Privacy

Version 2.0, effective from 28 October 2026 to 5 November 2026 (archive). It describes consent v4, which stays valid until you replace it with a newer one; the processing today is described on the current Privacy page. Slovenska različica: Zasebnost (v4).

1. Controller

The controller of personal data in Cycling Mentor is BeFly, oddaja nepremičnin, d.o.o. (BeFly d.o.o.), Ljubljanska cesta 38B, 1293 Šmarje-Sap, Slovenia, registration number 7475039000. Contact: info@befly.si. The service is for people aged 18 or older who open an account by signing up or receive one by invitation; the Terms of Use also apply.

2. Legal basis

• We process health, training and nutrition data on the basis of your explicit consent (Article 6(1)(a) and Article 9(2)(a) of the General Data Protection Regulation), which you accept on the dashboard; for Garmin Connect data we also ask for separate consent when you connect it.
• Processing of Garmin Connect data by artificial intelligence (section 12) only if you choose it with a separate box, on the basis of that separate explicit consent (Article 6(1)(a) and Article 9(2)(a)); the choice is not a condition of the service — without it no artificial intelligence processes that data.
• Automatic clearance of your health screening (section 10) only if you choose it with a separate box, on the basis of that separate explicit consent (Article 9(2)(a) and Article 22(2)(c)); the choice is not a condition of the service — without it a person clears you.
• We process your e-mail address, Telegram identifier and sign-in data (including the hashed record of your password, if you set one) to perform our contract with you (Article 6(1)(b)); that is why we use them before consent, to open your account and let you sign in.
• We process sign-in records with IP addresses, including failed sign-in attempts, program logs and error records on the basis of our legitimate interest in the security of the service and of your account and in detecting abuse (Article 6(1)(f)).
• We process consent records and the audit trail on the basis of our legitimate interest in demonstrating compliance and defending legal claims (Article 6(1)(f), and Article 9(2)(f) for health data in them).

Health and training data are not a legal requirement, but the service needs them: without them the coach cannot plan your training. You can withdraw consent at any time; withdrawal does not affect the lawfulness of processing before it.

3. What data we process

• Rides and workouts: power, heart rate, cadence, duration, training load, FTP, perceived effort and the ride file, which can contain the GPS track of your route.
• Wellness and health: HRV, resting heart rate, sleep, readiness, a short weekly check-in (energy, sleep, mood, libido, hunger, overeating, pain and infections, and menstruation for women), the outcome of the PAR-Q+ questionnaire in the guide (you fill in the official form on its own site; we store only the outcome category and the date) and your answer to the guide's question about a training break.
• Weight and body composition.
• Nutrition: what you write about food, and photos you send, for example of meals (we do not store the photo, only a short description).
• Conversation: your messages in Telegram and the coach's replies.
• Profile: height, age, sex, goals (including target weight), available time, equipment and devices, camp location and terrain, lean mass, ingredients you avoid, and notes.
• Connections: your account identifier and permissions at the services you connect, and the access tokens for them.
• Account: e-mail address, the identifier of your Telegram chat, your password if you set one (we keep only its one-way hashed record, from which the password cannot be read directly), and sign-in records with time and IP address, including failed attempts, which we keep to protect your account against break-ins.

The content of messages that the code recognises as a health warning is neither stored nor sent to the language model.

For the annual report we send to the authors of the questionnaire (PAR-Q+ Collaboration) as a condition for using it, on the basis of this consent we count the outcome categories of your health screening (PAR-Q+ and ePARmed-X+) for each 12-month period. If you withdraw consent or delete your account, we subtract your outcomes from every period whose report has not yet been sent. In reports already sent they remain only as part of a total from which you cannot be identified. The report shows the breakdown by category only when every category has at least 5 riders. Otherwise it shows only how many riders were screened, and only if there are at least 5.

Separately from this consent and not based on it: the time you recorded an outcome and the time it was confirmed (by the code or by a person) or reset are kept with your account's internal label in the alert and audit records for 5 years, also after your account is deleted, like the rest of the audit trail. These records hold neither answers nor the outcome category, but the confirmation record shows that your outcome was confirmed and whether the code or a person confirmed it. We keep in the same way the time you choose or withdraw automatic clearance (with the version of the box text you accepted) or the processing of Garmin Connect data by artificial intelligence, and the time of a request for human review.

