Legal

Privacy

In force from 4 October 2026 · Pro Cykling ApS

1. Who is responsible

Pro Cykling ApS, Elmehaven 6, 8520 Lystrup, Denmark, is responsible for personal data in your account, in riders' Velograph Passports and in personal workspaces. Write to hello@velograph.ai about anything on this page.

A team, club or studio decides how it uses Velograph for its own riders and clients. For that data, the team or studio is the controller and we process the data on its behalf, under a data processing agreement that we provide on request. Riders can always contact us directly.

2. What we collect

3. Health-related data

Heart rate, HRV, sleep, illness, injury and body measurements can be health data, which the law protects specially. We process it only to provide Velograph to the rider and the people the rider trains with, on the basis of the rider's explicit consent, given when they add it or connect a platform that sends it (for riders under 18, with a parent's or guardian's agreement). A rider can withdraw consent at any time by removing the data or disconnecting the platform, or by writing to us; data already used lawfully stays lawfully used.

From the phone's health app. When a rider switches it on in Velograph's iPhone or Android app, the app reads the workouts their watch recorded in Apple Health or Health Connect (heart rate, power, cadence, speed, distance, route) and sends them to their profile. Only the watch's own workouts are read, never what other apps wrote there, and nothing is written to the health app. With the same switch, and the rider's own permission on the phone's screen, the app also reads the wellness the watch, a ring or their apps put there (sleep, HRV, resting heart rate and breathing rate while asleep, a year back at first), so the rider's readiness is read against their own normal. The data is used only for the rider's training in Velograph, never for advertising, and is shown to others only as the rider has chosen. Switching it off stops it at once.

Live from a Garmin Edge. When a rider pairs their Edge with Velograph's data field, after ticking a box under a list of what is sent and who sees it, the Edge sends their position, speed, power, heart rate, cadence, distance and climbing second by second while a ride is recorded. It goes through the Garmin Connect app on their phone, straight to Velograph. Nothing is sent before the Edge is paired, before the ride starts or after it ends. The rider's coaches and their team's managers follow it on the live board; other riders do not see it. It is kept only in Velograph's memory, never stored, and is gone a few hours after the ride; the ride Velograph keeps is the file the Edge records, which arrives the usual way. On a day the rider is in a race, heart rate is not sent, and the rider can stop sending it in the field's settings. Unpairing the Edge, in their profile under Connections or with "Pair again" in the field's settings, stops it at once. The yes, and unpairing, are recorded with the words the rider was shown.

4. Building Velograph's own models

Velograph builds its own models to answer questions a general AI cannot: how a change to a bike fit is likely to feel, a rider's thresholds without a test, how form will develop on a plan. These are Velograph's own models, not language models, and are not given to anyone else.

• Only with the rider's explicit consent. Every rider is asked once, in plain words, and nothing is used until they say yes. "Not now" or no answer is a no. The answer, and every change to it, is recorded with the words the rider was shown.
• What is used: rides (power, heart rate, cadence, speed and altitude), thresholds, age, sex and height, and bike fits with the follow-up answers on how they felt.
• What is never used: names, contact details, photos, GPS positions, notes, journal entries, messages and AI conversations. Data is linked to the rider only by a code.
• Never included: riders under 18, whose data is never used and who are never asked; rides from Strava; and anything recorded in a team or studio that has chosen to keep its data out.
• Changing your mind: in your profile, at any time. From then on your data is left out of new models. Models already built are not rebuilt, because what a model has learned cannot be taken out of it again; they hold no data that identifies you.

Diagnostics for support

When data from a watch, ring, band, scale or connected service does not arrive as it should, Velograph's support can find out why from a log of how it arrives. The log is kept only for people who choose to share it.

