Privacy Policy

01 · Responsibility

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed because there is currently no legal obligation to do so.

02 · At a glance

The essentials

• intellivelo needs location data to show your position, calculate bike routes, provide navigation, and record rides.
• The location, route, and ride data described below is encrypted in transit to the intellivelo API for route calculation and RideIQ analysis.
• Planned and completed rides are stored on your device and may be synchronized through a cloud service available to the app.
• intellivelo currently has no user accounts, creates no advertising profiles, and does not sell personal data.

03 · iOS app

Data processing in the app

Location and ride recording

If you allow the app to access your location, it processes your precise location. During a ride, this may include coordinates, timestamps, speed, direction of travel, altitude, and horizontal and vertical accuracy. Background access allows navigation and ride recording to continue when the screen is off or the app is not in the foreground.

This processing is necessary for map positioning, route planning, navigation, ride statistics, and RideIQ analysis. The legal basis is Article 6(1)(b) GDPR. Without location access, these features are unavailable or limited. You can change access at any time under Settings → Privacy & Security → Location Services. This does not automatically delete rides that have already been stored.

Bluetooth and eBike data

With your permission, the app uses Bluetooth to find a supported nearby eBike component and read data such as battery level, wheel speed, power values, and assistance mode. The Bluetooth connection is made directly between your iPhone and the eBike. intellivelo does not send this live Bluetooth data to the RideIQ API. Selected summaries—currently battery level at the start and end, peak power, and assistance mode—may be stored with your ride history and synchronized through an available cloud service. The legal basis is Article 6(1)(b) GDPR.

04 · Routing and RideIQ

Transfer between the app and intellivelo API

The app communicates with the intellivelo API over an encrypted connection. We use technical service providers to operate the API and provide routing and RideIQ features.

Purpose, legal basis, and retention

This processing calculates and assesses bike routes and therefore provides the app features you request. The legal basis is Article 6(1)(b) GDPR. Route and ride data is processed for as long as needed to provide the requested feature. Operational and security logs may include an IP address, request time, requested function, status information, and technical device or connection data. We process these logs to provide the service securely and reliably on the basis of Article 6(1)(f) GDPR and delete them when they are no longer needed for operations, troubleshooting, or abuse prevention, unless legal obligations require otherwise. Our legitimate interest is the secure and reliable operation of the API.

RideIQ is not a decision with legal effect

RideIQ automatically calculates an indication of route quality. The result is solely for your guidance and has no legal or similarly significant effect. No automated decision-making within the meaning of Article 22 GDPR takes place.

05 · Storage

Device and cloud storage

The app stores data on your device and may synchronize it through a cloud storage service connected to your device. This includes, in particular:

• planned rides with names and addresses, start and destination, route, route preview, distance, duration, and RideIQ Score;
• completed rides with time, GPS track, distance, duration, speeds, route and arrival values, RideIQ Score, and the eBike summaries described above; and
• app settings such as map style and hill, turn, and surface preferences.

This supports ride history, analysis, reuse of planned routes, restoration, and synchronization between your devices. The legal basis is Article 6(1)(b) GDPR. The cloud service provider processes synchronized data under the terms of your account with that provider. The data remains stored until you delete the relevant rides or app data, disable cloud synchronization for intellivelo, or arrange deletion through the provider or us, unless legal retention obligations require otherwise.

06 · Recipients

Maps, search, and service providers

Place and address search

The app uses a mapping and search provider for place and address suggestions. The provider may process search terms, request time, device and software information, and—where permission has been granted—location and visible map area data. This processing answers your search request on the basis of Article 6(1)(b) GDPR.

Maps and map resources

We use mapping data and technical service providers to display and deliver maps and related resources. As a technical necessity, these providers may receive an IP address, request time, requested resource, and device or connection data. Location or route data is shared only where necessary to provide a feature you request. The legal basis is Article 6(1)(b) GDPR for displaying and using the map and Article 6(1)(f) GDPR for secure and reliable delivery. Our legitimate interest is a responsive and reliable map display.

