Privacy

Version 3.0, effective 5 November 2026. Slovenska različica: Zasebnost.

1. Controller

The controller of personal data in Cycling Mentor is BeFly, oddaja nepremičnin, d.o.o. (BeFly d.o.o.), Ljubljanska cesta 38B, 1293 Šmarje-Sap, Slovenia, registration number 7475039000. Contact: info@befly.si. The service is for people aged 18 or older who open an account by signing up or receive one by invitation; the Terms of Use also apply.

2. Legal basis

• We process health, training and nutrition data on the basis of your explicit consent (Article 6(1)(a) and Article 9(2)(a) of the General Data Protection Regulation), which you accept on the dashboard; for Garmin Connect data we also ask for separate consent when you connect it.
• Processing of Garmin Connect data by artificial intelligence (section 12) only if you choose it with a separate box, on the basis of that separate explicit consent (Article 6(1)(a) and Article 9(2)(a)); the choice is not a condition of the service — without it no artificial intelligence processes that data.
• Automatic recording of your health screening outcome and opening of hard workouts (section 10) on the basis of this explicit consent (Article 9(2)(a)): by accepting this text you also explicitly consent to the code recording the clearance without a person. In our view this clearance is not a decision with legal or similarly significant effects under Article 22(1); if it were, it is based on this explicit consent (Article 22(2)(c)). You have the rights described in section 10 in any case.
• Reading body composition from intervals.icu (section 14) only if you choose it with a separate box, on the basis of that separate explicit consent (Article 6(1)(a) and Article 9(2)(a)); the choice is not a condition of the service — without it we do not read your body fat percentage from intervals.icu.
• We process the language and time zone you choose in the settings to perform our contract with you (Article 6(1)(b)): we write to you and show the dashboard in that language and put workouts and reminders on the right day and time.
• We process your e-mail address, Telegram identifier and sign-in data (including the hashed record of your password, if you set one) to perform our contract with you (Article 6(1)(b)); that is why we use them before consent, to open your account and let you sign in.
• We process the identifiers of your accounts, permissions and access tokens at the services you connect, and your MyWhoosh e-mail address and password if you connect it, for the performance of our contract with you (Article 6(1)(b)): without them the connection you choose is not possible.
• We process sign-in records with IP addresses, including failed sign-in attempts, program logs and error records on the basis of our legitimate interest in the security of the service and of your account and in detecting abuse (Article 6(1)(f)).
• We process consent records and the audit trail on the basis of our legitimate interest in demonstrating compliance and defending legal claims (Article 6(1)(f), and Article 9(2)(f) for health data in them).

Health and training data are not a legal requirement, but the service needs them: without them the coach cannot plan your training. You can withdraw consent at any time; withdrawal does not affect the lawfulness of processing before it.

3. What data we process

• Rides and workouts: power, heart rate, cadence, duration, distance, training load, FTP, perceived effort and the ride file, which can contain the GPS track of your route; from Garmin Connect also activity details, manually edited activities and automatically detected movement (Move IQ).
• Wellness and health: HRV, resting heart rate, sleep, readiness, from Garmin Connect also Garmin's stress score, VO2max and other Garmin performance metrics, daily steps, short movement intervals during the day (epochs), blood oxygen saturation, respiration rate, health snapshot (a short measurement of several values at once on a Garmin device), blood pressure and skin temperature, a short weekly check-in (energy, sleep, mood, libido, hunger, overeating, pain and infections, and menstruation for women), the outcome of the PAR-Q+ questionnaire in the guide (you fill in the official form on its own site; we store only the outcome category and the date) and your answer to the guide's question about a training break.
• Weight and body composition.
• Settings: language and time zone, which you choose (we pre-fill them from your browser settings and store them only once you confirm them).
• Nutrition: what you write about food, and photos you send, for example of meals (we do not store the photo, only a short description).
• Conversation: your messages in Telegram and the coach's replies.
• Profile: height, age, sex, goals (including target weight), available time, equipment and devices, camp location and terrain, lean mass, ingredients you avoid, and notes. We do not store an age under 18: we record only the day it was entered, as a flag because of which a person records your health screening outcome (section 10).
• Connections: your account identifier and permissions at the services you connect, and the access tokens for them; for MyWhoosh, if you connect it, also the e-mail address and password of your MyWhoosh account (section 16).
• Account: e-mail address, the identifier of your Telegram chat, your password if you set one (we keep only its one-way hashed record, from which the password cannot be read directly), and sign-in records with time and IP address, including failed attempts, which we keep to protect your account against break-ins.

The content of messages that the code recognises as a health warning is neither stored nor sent to the language model.