• Only with your explicit consent, given under your profile, for 14 days or until you stop it. It is a choice of its own: these terms do not give it, and saying no changes nothing else. The answer, and every change to it, is recorded with the words you were shown.
• What is logged: which app wrote which kind of data to the phone's health app, how many readings and for which days, what the app sent, what Velograph kept and where, what each connected service delivered, and every error on the way. When you turn it on, the app's log of the last 14 days goes along.
• What is never logged: the readings themselves, such as heart rate, HRV, sleep times, weight or routes.
• Who reads it: Velograph's own support staff, to help you and to make the connections better. Each time a log is opened, it is written to Velograph's audit log. It is never sent to an AI, used for advertising or given to anyone else.
• How long: each entry is kept for 30 days. When you stop sharing, everything logged is deleted.

5. How the AI features use your data

Velograph's AI features explain rides, answer questions in Ask Velograph, write status reports and draft training and race plans. This is what happens when they run:

• What the AI reads: only what the request needs and what the person asking may see: rides and their numbers, plans, races, thresholds and what people wrote, labelled as measured or as written. Output is always marked as AI and never replaces what a person wrote.
• Where it runs: at Anthropic (Claude) or OpenAI, on Velograph's key, the workspace's or the rider's own. They receive only the data for that request and, under their commercial terms, do not train their models on it. Velograph does not use AI conversations to train anything.
• Rides from Strava are never sent to an AI, as Strava's terms require.
• Rides from Garmin are sent to an AI only after the rider's explicit yes, given on the Garmin card in their profile, as Garmin's terms require. Without it they are still analysed and shown to the rider and their coaches; only the AI leaves them out. The rider can withdraw the yes on the same card at any time, and from then on no Garmin ride of theirs reaches an AI.
• Workouts from Apple Health and Health Connect are sent to an AI only after the rider's explicit yes, asked separately in the app; without it they are still analysed and shown, and the AI leaves them out. The yes can be withdrawn at any time. Wellness from the phone's health app (sleep, HRV, resting heart rate, breathing) is not sent to an AI at all.
• AI apps outside Velograph (Claude, ChatGPT and others a person connects to their account) receive what that person may see, except rides from Strava, Garmin, Hammerhead, Wahoo, Polar and Suunto and workouts from the phone's health app, which are never passed on to them.
• Velograph's own models are separate and need their own consent; see section 4.

6. Why we use your data, and on what basis

• To provide Velograph - accounts, analysis, planning, bike fits, AI features you use, support: because it is necessary for our agreement with you.
• Health-related data: on the rider's explicit consent (section 3).
• Building Velograph's own models: on the rider's explicit consent, asked separately (section 4).
• Security and improvement - preventing misuse, fixing faults, understanding which features are used: our legitimate interest in a safe, working service.
• Product statistics - learning which pages and features are used and where people get stuck, to make Velograph better: your consent, asked for in the cookie question and never assumed. They hold no training or health data, and you can withdraw your consent at any time in your profile or the cookie settings.
• Counting visits to public pages - learning how people find Velograph and which ways bring the people who sign up: our legitimate interest in knowing where Velograph is found. Only daily totals are kept, nothing is stored on your device, and your IP address is never stored.
• Payments and bookkeeping: our agreement with you, and our legal obligation to keep accounting records.
• Emails about your account - invitations, receipts, security, changes to these terms: our agreement with you. We do not send marketing without your consent.

