Privacy

1. Data controller

DRIPSPIN S.R.L., registered at Str. Ghiosesti nr. 325, Oras Comarnic, Prahova, Romania, CUI 52790239, is the controller of personal data processed through Gritmo. Privacy requests can be sent to vladbeu@gmail.com.

2. Data we process

Depending on the features you use, we may process:

• account information, such as name, email address and authentication identifiers;
• rider profile information, including body mass and training preferences;
• cycling and performance data, including power, heart rate, cadence, speed, time, routes, location, elevation, workouts and derived performance estimates;
• activity files and data obtained from a service you choose to connect;
• trainer data needed during a session, such as connection state, capabilities, telemetry and control responses;
• technical, security and diagnostic data, such as browser, device, error and request information;
• messages and information you send when requesting support.

Cycling, heart-rate and performance data may reveal information about health and may qualify as special-category data under applicable law.

3. Why we use data

• to create and secure your account;
• to import, store, display and analyse rides and routes;
• to estimate rider performance and generate workout or pacing guidance;
• to connect to and control a compatible smart trainer when you request it;
• to diagnose failures, prevent abuse and improve reliability;
• to respond to support requests and meet legal obligations.

4. Legal bases

We process account and ordinary service data where needed to create your account and provide the Gritmo features you request under Article 6(1)(b) GDPR. We process limited security and diagnostic data under Article 6(1)(f) where necessary for our legitimate interest in protecting Gritmo and its users. We process data under Article 6(1)(c) when needed to comply with a legal obligation.

Cycling, heart-rate and derived performance data may constitute health data. Gritmo saves and uses that data in your account only after you give explicit consent for the ride history, analysis, Rider Model, workout and pacing features described when the choice is shown. This consent is the basis under Articles 6(1)(a) and 9(2)(a) GDPR for that account-scoped performance processing. Accepting the Terms or reading this notice does not provide consent.

You can withdraw consent in Data & Privacy settings. Withdrawal stops new cloud performance processing and deletes the saved performance bundle, including Activities, trainer and Course Ride history, Rider Model evidence, Coach Insights, saved workouts, and connected activity data. Your account and Courses you created remain. Deletion does not affect processing already carried out lawfully, and private file cleanup may finish shortly after the database deletion commits.

If you enable external AI editing for Coach Insights, Gritmo asks for a separate explicit choice before sending the minimized summary described below. We rely on your consent under Articles 6(1)(a) and, where that summary contains or reveals health data, 9(2)(a) GDPR. Declining does not remove the Rider Model or other non-AI features.

5. Connected services and device access

Connecting an external activity service is optional. When you connect one, Gritmo receives the profile, activity and stream data covered by the permissions shown during authorisation. Connection credentials are stored server-side and protected in transit and at rest. You can disconnect a service from your account settings and, where applicable, from the provider itself.

Web Bluetooth access requires a browser permission and a user action. Trainer communication occurs through the browser during the session. We store session or activity data only where a Gritmo feature expressly saves it.

6. Who receives data

We use service providers for hosting, databases, authentication, mapping, diagnostics and support. We share only the data needed for them to provide those services under contractual and confidentiality obligations. Data is also exchanged with a connected service when you request that integration.

We may disclose data when legally required, to protect users and the service, or as part of a corporate transaction subject to appropriate safeguards. We do not sell personal data.

6A. Local data and ride files

Guest rider-model data and recoverable trainer rides stay in this browser. Signing in does not automatically upload them. Where an account transfer is available, it begins only after you explicitly choose to save the selected data.

When you upload a FIT file, Gritmo parses it for the selected import, saves the normalized Activity and analysis data, and discards the original FIT bytes after processing. A later FIT export is generated by Gritmo from normalized saved data; it is not recovery of the original file.

6B. OpenAI editorial editing

Gritmo's engine analyzes your data and establishes the findings used throughout the product. OpenAI is used only as an editorial layer to turn those findings into clear Coach Insights. It does not calculate your Rider Profile or make physiological or training decisions.

Before the first request, Gritmo asks you to agree. Vercel AI Gateway sends OpenAI only a minimized, purpose-specific summary of findings. The Coach request does not include your name, email, authentication data, original ride file, raw activity stream, coordinates, route geometry, home, start/end location, or location-derived identifiers. API data is not used to train OpenAI models unless DRIPSPIN explicitly opts in. OpenAI normally retains request and response content for no more than 30 days for abuse monitoring; it may retain it longer where legally required or reasonably necessary to prevent harm. If you choose Not now, your Rider Profile and other product features remain available without Coach Insights.

6C. Cookies and browser storage

Gritmo V1 uses no advertising, marketing, cross-site tracking, or behavioral-profiling cookies. We use only storage needed for a feature you request:

• authentication, session, CSRF, OAuth-state, and security cookies;
• local browser storage for guest rider data, trainer recovery, and product preferences;
• temporary browser storage needed to complete a current flow.

You can clear local Gritmo data in the product or through browser/site-data controls. Signing out or session expiry ends applicable authentication cookies. Disabling necessary storage may prevent login, recovery, or local continuity from working.

6D. Aggregate launch measurement

Launch Pulse stores aggregate counters for bounded product actions and acquisition classes. These counters do not contain a user, session, device, cookie, browser-storage, IP-hash, or fingerprint identifier and are not used for person-level tracking. The Active riders total is calculated from existing account-owned product records for the selected period; it does not create a separate tracking identity.

7. International transfers

Some providers may process data outside Romania or the European Economic Area. Where required, we use an adequacy decision, standard contractual clauses or another lawful transfer safeguard.

8. Retention and security

• Account data is kept until you delete the account.
• Saved Activities, streams and derived performance data are kept until you delete them, withdraw performance-data consent, delete all performance data, or delete the account.
• The original bytes of an uploaded FIT file are discarded after the requested import is processed.
• Operational logs and support correspondence are kept only for the period needed to protect, diagnose and support the service or handle an active legal issue.
• Deleted data may remain temporarily in protected infrastructure backups until the provider's normal backup rotation removes it.

We use reasonable technical and organisational measures to protect personal data, but no online service can guarantee absolute security.

9. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. You may also complain to the Romanian National Supervisory Authority for Personal Data Processing or the competent authority in your country of residence.

Send requests to vladbeu@gmail.com. We may need to verify your identity before completing a request.

Account Settings provides self-service account export, Activity deletion, deletion of all saved performance data while keeping the login, complete account deletion, and local browser-data clearing. Private object deletion may finish shortly after the database deletion commits; protected backups expire through the stated backup rotation.

10. Changes to this notice

We may update this notice when Gritmo, our providers or legal requirements change. We will publish the new date and provide additional notice for material changes where required.