Privacy Policy

1. Who we are

Velco (velco.cc) is a group-ride organising platform operated by Ferry Goyen, based in the Netherlands. If you have questions about this policy, email info@velco.cc.

2. What data we collect

We collect the following personal data when you use Velco:

• Account data — your name, email address, country and profile photo when you create an account.
• Ride data — rides you create or join, including date, time, route, pace and notes.
• GPX files — GPS route files you optionally upload to rides. These are stored and made available to other participants.
• Contact & emergency info — phone number and emergency contact you optionally add to your profile.
• Usage data — anonymised page views collected by Vercel Analytics (no cookies, no cross-site tracking).

We do not collect payment information, sell your data, or show you advertisements.

3. Why we use your data

• To provide the service (legal basis: contract) — creating and finding rides, showing participant lists, enabling group communication.
• To keep the service running (legal basis: legitimate interest) — detecting abuse, debugging errors, measuring performance.
• Safety (legal basis: legitimate interest) — showing emergency contact info to fellow participants on a ride, so someone can reach your next-of-kin if needed.

4. Who we share data with

We use the following sub-processors to operate Velco:

• Supabase (database & authentication) — data is stored in an EU data centre. Supabase is GDPR-compliant.
• Vercel (hosting & analytics) — the web app is served via Vercel's CDN. Analytics are cookieless and anonymised.

We do not share your personal data with any other third parties, advertisers or data brokers.

5. How long we keep your data

We keep your data for as long as your account is active. When you delete your account, all personal data — profile, rides you organised, GPX files and participation records — is permanently deleted within 30 days. Anonymised aggregate statistics (total ride counts etc.) may be retained.

6. Your rights (GDPR)

As a person in the EU/EEA you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data via your profile settings.
• Erasure — delete your account and all associated data using the "Delete account" button in your profile.
• Portability — request your data in a machine-readable format.
• Objection — object to processing based on legitimate interest.

To exercise these rights, email info@velco.cc. We will respond within 30 days.

7. Cookies

Velco itself does not use tracking cookies. Vercel Analytics collects anonymised, cookieless usage data. No consent banner is required for this type of analytics under Dutch law.

8. Security

All data is transmitted over HTTPS. Database access is protected by row-level security policies (Supabase RLS), meaning users can only access data they are permitted to see. Passwords are never stored — authentication is handled by Supabase Auth.

9. Changes to this policy

We may update this policy from time to time. We will notify registered users by email if changes are significant. The effective date at the top of this page always reflects the latest version.