7. Who can see your data

• In Velograph: each role sees only what it needs, in the workspaces it belongs to. A rider's Passport is shown to a team or studio only when the rider allows it. Of rides that come only from Strava, coaches see only that a ride happened; the details are shown only to the athlete, and the rides are never sent to an AI provider. Ask Velograph conversations are private unless the person who started one shares it.
• Rides you share on your profile are seen by whom you choose (everyone, or approved followers): a drawing of the route without the first and last kilometre unless you show them, never a map, with power and heart rate only if you tick them. If you are 18 or over and also tick "Let others ride it", whoever sees the post can ride that ride on their trainer, against you: its road on a map (without the first and last kilometre when those are hidden) and your speed along it, with power and heart rate only as you show them; your FTP is never used. Taking the tick back on the post, or deleting the post, ends it.
• Velograph support sees a workspace only when its owner or a manager grants access, for a limited time, read-only and recorded. Support never reads AI conversations.
• Service providers who process data for us, under contracts that bind them to our instructions and to confidentiality:
  • Hosting and database: DigitalOcean, in its Frankfurt data centre in Germany.
  • Payments: Stripe (Stripe Payments Europe, Limited, in Ireland), our payment service provider, which stores and charges cards.
  • AI: Anthropic (Claude) and OpenAI, when an AI feature is used, whether on Velograph's key or a key you add. They receive only the data needed for the request, and under their commercial terms do not use it to train their models.
  • Email delivery, for invitations, receipts and account messages.
• Platforms you connect, such as intervals.icu, Strava, Garmin, Hammerhead, Wahoo, Polar and Suunto, and apps you let send rides to Velograph, exchange data with Velograph as you authorise; their own privacy policies apply to them. Garmin's is at garmin.com/privacy/connect. Disconnecting a platform, here or on the platform's side, stops new data at once; rides already imported stay until you delete them.
• Weather for courses on the trainer comes from two public weather institutes, DMI (Denmark) and MET Norway. For a past ride, Velograph asks DMI for a weather station's measurements at the ride's time: a station number and a time, never where you rode or who you are. For a race ahead, it asks MET Norway for the forecast at a few points of the race's course, rounded to about a kilometre. Neither learns who asked.
• We share data with authorities only when the law requires it.

8. Data outside the EU

Velograph's servers and database are in the EU. AI providers and some other service providers may process data in the United States. Where they do, the transfer relies on the EU-US Data Privacy Framework, for providers certified under it, or on the European Commission's standard contractual clauses.

9. How long we keep data

• Account and workspace data: for as long as the account or workspace exists. An account you delete goes 30 days after you ask, the time you have to change your mind (deleting your account); a workspace you ask us to delete goes within 30 days.
• A rider's Passport stays with the rider when they leave a team or studio.
• Live rides from a Garmin Edge: never stored, only held in memory, and gone 20 minutes after the ride ends, or two hours after the Edge was last heard from. Which Edge is paired, and when it was last heard from: until it is unpaired. A wrong pairing code typed, with a hash of the network address it came from that changes every day: one day, to limit guessing.
• Ask Velograph conversations: until the person who started them deletes them, or the account is deleted.
• Accounting records, including payments and invoices: five years, as Danish bookkeeping law requires.
• Records of what you agreed to (terms, card authority, model training): for as long as the account exists and afterwards for as long as a claim could be made.
• Training copies made for building a model: deleted when the model is built, or within a year at the latest. A deleted account's data is left out of every model built afterwards.
• Security and error logs: a limited period, normally no more than a year.
• Usage counts and product statistics: 400 days, so one season can be compared with the last, then deleted. Withdrawing your consent to product statistics deletes what was counted under your code straight away.
• Visits to public pages: the codes that tell visitors apart are deleted after two days. The daily totals hold nothing about any person. How you found Velograph, if you signed up from a public page, is kept as long as the account.

10. Your rights

You have the right to see the data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a machine-readable form, and to withdraw any consent. Write to hello@velograph.ai; we answer within one month. If a team or studio controls the data, we pass your request on to them and help them answer it.

You can also complain to Datatilsynet, the Danish Data Protection Agency (datatilsynet.dk), or to the data protection authority where you live.

11. Security

Connections are encrypted, AI keys and connection secrets are stored encrypted, staff access is limited to what each person needs and protected by two-factor sign-in, and access by Velograph support requires the workspace's permission and is logged. No system is perfectly secure: if a breach puts your data at risk, we tell you and the authorities as the law requires.

12. Cookies and similar technology

Velograph uses what it needs to work, such as the cookie that keeps you signed in, and nothing else in your browser without your yes. The only thing it asks for is product statistics (section 2). There are no advertising or tracking cookies, and no other company sets cookies on Velograph's pages; fonts and the map library are served by Velograph itself. Map images come from OpenStreetMap, which sees your IP address when a page shows a map. Every cookie, what it does and for how long, and how to change your answer, are in the cookie policy.

13. Changes

When we change this policy in a way that matters, we tell you by email or in Velograph before it takes effect. The version in force and its date are shown at the top of this page.