For the annual report we send to the authors of the questionnaire (PAR-Q+ Collaboration) as a condition for using it, on the basis of this consent we count the outcome categories of your health screening (PAR-Q+ and ePARmed-X+) for each 12-month period. If you withdraw consent or delete your account, we subtract your outcomes from every period whose report has not yet been sent. In reports already sent they remain only as part of a total from which you cannot be identified. The report shows the breakdown by category only when every category has at least 5 riders. Otherwise it shows only how many riders were screened, and only if there are at least 5.

Separately from this consent and not based on it: the time you recorded an outcome and the time it was confirmed (by the code or by a person) or reset are kept with your account's internal label in the alert and audit records for 5 years, also after your account is deleted, like the rest of the audit trail. These records hold neither answers nor the outcome category, but the confirmation record shows that your outcome was confirmed and whether the code or a person confirmed it. We keep in the same way the time you choose or withdraw the processing of Garmin Connect data by artificial intelligence or reading body composition from intervals.icu, the time of the confirmation when you connect Polar, and the time of a request for human review.

4. Where the data comes from

From your intervals.icu account (rides, wellness, training settings and, if you choose it, the body fat percentage your scale sends there), from Withings if you connect it (weight and body composition), from Garmin Connect if you connect it (activities and daily health values), from Rouvy, Wahoo, Polar, Hammerhead, Suunto or MyWhoosh if you connect them (rides), from Telegram (your messages) and from what you enter yourself on the dashboard, in the guide or in the chat.

5. What for

To plan your training and adapt it as you go, to assess readiness and training load, for nutrition advice, for the conversation with your coach in Telegram, for the dashboard, for sending planned workouts to the services you connect and for the safety check before intense training; language and time zone to set the language of messages and the dashboard and the correct day and time of workouts and reminders.

6. Where it is kept and how it is protected

In a separate database for you only, on a server in the EU managed by BeFly; today this is a Mac computer. The database is encrypted; every account has its own key, kept in this Mac's key store (Keychain). An export we prepare on the Mac at your request and accepted suggestions from the occasional review of how the coach is helping you are stored unencrypted in your folder; these two folders are excluded from the Time Machine copies on the external disk, but stay in the Mac's local snapshot of the whole disk for up to 24 hours.

Encryption protects copies of your database and files that leave the Mac without the key: someone who has only a copy cannot read it. It does not protect the running Mac, because the program on it opens the database. It does not protect a stolen Mac or its disk: the disk is not encrypted, and the Mac signs in automatically at start-up, which unlocks the key store.

Your password, if you set one (password sign-in is available from 27 November 2026): we do not keep it in readable form and do not send it to services that check for leaked passwords; we check it only against a list of commonly used passwords that is part of the program. After too many wrong attempts, password sign-in is closed: for your account for at most 24 hours, for the same network address for at most one hour. You can reopen it for your account earlier by resetting your password; meanwhile you can sign in with a code by e-mail or with a link from Telegram (/prijava).

7. Copies

All copies are in the EU.

• Every day the Mac makes a copy of your database, encrypted with the same key; we keep it for 14 days.
• Time Machine (macOS backup) copies the Mac to a network disk on the same local network; the copies contain your encrypted database and the key store, which is locked with the Mac's sign-in password. Under Apple's rules it keeps hourly copies for the past 24 hours, daily copies for the past month and weekly copies for all previous months; it deletes the oldest when the disk is full. On the Mac itself Time Machine also takes a local snapshot of the whole disk every hour and keeps it for up to 24 hours.
• Time Machine copies also contain the account register (email address, Telegram identifier, sign-in records with IP address and the audit trail). Its key is the key of the whole database, so it remains when you are deleted; an encrypted copy of this key is also kept on our backup server (VPS), so that we can restore the system if the Mac were lost. We do not open these copies or restore your data from them, except in a system restore, after which we repeat your deletion (see Deletion in section 19). We do not use older copies of the register for any other purpose.
• We do not copy your database to another server.

8. Who else receives data

Our processors:

• OpenRouter (OpenRouter, Inc.) and the language model providers it forwards requests to: the conversation, photos and summaries of your data (section 10).
• Cloudflare: all dashboard traffic for app.cyclingmentor.com passes through its network, including your IP address. Because the encrypted connection to the dashboard ends in Cloudflare's network, Cloudflare can technically see the content of requests, including your password at sign-in and links from e-mails; as a processor it may use them only to forward the traffic. The service's outbound traffic on the Mac goes through the Cloudflare WARP service, except connections to our backup server (VPS) and to the Cloudflare network that carries the dashboard, which we exclude from the tunnel; Cloudflare sees which servers the service talks to, but not the content of encrypted connections.
• Microsoft: sends e-mail to your address with your invitation, a link to confirm your signup, a link to set or reset your password, a sign-in code or a Telegram link, and sends a notice to the person at BeFly who runs Cycling Mentor to a BeFly mailbox (section 10); we keep no copy among sent items.
• The provider of our server in the EU (VPS): it holds encrypted daily copies of BeFly's management database (with the erasure list and error records; see section 18), an encrypted copy of the keys of that database and of the account register, and a copy of the program code with its settings, which contains in plain text the sign-in email addresses of the person who runs the service and of people with view access to their dashboard; the provider has no key with which it could open the encrypted copies.

