Privacy policy

1. Data controller

Luca Remiddi, Via Novella 48, 27030 Zinasco Vecchio (PV), Italia. Contact email: veloai.eu@gmail.com.

2. Data we process

• Account: email address, password (stored in encrypted form by the authentication provider; we cannot see it), account identifier, chosen language, creation date. If you use the app as a guest, an anonymous account with no email is created.
• Profile photo (optional): the image you upload. It is kept in a storage space whose address is accessible to anyone who knows it, but it is not listed publicly or linked to your email.
• Routes and requests: start and finish cities, kilometres, elevation, bike type and the notes you write, and the routes you choose to save.
• Usage counters: how many route generations you made today, to apply the service limits.
• Email for the VeloAI Pro notice (optional): if you choose “Notify me when Pro is live”, we keep the email you enter (and your language) only to write to you when the service launches. It is deleted on request to veloai.eu@gmail.com and also when you delete your account.
• Technical data: IP address and network information that servers receive during normal operation (security logs).
• We do not collect your GPS location: you type the start yourself. We use no advertising and no analytics or tracking tools.

3. Why we process it and on what basis

• To create and manage your account and provide the service (Art. 6(1)(b) GDPR, performance of a contract).
• For security, to prevent abuse, to apply usage limits and keep costs under control (Art. 6(1)(f), legitimate interest).
• For the profile photo, which is optional (Art. 6(1)(a), consent, which you can withdraw by removing the photo).
• To comply with legal obligations, for example tax obligations once payments are active (Art. 6(1)(c)).

4. Who we share data with

We use providers that process data on our behalf or to deliver the feature you request:

• Supabase (accounts, database, storage and server functions). The project is hosted in the EU West (Irlanda) region.
• OpenRouteService / HeiGIT (route calculation, place search, elevation): they receive the coordinates and place names needed for the calculation.
• Google (Gemini): receives the measured route data and the notes you write, to generate the explanation text. Do not write personal data about yourself or others in the notes.
• Open-Meteo: receives the coordinates of some points on the route for weather forecasts.
• OpenStreetMap (and its services such as Overpass, Nominatim and the map servers): receive coordinates or search text and, like any website, your IP address.
• PayPal, only if you choose to donate: you are taken to PayPal’s site, which processes payment data as an independent controller; we never see or store your card details.
• Cloudflare (Cloudflare Pages), which hosts the website and the web version of the app: like any hosting service it receives the IP address and technical data of requests and logs them for security and operation.
• Visit statistics: the site may use Cloudflare Web Analytics, which measures visits and page views in aggregate form, without cookies and without identifying you.
• Feedback: if you submit the “Feedback” form we store the message, the type of report, the answer on willingness to pay, the language and, only if you enter it, your email so we can reply.
• Google Play and the Apple App Store, for distributing the app and, when active, for payments.

Some providers are located outside the European Economic Area (for example in the United States): in that case transfers rely on the safeguards provided by the GDPR, such as standard contractual clauses or adequacy decisions. We do not sell your data.

5. How long we keep data

For as long as you keep your account. When you delete it (from the app or as described on the “Delete account” page) we erase the account, profile, photo, saved routes and counters. Technical backup copies managed by providers may remain for a limited period before being overwritten. Inactive guest accounts may be deleted.

6. Your rights

You can ask for access, rectification, erasure, restriction and portability of your data and object to processing by writing to veloai.eu@gmail.com. You can delete your account and data yourself in the app (Profile → Delete account). You also have the right to lodge a complaint with a supervisory authority: in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority of your country.

7. Children

VeloAI is not intended for people under 16. If you believe a child has given us data, write to us and we will erase it.

8. Security

We use encrypted connections (HTTPS), access rules so that each user sees only their own data, and service keys kept on the server, not in the app. No system is 100% secure: if you notice a problem, write to us.

9. Changes

We may update this policy. The date of the last update is at the top; for important changes we will notify you in the app.