing is our legitimate interest in providing a reliable and secure service (Article 6(1)(f) GDPR).

AI interactions

When you use the VéloPeak coach chat, your messages and activity context are sent to a third-party AI provider to generate responses. We do not use your data to train AI models.

How we use your data

We do not sell your personal data. We use analytics and marketing cookies only with your consent, and marketing cookies only to measure and improve our own advertising campaigns.

Third-party services

We use third-party sub-processors to operate the platform. These include providers for:

• Database hosting — EU-based infrastructure
• Application hosting and CDN — EU-based infrastructure
• AI model inference — US-based provider (data processed for response generation only; not used for model training)
• Payment processing — US-based provider (PCI-DSS compliant)
• Transactional email delivery — US-based provider
• Strava — activity data integration (US-based)
• Error and performance monitoring — third-party provider (technical error data only; retained for 90 days; used exclusively for fault detection and resolution)
• Web analytics: Google (Google Analytics 4 and Google Tag Manager), loaded only after you consent to analytics cookies
• Marketing measurement: Google and Meta (Facebook/Instagram) advertising tools, loaded only after you consent to marketing cookies

Health data is shared with only one of the sub-processors above: the AI model inference provider, and only as the short recovery summary described under "Health data". No other sub-processor on this list receives it.

Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or equivalent).

You may request the full list of sub-processors by contacting us at support@velo-peak.com.

Data retention

• Account data: retained for as long as your account is active, and up to 30 days after deletion
• Activity data: retained for as long as your account is active
• Health and sensor data: retained for as long as your account is active, and deleted with it
• Payment records: retained for 7 years for legal and tax compliance
• Server logs: retained for 90 days
• Error monitoring data: retained for 90 days

Your rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your data in a portable format
• Restrict or object to certain processing
• Withdraw consent at any time (for consent-based processing)

To exercise any of these rights, contact us at support@velo-peak.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

Cookies

We use cookies and similar technologies in three categories:

• Strictly necessary: required for the site to work (authentication, security, keeping you signed in). Always active, and cannot be disabled.
• Analytics: help us understand how the platform is used (pages visited, features used, session duration) so we can improve it. We use Google Analytics 4, loaded through Google Tag Manager.
• Marketing: let us measure and improve our own advertising campaigns (for example, which campaign brought a visitor to us). We use Google and Meta tools for this.

Non-essential cookies are off by default. On your first visit we show a cookie banner and load these technologies in a consent-denied state (Google Consent Mode). Nothing is sent to analytics or marketing providers until you consent. You choose per category: accept all, reject non-essential, or manage each category individually.

You can review or withdraw your consent at any time via the "Cookie settings" link in the site footer. Withdrawing consent is as easy as giving it, and declining non-essential cookies never affects your access to the platform.

The legal basis for non-essential (analytics and marketing) cookies is your consent (Article 6(1)(a) GDPR and the ePrivacy rules). Strictly necessary cookies rely on our legitimate interest in operating a secure service.

Children

VéloPeak is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you by email. The date at the top of this page reflects the most recent update.

Contact

For any privacy questions or requests, contact us at support@velo-peak.com.