1. Controller
- Service provider
- Fynn van Rießen and Sasha Martinelle
- Postal address
- Edelweißstraße 4, 81541 München, Germany
- info@la-route.app
- Telephone or other direct contact
- info@la-route.app
- Public register and number
- No public register entry
The controller is the service provider named in the Legal Notice.
2. Data we process
- Account data — Email address, authentication identifiers, registration time and the legal-document versions recorded at signup.
- Profile and body data — Display name, weight, height, functional threshold power (FTP), nationality, biography, units and visibility choices.
- Ride and sensor data — Start and end time, duration, distance, elevation gain, Route, trainer name, power, cadence, speed and optional heart rate, both as summaries and time series.
- Created content — Worlds, Routes, landscape drafts and build records you create.
- Technical and security data — IP address, request time and type, browser and device information, security events and Turnstile challenge results.
Bluetooth permission and pairing are handled by your browser. Saved device identifiers and display preferences remain in your browser and are not uploaded as profile data.
3. Why we process data and our legal bases
We process account, profile, Ride, sensor and created-content data to create and secure your account, run Rides, save your history, provide account export and deletion, and operate the features you request. The legal basis is Article 6(1)(b) GDPR (performance of our Terms and steps requested before entering into them).
We process request, security and abuse-prevention data to keep the service reliable and protect accounts. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are service security, fraud prevention, fault diagnosis and the defence of legal claims.
Where we must retain or disclose information to meet a legal obligation, the legal basis is Article 6(1)(c) GDPR.
Training, body and heart-rate data may reveal information about your health. To the extent that they are special-category data, we process them on the basis of your explicit consent under Article 9(2)(a) GDPR. You may withdraw that consent at any time by emailing us or deleting your account. Withdrawal does not affect processing that was lawful before it, but la-route cannot provide its core Ride and history features without these data.
4. Service providers and recipients
| Provider | Primary location | Role |
|---|---|---|
| Supabase | Ireland (primary project region) | Account authentication, database and account deletion. Receives account, profile, Ride and created-content data. |
| Fly.io | Paris (primary app region) | Runs the application and processes requests, IP addresses and technical connection data. |
| Cloudflare | Global network | DNS, content delivery, attack protection and Turnstile bot checks. Receives IP address, request metadata and browser or device signals. |
| Resend | United States and subprocessors | Delivers account, confirmation and password-reset email. Receives email address and delivery metadata. |
These providers process data for us under their service terms and data-processing agreements. We do not sell personal data and do not use it for third-party advertising. We disclose data to public authorities only where law requires it.
5. International transfers
The main Supabase database is stored in Ireland and the app runs primarily in Paris. Some providers or their subprocessors are established outside the European Economic Area, including in the United States. Where Chapter V GDPR applies, transfers must rely on an applicable adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful safeguard. You may ask us for information about the safeguard used for a specific transfer.
6. How long we keep data
Account, profile, Ride, created-content and acceptance records are kept while your account exists, unless you delete an item earlier. Deleting your account removes the account and its product data from active systems; residual copies age out of provider backups according to their backup cycles.
Security and delivery logs are kept only for as long as needed to secure and operate the service, investigate incidents, meet legal duties and resolve disputes. The period depends on the type of log and the provider's configured retention. Browser preferences remain until you clear them; the offline Ride queue remains until a Ride is uploaded or the browser data is cleared.
7. Cookies and browser storage
We use an essential, HttpOnly session cookie so the application can recognise a signed-in request. Supabase stores the browser authentication session locally so it can refresh sign-in. We also use local storage for Ride display choices and paired-device identifiers, session storage for the sign-in return path, and IndexedDB for the offline Ride upload queue.
Cloudflare Turnstile runs on the sign-in and account-creation page to distinguish people from automated requests. It processes technical browser and device signals and returns a short-lived challenge result. We do not use advertising or analytics cookies.
8. Your rights
Subject to the conditions in the GDPR, you may request access, correction, deletion, restriction, portability or objection. You may withdraw consent at any time. Settings includes an account-data export and account deletion; you may also email info@la-route.app. We may need to verify your identity before acting on a request.
You may lodge a complaint with a data-protection supervisory authority, in particular in the EU country where you live or work, or where you believe an infringement occurred.
9. Required and optional data
An email address and authentication credentials are required for an account. The Ride measurements and essential profile values used by a selected feature are required to provide that feature. Biography, nationality, heart-rate connection and public visibility are optional. We do not use solely automated decision-making that produces legal or similarly significant effects.
10. Changes and contact
We will update this notice when the product or its data handling changes. If a change materially affects how we use your data, we will provide an appropriate notice and, where required, ask for consent again.
Questions and privacy requests: info@la-route.app.