Privacy Policy

v1.0.0-draft · 2026-05-10

Draft notice. This page is in pre-launch validation phase. Final wording will be reviewed before public launch with full legal entity details.

1. Data Controller

VeloTribe (currently operated by its founders as natural persons; a legal entity will be incorporated before commercial launch).

Contact: privacy@velotribe.com

2. Data Processor

OTN (Old To New) acts as technical data processor on behalf of VeloTribe under documented instructions, providing hosting and infrastructure for the waitlist platform.

3. Purposes & legal basis

We process your data with the following purposes:

Waitlist management — basis: your consent (Art. 6.1.a GDPR)
Launch communication — informing you when VeloTribe goes live (consent)
Product validation — aggregating optional Step 2 data to decide what to build (consent)

4. Data we collect

Step 1 (mandatory): email, cycling discipline (cyclists) or business name + type + location (hosts), IP address (hashed), user agent, locale, consent timestamp.

Step 2 (optional): country of residence, experience with Girona, dream trip categories, trip duration, free-text feedback.

We do not collect special-category data (Art. 9 GDPR). No automated decisions are taken based on your data.

5. Recipients

Cloudflare Inc. — hosting, D1 database, web analytics. Data stored in Western Europe region. EU SCCs and DPA apply.
Resend Inc. — transactional email delivery (welcome, updates). DPA in place.

We do not sell or share your data with any other third party.

6. Retention

We keep your data until product launch plus 12 months. If you withdraw consent, we delete your record within 30 days (except minimal audit logs kept for 6 years per Spanish civil law).

7. Your rights

You have the right to access, rectify, delete, restrict, port and object to the processing of your data, and to withdraw consent at any time. Exercise these rights at privacy@velotribe.com. We respond within 30 days.

You can also lodge a complaint with the Spanish Data Protection Authority (AEPD, www.aepd.es).

8. Security

Data is transmitted via HTTPS and stored in EU region (Cloudflare WEUR). IP addresses are hashed before storage.

9. Updates to this policy

This is version 1.0.0-draft dated 2026-05-10. Material changes will be notified by email.