Privacy Policy (GDPR)

1. Controller

The data controller is [Company name], [address], KRS [•], NIP [•]. Contact for privacy matters: [privacy e-mail].

2. Data we process

• Account data: e-mail, display name, avatar.
• Profile data: home spot, bio, weight, height, experience, skill level, gear quiver.
• Ride data: sessions, GPS tracks, live-tracking points, invite participation, chat messages.
• Payment data: transaction identifiers (card details are processed by the payment provider, never stored by us).
• Technical data: device type, approximate location (IP-based) when GPS is unavailable.

3. Purposes and legal bases

• Providing the service (Art. 6(1)(b) GDPR): accounts, invites, chat, sessions, payments.
• Safety features such as SOS and live tracking (Art. 6(1)(b) and (c)).
• Anonymised statistics and gear benchmarks — only with your opt-in consent (Art. 6(1)(a)); you can withdraw it in your profile at any time.
• Legal obligations: accounting and tax records (Art. 6(1)(c)).

4. Recipients

Hosting and database provider, payment providers, app stores (for in-app purchases), map and weather data providers. Data may be processed outside the EEA under standard contractual clauses.

5. Retention

Account data is kept while your account exists; payment records for the period required by tax law; live-tracking points are deleted after the track ends. You may delete your account at any time.

6. Your rights

Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to the President of the Polish Data Protection Authority (UODO).