Independent controllers of your own accounts (we send data there on your instruction; their privacy policies apply):

• intervals.icu: we read rides, wellness, training settings and, if you choose it, body fat percentage from it (section 14); we write planned workouts, the weight and sleep you report in the chat, weight from Withings, the perceived effort of a ride, FTP and maximum heart rate to it.
• Withings, if you connect it: we read weight and body composition from it and write nothing to it.
• Garmin Connect, if you connect it: we receive activities and daily health values from it and write the planned workouts you confirm to it (section 11).
• Rouvy and Wahoo, if you connect them: we read rides from them and write planned workouts to them (section 13).
• Polar (Polar Electro Oy), if you connect it: we read rides from it and write nothing to it (section 15).
• Hammerhead (Karoo devices), if you connect it once the connection is available: we read rides from it and write planned workouts to it.
• Suunto, if you connect it once the connection is available: we read rides from it and write nothing to it.
• MyWhoosh, if you connect it: we sign in to your account with your MyWhoosh e-mail address and password, read rides from it and write nothing to it (section 16).
• Telegram: messages between you and the coach, workout files and sign-in links.

9. Transfers outside the EU

Under its privacy policy OpenRouter transfers data to servers in the United States and to other countries outside the EEA. The data processing agreement with OpenRouter is part of its terms of service (section 10.2); transfers outside the EEA rest on the EU Standard Contractual Clauses, Module 2 (controller to processor, section 13.2 of the agreement); its list of sub-processors is Schedule 3 of the agreement at trust.openrouter.ai. For the conversation, training questions and the weekly review we use Claude models; the providers of these models are headquartered in the United States. We do not restrict the choice among them, except for Garmin Connect data if you choose its processing by artificial intelligence: those requests are taken only by providers headquartered in the EU or the United States that do not keep prompts (section 12).

Cloudflare and Microsoft are companies headquartered in the United States and may also process data outside the EU. We send data to Telegram, Garmin, Rouvy, Wahoo, Polar, Hammerhead, Suunto, MyWhoosh and the other independent controllers on your instruction; their privacy policies apply, including to their transfers outside the EU.

10. Artificial intelligence, profiling and automated decisions

Numbers (training load, rest, calories, safety limits) are computed by code. A language model writes the coach's messages and explanations within the limits the code sets; its answer can be wrong. The conversation, training questions and the weekly review run on Claude models (Anthropic) through OpenRouter.

The model receives your message and the recent messages of the conversation, a photo if you send one, your profile and summaries: training load, weight, readiness (level and reason, no raw measurements), plan and nutrition; for an occasional review of how the coach is helping you, also your messages from the last 28 days. The model does not receive data we receive through our own Garmin Connect connection or anything derived from it, unless you choose so separately (section 12). Rides from Rouvy, Wahoo (once available), Polar and MyWhoosh, and rides, HRV and sleep that intervals.icu imports from any device or service, including your Garmin Connect account, we process like other ride and wellness data, including with the language model. We keep rides from Hammerhead and Suunto in your database, but the language model does not receive them.

Every request is set so that only providers that do not collect data may take it (data_collection: deny); under OpenRouter's rules this means they do not use your data to train models. It does not mean they do not keep it: for these requests we have not switched on zero data retention (ZDR), and some providers keep prompts for a while, Anthropic for example for 30 days. OpenRouter itself does not train models on your data. The language model does not decide on clearing your health screening.

Profiling: from your data, code and the model build an assessment of readiness and training load and a training plan. Hard workouts are unlocked by the clearance of your health screening, which is valid for 12 months when the questionnaire clears you without further assessment, and for 6 months after an assessment by a professional or a physician. A message in which the code recognises a heart warning (for example chest pain) or a pregnancy invalidates the clearance; then complete the questionnaire again and record the new outcome; if you answer NO to every question, the code records it again without a person. The code can also recognise a warning in a message that does not contain one (for example ‘I have no chest pain, just tired legs’); in that case complete the questionnaire again or ask for a review. After any other change in your health, complete the questionnaire again.

