Privacy policy
Last updated: [DATE]
1. Who we are
Cyclone Indoor Cycling ("Cyclone", "we", "us") is run by [COMPANY NAME], a company registered in England and Wales, company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS]. You can contact us at [CONTACT EMAIL].
We are the "controller" of the personal data described below under UK data protection law (UK GDPR and the Data Protection Act 2018).
2. What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Your email address | To send your sign-in link, identify your account, tell you about your purchase and answer your messages. | Contract (providing the service) |
| Sign-in link and session records (a random code linked to your email) | To keep you signed in. Sign-in links last 15 minutes. Sessions last 30 days or until you sign out. | Contract; legitimate interests (security) |
| Whether you have paid, when, the amount and a payment reference | To give you access and keep tax and accounting records. Your card details go straight to Stripe and never reach us. | Contract; legal obligation (tax records) |
| Strava connection (only if you choose to connect): your Strava athlete ID and name, and the access codes Strava gives us | To upload your rides to your Strava account when you press upload. | Consent (you can disconnect at any time) |
| Basic technical data (IP address, browser type, requests) in our hosting provider's logs | To run the website, keep it secure and prevent abuse. | Legitimate interests |
| Messages you send us | To reply and keep a record of the support we gave. | Legitimate interests; contract |
3. What stays on your device
- Bike fit videos. The video you choose is analysed in your browser. It is not uploaded to us or anyone else and is not saved.
- Ride data. Power, heart rate, cadence and speed from your trainer and sensors are used in your browser. We only receive a ride if you press upload to Strava, and then it passes through our server to Strava without being stored by us.
- Settings. Your power and heart rate zones, dashboard layouts, custom workouts and routes are saved in your browser's local storage on your device.
4. Who we share data with
We use these service providers (processors) to run Cyclone. We do not sell your data.
- Cloudflare hosts the website and stores account records.
- Resend sends the sign-in emails.
- Stripe takes payments. Stripe is also responsible for the card data it handles.
- Strava, only if you connect your account. Strava has its own privacy policy.
- Content delivery networks. When you use Bike Fit, your browser downloads the pose-detection software and model from jsDelivr and from Google's storage. Those providers can see your IP address and the request, but not your video.
We may also share data where the law requires it, or with professional advisers (for example accountants and lawyers) under a duty of confidentiality.
5. Transfers outside the UK
Some of these providers are based in, or process data in, the United States or other countries. Where that happens we rely on UK-approved safeguards, such as the UK addendum to standard contractual clauses or an adequacy arrangement, which the providers offer.
6. How long we keep data
- Sign-in links: 15 minutes. Sessions: up to 30 days.
- Account and payment records: while you have an account and for up to six years afterwards, for tax and accounting.
- Strava connection: until you disconnect or ask us to delete your account.
- Support emails: up to two years after we last spoke.
7. Cookies and similar technologies
We use one cookie, a sign-in session cookie, which is strictly necessary to keep you signed in. We also use your browser's local storage to remember your settings on your device. We do not use advertising, tracking or analytics cookies. Fonts are hosted by us, so your browser does not contact Google for them.
8. Your rights
Under UK data protection law you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; and give you your data in a portable format. Where we rely on your consent (Strava), you can withdraw it at any time. To use any of these rights, email [CONTACT EMAIL]. We aim to reply within one month. To delete your account, email us from the address on the account.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
9. Children
Cyclone is for people aged 18 and over. We do not knowingly collect data from children.
10. Security
Data is sent over encrypted connections and sign-in uses one-time links rather than passwords. No system is completely secure, but we take reasonable steps to protect your data and will tell you and the ICO if a breach puts your rights at risk, as the law requires.
11. Changes to this policy
If we change this policy in a way that matters to you, we will update the date above and tell you by email or on the website.