HELP AND TRUST

Privacy policy

Updated 30 October 2026.

Communications and preferences

Messages needed for access, security and account management are sent to provide the service. News and marketing emails require a separate choice. Withdraw your subscription in Profile → Communications or using the unsubscribe link in any email. We use Brevo to send emails and manage subscriptions. We keep the version and date of terms acceptance and the history of communication choices to document and respect your preferences.

Controller and contact

VeloCrew is provided by Fernando Soto de Toro (Spain). Contact the data controller at admin@velocrew.es with questions about your data. This policy applies to velocrew.es and the VeloCrew apps.

Data we use

Account and identity data: email, name or alias, user ID and profile photo if you add one. Shared content: Crew memberships, join requests, attendance, routes and their coordinates, meeting points, dates, photos and videos. Optional cycling preferences: weight and expected average speeds. Expenses: descriptions, amounts, participants, splits and payment confirmations. Technical data: installation and notification identifiers, language, platform, usage activity and logs needed to operate and protect the service.

Purposes and legal bases

We process data needed to create your account, organise rides, share content and manage expenses to provide the service you request. We use technical data for security, abuse prevention, diagnostics and service improvement based on our legitimate interest in keeping the service operational. Features requiring device permissions, such as photos or notifications, depend on your choice; you can revoke permissions in device settings. We also comply with applicable legal obligations.

What others can see

A Crew’s name, description, area and cover photo may appear in search. Open Crews allow direct joining; closed Crews require approval. Administrators see join requests and manage members. Ride content, albums and expenses are shared with the relevant members or participants. If you share a link or image outside VeloCrew, recipients can access that content. Do not publish other people’s information without their permission.

Service providers

We use Google Firebase for authentication, databases, server functions and notifications; Cloudinary for photos and videos; and Vercel for web hosting. If you choose Apple or Google sign-in, that provider handles identification. Maps and weather use providers such as Apple, Google Places and OpenStreetMap: weather requests send route coordinates, not your password. These services may process data outside the European Economic Area under their terms and data protection safeguards, including standard contractual clauses or adequacy decisions where applicable. Contact admin@velocrew.es for more information.

Optional location in the route designer

With your permission, we use the device location to centre the map when opening the route designer. We do not track your position in the background. You can create routes without this permission; the last starting point you chose is remembered on the device as a fallback. You can revoke permission in device settings. Map providers receive the requests needed to display the area you view.

Expenses and payments

VeloCrew records and splits shared expenses. Confirming a payment records a payment made elsewhere; it does not execute a bank transfer or charge a card. This feature does not require card details.

Retention

We retain data for as long as needed to provide the service and maintain your account and shared content. You may request deletion. When handling a request, we consider shared content and other participants’ rights; we may retain the minimum information necessary for legal obligations, security or claims for the applicable period. Backups and technical logs may take time to be removed according to their retention cycle. You can request details about your data.

Your rights and deletion

You can request access, correction, deletion, portability, restriction or object to processing by emailing admin@velocrew.es from your account email. In the iOS and Android versions that include this feature, you can initiate a request from Account → Delete my account without sending an email. Requests are processed manually within 30 days and confirmed by email. First transfer Crews you own to another active member; if there are none, you can confirm their deletion. You can also request deletion by email with the subject “Delete VeloCrew account”. To delete selected data without closing your account, email us from your account address with the subject “Delete VeloCrew data”, specifying the photos, videos, routes or profile data to remove; we will process your request within 30 days. We will verify your identity without asking for your password. Device permissions can be withdrawn in settings. You may complain to the Spanish Data Protection Agency (aepd.es) or another competent authority if you believe your rights have not been respected.

Local storage and changes

The app and website store session data, preferences and caches needed for operation. We do not sell your personal data. When features or processing change, we will update this policy and communicate significant changes.