• Automatic recording of the outcome: whenever the official questionnaire says you may start, the code records your outcome at once and without a person and opens hard workouts. The outcome is your declaration; the code does not verify it or carry out a medical assessment, and the PAR-Q+ Collaboration does not endorse our procedures. One exception: while a flag is recorded that an age under 18 was entered, the person who runs Cycling Mentor records the outcome; an outcome the code recorded before the flag is revoked by the code. The questionnaire says you may start when you answer NO to every PAR-Q+ question or ePARmed-X+ clears you without further assessment. If you answer "yes" to the guide's question about a training break, the code still clears you and itself records your re-entry day by the same rule a person uses: from that day your re-entry weeks are counted, in which the plan increases your training load more gradually. No one reviews these outcomes unless you ask for a review (below, Your rights for these decisions). Automatic clearance applies to an outcome that is waiting for clearance when you accept this consent and to all later outcomes.
• Clearance by a person: when the questionnaire refers you to a qualified exercise professional or a physician, the person who runs Cycling Mentor clears you once you record the approval. That person looks at the outcomes, dates and the answer about a break recorded since the last clearance, checks that the questionnaire's pathway is complete and that an approval is recorded after the referral, and after a "yes" about a break records your re-entry day by the same rule as the code. They do not see your answers to the questions, because we do not store them, and make no medical assessment.
• Automatic closing: the code also closes hard workouts by itself, without a person — when you record YES or an outcome that does not clear you, or when the code recognises a heart warning or a pregnancy in your message (above); it removes hard workouts already in your calendar, lighter workouts stay. An expired clearance and a recorded clearance with limitations or with required supervision do not close hard workouts: the plan does not adapt to your limitations or to a requirement for supervision, and after a clearance expires it still contains hard workouts. If you were cleared with limitations or only for supervised activity, you adapt the workouts yourself or do them under supervision. You then get a notice that you train at your own risk and should seek medical advice if in doubt; the notice does not limit BeFly's liability as provided by law.
• Your rights for these decisions: at any time you can ask a person to review a decision on clearance, invalidation or closing (on the dashboard under Account, Consent, or at info@befly.si), state your point of view and contest it. The review is carried out by the person at BeFly who runs Cycling Mentor and who may change the decision. That person looks at what has been recorded since the last clearance and at your point of view, explains what the decision was based on (your recorded outcome and the questionnaire's rule) and changes it if needed. You get an answer by e-mail within 7 days, at the latest within one month; until then hard workouts stay as they are. You cannot switch automatic clearance off separately: you can ask for a review of any decision or withdraw your whole consent.
• Notice to the person who runs Cycling Mentor: when your PAR-Q+ outcome is waiting for a person, when you record a clearance with limitations or with supervision, or when you keep training after your clearance has expired, BeFly informs the person at BeFly who runs Cycling Mentor. The notice does not contain your name, your outcome or your answers. It goes by e-mail through Microsoft to a BeFly mailbox, where we keep it for 30 days, and to the Telegram of the person who runs Cycling Mentor. The notice is not a review or supervision of your training. BeFly does not change your plan on its basis. You can ask for a review by a person under Account.

We make no other decisions based solely on automated processing that have legal or similarly significant effects on you.

11. Garmin Connect

Optional, once the connection is available. You connect your own Garmin Connect account on Garmin's authorization page; we never see your Garmin password. When you connect, we ask you separately for consent to this data. Garmin is an independent controller of your Garmin Connect account.

• What we receive, once reading is available, and why (each type only if you select it with us when you connect, none is preselected, and allow it in Garmin Connect): completed activities with file (type, time, duration, distance, power, heart rate, cadence and the activity file, which can contain the GPS track of your route), activity details and manually edited activities — to calculate load, fitness and fatigue and adjust your plan, edited ones so that we calculate with corrected values; daily summaries (resting heart rate and steps) — resting heart rate to assess recovery and readiness, steps for display on your dashboard; sleep and HRV — to assess recovery and readiness; body composition — for lean mass and the lower energy limit in nutrition advice; stress, user metrics (VO2max), automatically detected movement (Move IQ), epochs (short movement intervals during the day), pulse oximeter (blood oxygen saturation), respiration, health snapshot (a short measurement of several values at once on a Garmin device), blood pressure and skin temperature — only for display on your dashboard, without interpretation and without effect on the plan; next to blood pressure and blood oxygen saturation it says that we do not monitor or interpret these values or alert you about them and that you should seek medical advice about health questions; your Garmin Connect account identifier and the permissions you give Cycling Mentor — to run the connection.
• Numbers are calculated from this data by code (load, readiness, recovery, safety limits). The language model receives neither this data nor the numbers the code calculates from it, unless you choose this (section 12).
• We do not request women's health data (menstrual cycle, pregnancy) from Garmin. If Garmin sends it anyway, we discard it on receipt and do not store it. We discard any other type not listed here in the same way.
• What we send: we write the planned workouts you confirm to your Garmin Connect calendar (workout name and description with cues, steps with power targets in watts computed from your FTP and cadence targets, and the workout day); before the first upload we point this out to you separately. Workouts Garmin already has stay in Garmin Connect after you disconnect or delete your account with us, until you delete them there.
• What for: only to coach you (training load, fitness, fatigue, readiness, planning) and for display on your dashboard. We do not sell Garmin Connect data, do not share it with anyone for their own use, do not share it with data brokers or analytics and advertising tools, and do not use it for advertising.
• Who receives or processes it: hosting is a server in the EU managed by BeFly (today a Mac computer with Time Machine copies, sections 6 and 7); there is no external hosting provider for this data. It is also received or processed by Cloudflare (Garmin's deliveries to our server and the dashboard traffic pass through its network, processor), Telegram (coach messages can carry values computed from it; the language model receives these messages as part of the conversation only if you choose processing by artificial intelligence) and Garmin (planned workouts). OpenRouter and the language model providers receive it only if you choose its processing by artificial intelligence (section 12). intervals.icu, Withings, Rouvy, Wahoo, Microsoft and the provider of our backup server do not receive data we receive through our own Garmin Connect connection or values derived from it. There are no other recipients.
• Retention: like your other ride and health data in your database, until your account is deleted, with the copies and periods in sections 7 and 18. When you disconnect, we delete the account identifier, the permissions and the access tokens; if we cannot deregister at Garmin at once, we keep a copy of the tokens only to retry the deregistration, for 24 hours after you disconnect (usually we delete it sooner); if the service is not running when that period ends, we delete it the first time it runs after that, without another deregistration attempt. Data received before you disconnect stays in your database until your account is deleted, unless you ask us to delete it earlier (info@befly.si).
• Disconnecting: you can disconnect at any time on the dashboard (Connections) or in Garmin Connect; after that we receive nothing more and send nothing more. When you withdraw consent or delete your account, we disconnect for you.
• Your rights for this data: access and export on the dashboard (Account), correction of device values in Garmin Connect or through info@befly.si, deletion by deleting your account or, on request, of the Garmin Connect data only, restriction and objection at info@befly.si, withdrawal of consent on the dashboard or with the /preklici command, and withdrawal of processing by artificial intelligence under Account (section 12).