4. Where the data comes from

From your intervals.icu account (rides, wellness, training settings), from Withings if you connect it (weight and body composition), from Garmin Connect if you connect it (activities and daily health values), from Rouvy or Wahoo if you connect them (rides), from Telegram (your messages) and from what you enter yourself on the dashboard, in the guide or in the chat.

5. What for

To plan your training and adapt it as you go, to assess readiness and training load, for nutrition advice, for the conversation with your coach in Telegram, for the dashboard, for sending planned workouts to the services you connect and for the safety check before intense training.

6. Where it is kept and how it is protected

In a separate database for you only, on a server in the EU managed by BeFly; today this is a Mac computer. The database is encrypted; every account has its own key, kept in this Mac's key store (Keychain). An export we prepare on the Mac at your request and accepted suggestions from the occasional review of how the coach is helping you are stored unencrypted in your folder; these two folders are excluded from the Time Machine copies on the external disk, but stay in the Mac's local snapshot of the whole disk for up to 24 hours.

Encryption protects copies of your database and files that leave the Mac without the key: someone who has only a copy cannot read it. It does not protect the running Mac, because the program on it opens the database. It does not protect a stolen Mac or its disk: the disk is not encrypted, and the Mac signs in automatically at start-up, which unlocks the key store.

Your password, if you set one (password sign-in is available from 27 November 2026): we do not keep it in readable form and do not send it to services that check for leaked passwords; we check it only against a list of commonly used passwords that is part of the program. After too many wrong attempts, password sign-in is closed: for your account for at most 24 hours, for the same network address for at most one hour. You can reopen it for your account earlier by resetting your password; meanwhile you can sign in with a code by e-mail or with a link from Telegram (/prijava).

7. Copies

All copies are in the EU.

• Every day the Mac makes a copy of your database, encrypted with the same key; we keep it for 14 days.
• Time Machine (macOS backup) copies the Mac to a network disk on the same local network; the copies contain your encrypted database and the key store, which is locked with the Mac's sign-in password. Under Apple's rules it keeps hourly copies for the past 24 hours, daily copies for the past month and weekly copies for all previous months; it deletes the oldest when the disk is full. On the Mac itself Time Machine also takes a local snapshot of the whole disk every hour and keeps it for up to 24 hours.
• Time Machine copies also contain the account register (email address, Telegram identifier, sign-in records with IP address and the audit trail). Its key is the key of the whole database, so it remains when you are deleted; an encrypted copy of this key is also kept on our backup server (VPS), so that we can restore the system if the Mac were lost. We do not open these copies or restore your data from them, except in a system restore, after which we repeat your deletion (see Deletion in section 16). We do not use older copies of the register for any other purpose.
• We do not copy your database to another server.

8. Who else receives data

Our processors:

• OpenRouter (OpenRouter, Inc.) and the language model providers it forwards requests to: the conversation, photos and summaries of your data (section 10).
• Cloudflare: all dashboard traffic for app.cyclingmentor.com passes through its network, including your IP address. Because the encrypted connection to the dashboard ends in Cloudflare's network, Cloudflare can technically see the content of requests, including your password at sign-in and links from e-mails; as a processor it may use them only to forward the traffic. The service's outbound traffic on the Mac goes through the Cloudflare WARP service, except connections to our backup server (VPS) and to the Cloudflare network that carries the dashboard, which we exclude from the tunnel; Cloudflare sees which servers the service talks to, but not the content of encrypted connections.
• Microsoft: sends e-mail to your address with your invitation, a link to confirm your signup, a link to set or reset your password, a sign-in code or a Telegram link; we keep no copy among sent items.
• The provider of our server in the EU (VPS): it holds encrypted daily copies of BeFly's management database (with the erasure list and error records; see section 15), an encrypted copy of the keys of that database and of the account register, and a copy of the program code with its settings, which contains in plain text the sign-in email addresses of the person who runs the service and of people with view access to their dashboard; the provider has no key with which it could open the encrypted copies.