07 · intellivelo.app

Website, audience measurement, and waitlist

Hosting and server logs

When you visit this website, our hosting and infrastructure providers process technically necessary data such as your IP address, time of access, requested page, referrer, browser, operating system, device type, and status information to deliver and secure the website and analyze errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of the website. The data is deleted when it is no longer needed for these purposes, unless legal obligations require otherwise.

Web analytics

We use a privacy-focused analytics service for aggregated audience measurement. Data may include timestamps, requested paths, filtered URL parameters, referrers, approximate region, operating system, browser, and device type. We do not use this data to build advertising profiles, and the analytics service does not use third-party cookies on our website. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to understand website use in aggregate and improve the service.

Waitlist

If you voluntarily join the waitlist, we process your name, email address, bike brand, and bike type. We use this data to confirm your subscription, organize beta access, select suitable test groups, and send beta invitations, product updates, and launch notices. The legal basis is your consent under Article 6(1)(a) GDPR.

After submitting the form, Brevo sends a confirmation email on our behalf. Your address is added to the confirmed waitlist only after you use the confirmation link. Brevo provides our contact management, email campaign, delivery, and unsubscribe functions as a processor acting on our behalf.

If we select you for external beta testing, we transfer your first name, last name, and email address to Apple through App Store Connect so Apple can send and manage your TestFlight invitation. Your bike information is used for our selection and is not included in the TestFlight tester import.

You can withdraw your consent at any time with future effect by using the unsubscribe link in an email or by contacting us. This does not affect the lawfulness of processing carried out before withdrawal. Waitlist contact details are stored until you withdraw consent, the beta and product-information purpose no longer applies, or legal obligations require further retention.

Contacting us

If you contact us by email, we process your contact details and the contents of your message to respond. Depending on your request, the legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR. Our legitimate interest is responding to inquiries. We delete the data once your request has been resolved and no legal retention or documentation obligations require otherwise.

08 · International processing

International data transfers

Some of our service providers may process data in countries outside the European Economic Area, including the USA. Where an adequacy decision by the European Commission does not establish an adequate level of data protection, transfers rely on appropriate safeguards under Article 46 GDPR, in particular the European Commission's Standard Contractual Clauses. Where a recipient is validly certified under the EU-US Data Privacy Framework, the transfer may also rely on the adequacy decision under Article 45 GDPR. You can request copies of the relevant safeguards using the contact details above.

09 · Retention and security

How long we retain and protect your data

Unless a specific period is stated in the individual sections, we store personal data only for as long as necessary for the relevant purpose. It is then deleted or anonymized unless statutory retention periods, the establishment or defense of legal claims, or technical backup cycles require otherwise.

We take appropriate technical and organizational measures to protect data. These include encrypted transmission, access restrictions, and data processing limited to what each feature requires. Transmission over the internet can nevertheless never be entirely risk-free.

10 · Data subject rights

Your rights

Subject to the applicable legal requirements, you have:

• the right of access under Article 15 GDPR,
• the right to rectification under Article 16 GDPR,
• the right to erasure under Article 17 GDPR,
• the right to restriction of processing under Article 18 GDPR,
• the right to data portability under Article 20 GDPR,
• the right to withdraw consent at any time with future effect under Article 7(3) GDPR, and
• the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR under Article 21 GDPR.

To exercise your rights, email christoph@kassen.name.

Under Article 77 GDPR, you also have the right to lodge a complaint with a data protection supervisory authority. The Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, is one of the authorities responsible for private entities in Bavaria. You may also contact the supervisory authority at your habitual residence or place of work.

11 · Updates

Changes to this privacy policy

We update this privacy policy when features, recipients, or legal requirements change. The current version is always available at intellivelo.app/privacy. The date above indicates when this version was last updated.