12. AI transparency statement (Garmin Connect data, optional, once the choice is available)

• By default no artificial intelligence processes this data: data we receive through our own Garmin Connect connection and anything derived from it (numbers, summaries, coach messages, conversation logs) is not sent to the language model or any other artificial intelligence service.
• Only with separate explicit consent: with a separate box under Account that is unticked by default you can choose that the coach also uses it in the conversation. Before you choose, no artificial intelligence processes it. The choice is not a condition of the service: you connect and use Garmin Connect without it too, only the coach does not know this data in the conversation.
• Nature and purpose: if you choose it, the Claude language model (Anthropic) through OpenRouter receives, in the conversation and for training questions, summaries that the code prepares from this data, in the same way as summaries from intervals.icu (section 10), so that it can explain your rides, wellness and plan and advise you. A part of the service for which no zero-retention provider is available (today the weekly review) does not receive this data. Training numbers and safety limits are still computed by code; the model does not decide on clearing your health screening.
• Who then receives it: OpenRouter (OpenRouter, Inc., United States) and only model providers headquartered in the EU or the United States that do not keep prompts (zero data retention, ZDR) and do not collect data (data_collection: deny): today Google (Vertex AI) and Amazon Web Services (Bedrock), both headquartered in the United States; they may also process data outside the EEA. We do not use the GLM model or providers headquartered outside the EU and the United States for this data. The transfer outside the EEA rests on the Standard Contractual Clauses with OpenRouter (section 9).
• No training: we do not use this data or anything derived from it, and do not pass it to anyone, to train, test, evaluate, benchmark or improve artificial intelligence models or systems; we do not put it into training or evaluation datasets, do not build an artificial intelligence knowledge base from it and do not keep it in any way that would enable that later. It does not go into the occasional review of how the coach is helping you or into tests of the coach. The same applies to prompts, responses, summaries and conversation logs that contain this data or are derived from it.
• Withdrawal: you can withdraw the choice under Account at any time, as easily as you give it, without a reason and without consequences for other parts of the service. From the withdrawal on, we send the model no more Garmin Connect data or anything derived from it, also not in the recent messages of the conversation. Withdrawal does not affect the lawfulness of processing before it. Withdrawing your whole consent, disconnecting Garmin Connect or deleting your account also ends the choice; when you reconnect or give consent again, the box is unticked again.
• Changes: we update this statement when the law, Garmin's rules or our use of artificial intelligence change; for any new use we ask for new consent (section 20).
• The statement does not apply to data that intervals.icu imports from your account through the Garmin Connect link you set up in intervals.icu: we process those like other intervals.icu data, including with the language model (section 10). If we receive the same ride both ways, we treat it as Garmin Connect data.

13. Rouvy and Wahoo

Optional, once the connection is available. You connect your own Rouvy or Wahoo account on that service's authorization page, only if you choose to; we never see your password. Rouvy and Wahoo are independent controllers of your accounts: we send data to them on your instruction, and their privacy policies apply (Rouvy, Wahoo).

