Privacy
1. Controller
The controller of personal data in Cycling Mentor is BeFly, oddaja nepremičnin, d.o.o. (BeFly d.o.o.), Ljubljanska cesta 38B, 1293 Šmarje-Sap, Slovenia, registration number 7475039000. Contact: info@befly.si. The service is for people aged 18 or older who open an account by signing up or receive one by invitation; the Terms of Use also apply.
2. Legal basis
- We process health, training and nutrition data on the basis of your explicit consent (Article 6(1)(a) and Article 9(2)(a) of the General Data Protection Regulation), which you accept on the dashboard; for Garmin Connect data we also ask for separate consent when you connect it.
- We process your e-mail address, Telegram identifier and sign-in data to perform our contract with you (Article 6(1)(b)); that is why we use them before consent, to open your account and let you sign in.
- We process sign-in records with IP addresses, program logs and error records on the basis of our legitimate interest in the security of the service and in detecting abuse (Article 6(1)(f)).
- We process consent records and the audit trail on the basis of our legitimate interest in demonstrating compliance and defending legal claims (Article 6(1)(f), and Article 9(2)(f) for health data in them).
Health and training data are not a legal requirement, but the service needs them: without them the coach cannot plan your training. You can withdraw consent at any time; withdrawal does not affect the lawfulness of processing before it.
3. What data we process
- Rides and workouts: power, heart rate, duration, training load, FTP, perceived effort.
- Wellness and health: HRV, resting heart rate, sleep, readiness, a short weekly check-in (energy, sleep, mood, libido, hunger, overeating, pain and infections, and menstruation for women), the outcome of the PAR-Q+ questionnaire in the guide (you fill in the official form on its own site; we store only the outcome category and the date) and your answer to the guide's question about a training break.
- Weight and body composition.
- Nutrition: what you write about food, and photos you send, for example of meals (we do not store the photo, only a short description).
- Conversation: your messages in Telegram and the coach's replies.
- Profile: height, age, sex, goals (including target weight), available time, equipment and devices, camp location and terrain, lean mass, ingredients you avoid, and notes.
- Account: e-mail address, the identifier of your Telegram chat, sign-in records with time and IP address.
The content of messages that the code recognises as a health warning is neither stored nor sent to the language model.
For the annual report we send to the authors of the questionnaire (PAR-Q+ Collaboration) as a condition for using it, on the basis of this consent we count the outcome categories of your health screening (PAR-Q+ and ePARmed-X+) for each 12-month period. If you withdraw consent or delete your account, we subtract your outcomes from every period whose report has not yet been sent. In reports already sent they remain only as part of a total from which you cannot be identified. The report shows the breakdown by category only when every category has at least 5 riders. Otherwise it shows only how many riders were screened, and only if there are at least 5.
Separately from this consent and not based on it: the time you recorded an outcome and the time the operator confirmed or reset it are kept with your account's internal label in the alert and audit records for 5 years, also after your account is deleted, like the rest of the audit trail. These records hold neither answers nor the outcome category, but the confirmation record shows that your outcome was reviewed.
4. Where the data comes from
From your intervals.icu account (rides, wellness, training settings), from Withings if you connect it (weight and body composition), from Garmin Connect if you connect it (activities and daily health values), from Telegram (your messages) and from what you enter yourself on the dashboard, in the guide or in the chat.
5. What for
To plan your training and adapt it as you go, to assess readiness and training load, for nutrition advice, for the conversation with your coach in Telegram, for the dashboard and for the safety check before intense training.
6. Where it is kept and how it is protected
In a separate database for you only, on a server in the EU managed by BeFly; today this is a Mac computer. The database is encrypted; every account has its own key, kept in this Mac's key store (Keychain). An export we prepare on the Mac at your request and accepted suggestions from the occasional review of how the coach is helping you are stored unencrypted in your folder; these two folders are excluded from the Time Machine copies on the external disk, but stay in the Mac's local snapshot of the whole disk for up to 24 hours.
Encryption protects copies of your database and files that leave the Mac without the key: someone who has only a copy cannot read it. It does not protect the running Mac, because the program on it opens the database. It does not protect a stolen Mac or its disk: the disk is not encrypted, and the Mac signs in automatically at start-up, which unlocks the key store.
7. Copies
All copies are in the EU.
- Every day the Mac makes a copy of your database, encrypted with the same key; we keep it for 14 days.
- Time Machine (macOS backup) copies the Mac to a network disk on the same local network; the copies contain your encrypted database and the key store, which is locked with the Mac's sign-in password. Under Apple's rules it keeps hourly copies for the past 24 hours, daily copies for the past month and weekly copies for all previous months; it deletes the oldest when the disk is full. On the Mac itself Time Machine also takes a local snapshot of the whole disk every hour and keeps it for up to 24 hours.