• What we read: completed rides (time, duration, power, heart rate, cadence, training load and the ride file, which can contain the GPS track of your route), from your profile only FTP if you allow it (we do not store other profile data), and your account identifier and the permissions you give when you connect.
• What we send: planned workouts (steps with power and cadence targets, cues and the workout day).
• We process rides from Rouvy like other ride data, including with the language model (section 10). The language model receives rides from Wahoo once this is available; we publish this on this page with a date. We keep rides from both in your database until your account is deleted.
• You can disconnect at any time on the dashboard or in that service's settings; after that we read and send nothing more and delete the access tokens. Workouts we have sent stay in Rouvy or Wahoo until you delete them there.

14. Body composition from intervals.icu

Optional, once available. If your scale that measures body composition sends your body fat percentage to your intervals.icu account (directly or through another service), we read it from there, only for a day on which intervals.icu also has a new weight measurement; we discard a value outside the range from 3 to 60 %. From the percentage and the weight of the same day we compute fat mass and lean mass. intervals.icu does not send muscle, bone or water mass, and we do not read them. If the same day already has body composition from Withings, we keep that one.

• What for: from the lean mass of all scales over recent days the code computes one value, writes it to your profile and uses it to compute the lower energy limit in nutrition advice. The dashboard shows body fat percentage, fat mass and lean mass. The language model receives only lean mass, as part of your profile; we do not send it your body fat percentage or fat mass. Because it also receives your weight, these can be approximately derived from the two values.
• Retention: in your database until your account is deleted, with the copies and periods in sections 7 and 18. We write nothing to intervals.icu because of this.
• Optional: you switch this reading on with a separate, unticked box under Account (at any time after you accept this consent) and can switch it off there at any time, as easily as you switched it on. Without this choice we do not read your body fat percentage from intervals.icu; weight and other intervals.icu data stay. After you switch it off we read nothing more; values already read stay in your database until your account is deleted, unless you ask us to delete them earlier (info@befly.si). The choice also ends when you withdraw the whole consent, accept a new version of the consent or delete your account; after that the box is unticked again.

15. Polar

Optional, once the connection is available. You connect your own Polar Flow account on Polar's authorization page, only if you choose to; we never see your Polar password. Polar Electro Oy is an independent controller of your Polar account: its privacy policy applies (Polar).

• What we read: cycling sessions you upload to Polar Flow after you connect (Polar does not give older ones), at most 30 days back: the sport, start, duration and the session file, from which we read time, heart rate, cadence, power, speed and the session summary; we do not read the GPS track or altitude from it. We do not store sessions of other sports. We also store your Polar account identifier and the access token. We do not read sleep, Nightly Recharge or daily activity from Polar. When you register and when we check the connection, Polar also sends us your first and last name, date of birth, sex, weight and height; we do not store these.
• What we send: when you connect, we register you with Polar as a user of our application, with an identifier that contains neither your e-mail address nor your account's internal label with us; apart from revoking access (below) we send nothing else. Polar thereby learns, as it already does from the authorization on its page, that your Polar account uses Cycling Mentor.
• Artificial intelligence: we process rides from Polar like other rides, including with the language model through OpenRouter (section 10). Polar's rules require your explicit permission before we pass Polar data on: you give it by accepting this consent and by a separate confirmation when you connect Polar (an unticked box without which the connection is not made). If you do not want the language model to receive your rides from Polar, do not connect Polar; the service works without it. We do not train artificial intelligence models on Polar data and do not give it to anyone for their own purposes.
• Retention and disconnecting: we keep rides from Polar in your database until your account is deleted. You can disconnect at any time on the dashboard (Connections) or in Polar Flow; after that we read nothing more. When you disconnect on the dashboard, withdraw consent or delete your account, we delete the token and also revoke the access at Polar. If our agreement with Polar ends, we delete the rides and other data received from Polar from your database, as that agreement requires; we tell you in advance where possible so that you can export them first.

16. MyWhoosh

Optional, once the connection is available. MyWhoosh has no official connection for applications such as Cycling Mentor. Our connection therefore uses the same access as the MyWhoosh app: with your MyWhoosh e-mail address and password it signs in to your account, reads the list of your rides and downloads their files. MyWhoosh does not support this connection and can disable it at any time. MyWhoosh's terms allow only personal and private use of the service and prohibit automated data collection, for example by robots. Our connection reads your account automatically, so MyWhoosh may restrict or close your account. We do not know whether or how it enforces this. If you do not want this risk, do not connect MyWhoosh; the service works without it. MyWhoosh is an independent controller of your MyWhoosh account: its privacy policy applies (MyWhoosh).