- Time Machine copies also contain the account register (email address, Telegram identifier, sign-in records with IP address and the audit trail). Its key is the key of the whole database, so it remains when you are deleted; an encrypted copy of this key is also kept on our server (VPS), so that we can restore the system if the Mac were lost. We do not open these copies or restore your data from them, except in a system restore, after which we repeat your deletion (see Deletion in section 14).
- We do not copy your database to another server.
8. Who else receives data
Our processors:
- OpenRouter (OpenRouter, Inc.) and the language model providers it forwards requests to: the conversation, photos and summaries of your data (section 10).
- Cloudflare: all dashboard traffic for app.cyclingmentor.com passes through its network, including your IP address; the service's outbound traffic on the Mac goes through the Cloudflare WARP service, except connections to our server (VPS) and to the Cloudflare network that carries the dashboard, which we exclude from the tunnel; Cloudflare sees which servers the service talks to, but not the content of encrypted connections.
- Microsoft: sends e-mail to your address with your invitation, sign-in code or Telegram link; we keep no copy among sent items.
- The provider of our server in the EU (VPS): it holds encrypted daily copies of BeFly's management database (with the erasure list and error records; see section 13), an encrypted copy of the keys of that database and of the account register, and a copy of the program code with its settings, which contains in plain text the sign-in email addresses of the person who runs the service and of people with view access to their dashboard; the provider has no key with which it could open the encrypted copies.
Independent controllers of your own accounts (we send data there on your instruction; their privacy policies apply):
- intervals.icu: we read rides, wellness and training settings from it; we write planned workouts, the weight and sleep you report in the chat, weight from Withings, the perceived effort of a ride, FTP and maximum heart rate to it.
- Withings, if you connect it: we read weight and body composition from it and write nothing to it.
- Garmin Connect, if you connect it: we receive activities and daily health values from it and write the planned workouts you confirm to it (section 11).
- Telegram: messages between you and the coach, workout files and sign-in links.
9. Transfers outside the EU
Under its privacy policy OpenRouter transfers data to servers in the United States and to other countries outside the EEA. The data processing agreement with OpenRouter is part of its terms of service (section 10.2); transfers outside the EEA rest on the EU Standard Contractual Clauses, Module 2 (controller to processor, section 13.2 of the agreement); its list of sub-processors is Schedule 3 of the agreement at trust.openrouter.ai. We do not restrict the choice of model providers: the providers of the GLM model are mostly headquartered in the United States, some in the EU, Singapore or China; the providers of the Claude models are in the United States.
Cloudflare and Microsoft are companies headquartered in the United States and may also process data outside the EU. We send data to Telegram, Garmin and the other independent controllers on your instruction; their privacy policies apply, including to their transfers outside the EU.
10. Artificial intelligence
Numbers (training load, rest, calories, safety limits) are computed by code. A language model writes the coach's messages and explanations within the limits the code sets; its answer can be wrong. The conversation runs on the GLM model (Z.ai), training questions and the weekly review on Claude models (Anthropic), both through OpenRouter.
The model receives your message and the recent messages of the conversation, a photo if you send one, your profile and summaries: training load, weight, readiness (level and reason, no raw measurements), plan and nutrition, but never data we receive through our own Garmin Connect connection or anything derived from it (section 11); for an occasional review of how the coach is helping you, also your messages from the last 28 days. Rides, HRV and sleep that intervals.icu imports from any device or service, including your Garmin Connect account, we process like other intervals.icu data, including with the language model.
Every request is set so that only providers that do not collect data may take it (data_collection: deny); under OpenRouter's rules this means they do not use your data to train models. It does not mean they do not keep it: we have not switched on zero data retention (ZDR), and some providers keep prompts for a while, Anthropic for example for 30 days. OpenRouter itself does not train models on your data.
Profiling: from your data, code and the model build an assessment of readiness and training load and a training plan. We make no decisions based solely on automated processing that have legal or similarly significant effects on you; clearance for training after the PAR-Q+ questionnaire is done by a person. You can ask for human review at info@befly.si.
11. Garmin Connect
Optional, once the connection is available. You connect your own Garmin Connect account on Garmin's authorization page; we never see your Garmin password. When you connect, we ask you separately for consent to this data.
- What we receive and what for: completed activities and the daily health values you allow in Garmin Connect (sleep, HRV, resting heart rate, weight and body composition); we keep only what coaching uses. We write planned workouts to your Garmin Connect calendar only after you confirm them. The only purpose is coaching you (training load, fitness, fatigue, readiness, planning).
- We do not sell Garmin Connect data, do not share it with anyone for their own use, do not share it with data brokers or analytics and advertising tools, and do not use it for advertising.
- Artificial intelligence: data we receive through our own Garmin Connect connection and anything derived from it (numbers, summaries, coach messages, conversation logs) is not sent to the language model or any other artificial intelligence service. We do not use it, and do not pass it to anyone, to train, test, evaluate or improve artificial intelligence models. Today no artificial intelligence processes Garmin Connect data; changing that would need Garmin's written permission and your separate explicit consent, which you can withdraw at any time. This does not apply to data that intervals.icu imports from your account through the Garmin Connect link you set up in intervals.icu: we process those like other intervals.icu data, including with the language model (section 10).