• What we keep and where: you enter your MyWhoosh e-mail address and password on the dashboard (Connections), only if you choose to. We keep them, together with the token MyWhoosh issues at sign-in, only in a separate key store on the Mac under your account: not in the database, not in program logs and not in the export.
• Why: MyWhoosh has no other access. We sign in with the e-mail address and password when you enter them and whenever the MyWhoosh token is no longer valid. If MyWhoosh rejects the sign-in, we try again at the next regular reading, at most once an hour; if we recognise from the response that the password is wrong, we stop signing in with it until you enter it again. If you change your MyWhoosh password, enter it again on the dashboard too, or disconnect MyWhoosh.
• Who can see them: because dashboard traffic passes through Cloudflare, Cloudflare can technically see this password too when you enter it (section 8). The person at BeFly who runs the Mac can technically read them (section 17). We keep your MyWhoosh e-mail address and password in a separate key store excluded from Time Machine backups on the external disk; when you disconnect, withdraw consent or delete your account we delete them, but they stay in the Mac's local snapshot of the whole disk for up to 24 hours (section 7). If the Mac were lost, you would need to enter them again. We recommend using a MyWhoosh password you do not use anywhere else.
• What we read: completed rides (start, duration, name and the ride file, from which we read time, heart rate, cadence, power, speed and the ride summary; we do not read the GPS track or altitude from it), up to 30 days back when you connect, and your MyWhoosh account identifier. We do not store other data from your account. We write nothing to MyWhoosh.
• We process rides from MyWhoosh like other rides, including with the language model (section 10), and keep them in your database until your account is deleted.
• Disconnecting: you can disconnect at any time on the dashboard (Connections). When you disconnect, withdraw consent or delete your account, we delete the e-mail address, password and token. We cannot revoke access at MyWhoosh without the password: if you wish, change your MyWhoosh password after disconnecting.

17. Who at BeFly sees your data

In the account overview the person at BeFly who runs the service sees the state of your account and connections and the date of your last ride; of health data they see only the type of PAR-Q+ safety event (an outcome waiting for a person, a clearance that has expired while you keep training, a recorded clearance with limitations or with supervision), not your answers; receives system alerts with your account's internal label; and sees the outcome of the PAR-Q+ questionnaire when clearing you for training after a referral; with automatic recording of the outcome only if you ask for a review or if needed to fix an error. Because that person runs the Mac, they can technically read all your data. No one else who uses Cycling Mentor sees your data.

18. How long

• Your data in the database: until your account is deleted.
• Hashed record of your password: as long as you have an account; a new password replaces it, and we delete it when your account is deleted.
• MyWhoosh e-mail address, password and token: as long as MyWhoosh is connected and your consent is valid; when you disconnect, withdraw consent or delete your account we delete them (the separate key store is not in the Time Machine backups on the external disk; they stay in the Mac's local disk snapshot for up to 24 hours).
• Daily copies on the Mac: 14 days.
• Sign-in records (codes, links for sign-in, signup confirmation and setting a password, sign-in attempts, IP address): once older than 30 days, we delete them at the next start of the dashboard or the next sign-in.
• Program logs (they carry your account's internal label; they are not encrypted): 90 days, then we delete them. Error records that the program writes about your account into BeFly's management database hold only the kind of error, and some also a label that changes every day, not your account's internal label or the error text. That label can be linked to your account only through the program log, so for at most 90 days, and after that by no one. This database has an encrypted copy on another server in the EU, which we do not delete.
• Audit trail and consent records: 5 years after you stop using the service, as evidence for possible claims within the limitation period.
• Erasure list (your account's internal label and the date): as long as a copy exists from which your data could come back. Because we do not delete the copies of BeFly's management database on our server, the label and the date also remain there afterwards.
• Time Machine: as described in section 7; the same applies to the account register and its key. We do not delete the encrypted key copies on the VPS: the register key can open the register's Time Machine copies and the live register, in which after deletion only what is listed below remains; the key of BeFly's management database can open that database's copies on the VPS (erasure list and error records).

After your account is deleted, the following remain until those 5 years run out: the row of your account in the register (internal label, without e-mail or Telegram), the record of this consent and of any withdrawals, the audit trail (who did what and when; it also holds the numbers of your intervals.icu and Withings accounts, settings changes with old and new values, and reasons the operator enters) and closed alerts, for example that you submitted the PAR-Q+ questionnaire. Lines with your account's internal label in program logs remain until their 90 days run out. In annual reports already sent to PAR-Q+ Collaboration your outcomes remain only as part of a total from which you cannot be identified.

19. Your rights

You have the right of access to your data, rectification, erasure, restriction of processing, data portability and the right to object to processing based on our legitimate interest.

• Export (access and portability): on the dashboard (Account) you can download your data in a JSON file at any time. The export does not contain the hashed record of your password or other security keys.
• Correction: you correct your profile on the dashboard or in the chat, rides and wellness in intervals.icu.
• Withdrawing consent: on the dashboard or with the /preklici command in Telegram. Processing stops at once; the data stays until deletion, and you can still read and export your dashboard. You withdraw only the choice of processing Garmin Connect data by artificial intelligence or of reading body composition from intervals.icu under Account, as easily as you give it. You withdraw your choice of an individual Garmin Connect data type under Account; we then stop storing that type and delete what we have stored. You cannot withdraw automatic clearance of your health screening separately; you can ask a person to review any decision about it (below).
• Human review of a decision about your health screening: under Account (Consent) or at info@befly.si; you get an answer by e-mail within 7 days, at the latest within one month (section 10).
• Deletion: request it on the dashboard or with the /izbrisi command in Telegram; we complete it within 7 days. When we delete, we at once delete your database and its copies on the Mac, sign-ins, connections and your key. Your encrypted copies in Time Machine thereby become unreadable to anyone without the Mac's sign-in password; because Time Machine also copies the key store, BeFly can still open them with the Mac's password until those copies expire. We cannot delete these copies one by one: until they expire we do not open them or restore your data from them. When a deletion starts, we write only your account's internal label and the date of deletion into a separate list, without your email or other data. If we ever have to restore the system from a copy, right after the restore we use this list to repeat your deletion in full (database, copies, key, folder). On request we also delete future Cycling Mentor workouts from your intervals.icu calendar; past ones stay. When we delete your account, we always delete our keys and access tokens for intervals.icu, Withings, Rouvy, Wahoo, Polar, Hammerhead and Suunto, and the MyWhoosh e-mail address, password and token. We also revoke the access at the service itself, but only where both the service and our connection to it support this: at Polar we do this ourselves; at intervals.icu, Withings, Rouvy, Wahoo, Hammerhead and Suunto we do not today, so please disconnect in each of them yourself; at MyWhoosh you revoke access by changing your password. We disconnect Garmin Connect for you when we delete your account; workouts we have sent to Garmin Connect, Rouvy, Wahoo or Hammerhead stay there until you delete them there. Messages stay in your Telegram app until you delete them.
• Restriction, objection and other questions: info@befly.si.
• Complaint: Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si.

20. Changes

For a new purpose of processing, new kinds of health data or of other data we process on the basis of consent, a transfer of health data to a country outside the EEA or a longer retention period, we ask for your consent again; until you give it, we do not process your data in the new way.

If you later accept a version of the consent that no longer includes a source from this version, from then on we read nothing more from that source; within 24 hours at the latest we delete the credentials and tokens for it (for MyWhoosh also the e-mail address and password, which stay in the Mac's local disk snapshot for up to 24 more hours) and, where the service allows it, also revoke the access there. Data already received from it stays in your database until your account is deleted; you can see it in the export, but we do not use it for workouts, advice, the dashboard or the language model. We delete it earlier if you ask us to (info@befly.si).

We tell you about other changes that affect you, namely a new processor, a new hosting provider with servers in the EU or EEA, new kinds of account data, or a change of contact details or of how you exercise your rights, by e-mail or in Telegram at least 30 days in advance; until then you can withdraw consent or request deletion, and if you request deletion before the date of the change, we do not move your data to the new provider. We use a shorter notice only when the change is urgent for security or a legal obligation; then we tell you at once and give the reason. Switching to another model of a provider already named in this consent, or dropping a provider, is not a change we tell you about in advance; we publish it on the Privacy page with its date.

Corrections that do not change the processing are published on this page with a date and version number; this page also keeps the current list of our processors (section 8).

A consent of version v4, given up to 5 November 2026 or while version v4 was again the current version, stays valid until you accept version v5 under Account. This page applies to it, except that with it the Polar and MyWhoosh connections and reading body composition from intervals.icu (sections 14 to 16) and the Hammerhead and Suunto connections are not available, and automatic recording of the outcome applies only if you choose it with the separate box under Account (otherwise a person clears your screening). The previous Privacy page (version 2.0), which describes consent v4, is at cyclingmentor.com/privacy/v4.

A consent of version v3, given up to 28 October 2026 or while version v3 was again the current version, stays valid until you accept a newer version under Account. This page applies to it, except that with it the Garmin Connect, Rouvy, Wahoo, Polar, Hammerhead, Suunto and MyWhoosh connections, reading body composition from intervals.icu, automatic recording of the outcome and the processing of Garmin Connect data by artificial intelligence are not available: a person clears your screening. The text of consent v3 says that the conversation runs on the GLM model. Since the morning of 28 October 2026 that is no longer so: the conversation with your coach, training questions and the weekly review run on Claude models (Anthropic) through OpenRouter, and the provider of the GLM model receives nothing. Anthropic was already named as a provider in consent v3. The Privacy page version 1.0, which describes consent v3, is at cyclingmentor.com/privacy/v3.

Cycling Mentor does not replace medical care.