- Who receives or processes it: Cloudflare (Garmin's deliveries to our server and the dashboard traffic pass through its network), Telegram (coach messages can carry values computed from it) and Garmin (planned workouts). Hosting is a server in the EU managed by BeFly (today a Mac computer with Time Machine copies, sections 6 and 7); there is no external hosting provider for this data today. OpenRouter and the model providers, intervals.icu, Withings and Microsoft do not receive data we receive through our own Garmin Connect connection.
- Your rights: you can disconnect at any time on the dashboard or in Garmin Connect, after which we receive nothing more. Access, export, deletion and retention work as for your other ride and health data; you correct device values in Garmin Connect or by writing to info@befly.si.
12. Who at BeFly sees your data
In the account overview the person at BeFly who runs the service sees the state of your account and connections and the date of your last ride, with no health data; receives system alerts with your account's internal label; and sees the outcome of the PAR-Q+ questionnaire when clearing you for training. Because that person runs the Mac, they can technically read all your data. No one else who uses Cycling Mentor sees your data.
13. How long
- Your data in the database: until your account is deleted.
- Daily copies on the Mac: 14 days.
- Sign-in records (codes, links, IP address): once older than 30 days, we delete them at the next start of the dashboard or the next sign-in.
- Program logs (they carry your account's internal label; they are not encrypted): 90 days, then we delete them. Error records that the program writes about your account into BeFly's management database hold only the kind of error, and some also a label that changes every day, not your account's internal label or the error text. That label can be linked to your account only through the program log, so for at most 90 days, and after that by no one. This database has an encrypted copy on another server in the EU, which we do not delete.
- Audit trail and consent records: 5 years after you stop using the service, as evidence for possible claims within the limitation period.
- Erasure list (your account's internal label and the date): as long as a copy exists from which your data could come back. Because we do not delete the copies of BeFly's management database on our server, the label and the date also remain there afterwards.
- Time Machine: as described in section 7; the same applies to the account register and its key. We do not delete the encrypted key copies on the VPS: the register key can open the register's Time Machine copies and the live register, in which after deletion only what is listed below remains; the key of BeFly's management database can open that database's copies on the VPS (erasure list and error records).
After your account is deleted, the following remain until those 5 years run out: the row of your account in the register (internal label, without e-mail or Telegram), the record of this consent and of any withdrawals, the audit trail (who did what and when; it also holds the numbers of your intervals.icu and Withings accounts, settings changes with old and new values, and reasons the operator enters) and closed alerts, for example that you submitted the PAR-Q+ questionnaire. Lines with your account's internal label in program logs remain until their 90 days run out. In annual reports already sent to PAR-Q+ Collaboration your outcomes remain only as part of a total from which you cannot be identified.
14. Your rights
You have the right of access to your data, rectification, erasure, restriction of processing, data portability and the right to object to processing based on our legitimate interest.
- Export (access and portability): on the dashboard (Account) you can download your data in a JSON file at any time.
- Correction: you correct your profile on the dashboard or in the chat, rides and wellness in intervals.icu.
- Withdrawing consent: on the dashboard or with the /preklici command in Telegram. Processing stops at once; the data stays until deletion, and you can still read and export your dashboard.
- Deletion: request it on the dashboard or with the /izbrisi command in Telegram; we complete it within 7 days. When we delete, we at once delete your database and its copies on the Mac, sign-ins, connections and your key. Your encrypted copies in Time Machine thereby become unreadable to anyone without the Mac's sign-in password; because Time Machine also copies the key store, BeFly can still open them with the Mac's password until those copies expire. We cannot delete these copies one by one: until they expire we do not open them or restore your data from them. When a deletion starts, we write only your account's internal label and the date of deletion into a separate list, without your email or other data. If we ever have to restore the system from a copy, right after the restore we use this list to repeat your deletion in full (database, copies, key, folder). On request we also delete future Cycling Mentor workouts from your intervals.icu calendar; past ones stay. We do not revoke access at intervals.icu and Withings: disconnect in those services. Messages stay in your Telegram app until you delete them.
- Restriction, objection and other questions: info@befly.si.
- Complaint: Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si.
15. Changes
For a new purpose of processing, new kinds of data, a transfer of health data to a country outside the EEA or a longer retention period, we ask for your consent again; until you give it, we do not process your data in the new way.
We tell you about other changes that affect you (a new processor, a new hosting provider with servers in the EU or EEA, a change of contact details or of how you exercise your rights) by e-mail or in Telegram at least 30 days in advance; until then you can withdraw consent or request deletion, and if you request deletion before the date of the change, we do not move your data to the new provider. We use a shorter notice only when the change is urgent for security or a legal obligation; then we tell you at once and give the reason.
Corrections that do not change the processing are published on this page with a date and version number; this page also keeps the current list of our processors (section 8).
Cycling Mentor does not replace medical care.