Independent controllers of your own accounts (we send data there on your instruction; their privacy policies apply):

• intervals.icu: we read rides, wellness and training settings from it; we write planned workouts, the weight and sleep you report in the chat, weight from Withings, the perceived effort of a ride, FTP and maximum heart rate to it.
• Withings, if you connect it: we read weight and body composition from it and write nothing to it.
• Garmin Connect, if you connect it: we receive activities and daily health values from it and write the planned workouts you confirm to it (section 11).
• Rouvy and Wahoo, if you connect them: we read rides from them and write planned workouts to them (section 13).
• Telegram: messages between you and the coach, workout files and sign-in links.

9. Transfers outside the EU

Under its privacy policy OpenRouter transfers data to servers in the United States and to other countries outside the EEA. The data processing agreement with OpenRouter is part of its terms of service (section 10.2); transfers outside the EEA rest on the EU Standard Contractual Clauses, Module 2 (controller to processor, section 13.2 of the agreement); its list of sub-processors is Schedule 3 of the agreement at trust.openrouter.ai. For the conversation, training questions and the weekly review we use Claude models; the providers of these models are headquartered in the United States. We do not restrict the choice among them, except for Garmin Connect data if you choose its processing by artificial intelligence: those requests are taken only by providers headquartered in the EU or the United States that do not keep prompts (section 12).

Cloudflare and Microsoft are companies headquartered in the United States and may also process data outside the EU. We send data to Telegram, Garmin, Rouvy, Wahoo and the other independent controllers on your instruction; their privacy policies apply, including to their transfers outside the EU.

10. Artificial intelligence, profiling and automated decisions

Numbers (training load, rest, calories, safety limits) are computed by code. A language model writes the coach's messages and explanations within the limits the code sets; its answer can be wrong. The conversation, training questions and the weekly review run on Claude models (Anthropic) through OpenRouter.

The model receives your message and the recent messages of the conversation, a photo if you send one, your profile and summaries: training load, weight, readiness (level and reason, no raw measurements), plan and nutrition; for an occasional review of how the coach is helping you, also your messages from the last 28 days. The model does not receive data we receive through our own Garmin Connect connection or anything derived from it, unless you choose so separately (section 12). Rides from Rouvy and Wahoo, and rides, HRV and sleep that intervals.icu imports from any device or service, including your Garmin Connect account, we process like other ride and wellness data, including with the language model.

Every request is set so that only providers that do not collect data may take it (data_collection: deny); under OpenRouter's rules this means they do not use your data to train models. It does not mean they do not keep it: for these requests we have not switched on zero data retention (ZDR), and some providers keep prompts for a while, Anthropic for example for 30 days. OpenRouter itself does not train models on your data. The language model does not decide on clearing your health screening.

Profiling: from your data, code and the model build an assessment of readiness and training load and a training plan. Hard workouts are unlocked by the clearance of your health screening, which is valid for 12 months.

• Automatic clearance, if you choose it (once the choice is available): with a separate box that is unticked by default (when you record an outcome or under Account) you can choose that the code records the clearance at once and without a person whenever the official questionnaire itself says you may start: you answer NO to every PAR-Q+ question, or ePARmed-X+ clears you without further assessment. The code takes into account only the outcome you record and this rule of the questionnaire; it does not make a medical assessment. The choice applies to outcomes you record after it.
• Clearance by a person: without that choice, when the questionnaire refers you to a qualified exercise professional or a physician, or when your answer to the guide's question about a training break is "yes", the person who runs Cycling Mentor clears you. That person looks at the outcomes, dates and the answer about a break recorded since the last clearance, and checks that the questionnaire's pathway is complete and that an approval is recorded after a referral. They do not see your answers to the questions, because we do not store them, and make no medical assessment.
• Automatic closing: the code also closes hard workouts by itself, without a person — when you record a YES, when you record an outcome that does not clear you, or when a clearance expires after 12 months; it removes hard workouts already in your calendar, lighter workouts stay.
• Your rights for these decisions: at any time you can ask a person to review a decision to clear you or to close hard workouts (on the dashboard under Account, Consent, or at info@befly.si), state your point of view and contest it. A person reviews the decision, takes your point of view into account, explains what it was based on (your recorded outcome and the questionnaire's rule) and changes it if needed. You can withdraw the choice of automatic clearance under Account at any time; if the code has already cleared you, the clearance stays and a person reviews it.

We make no other decisions based solely on automated processing that have legal or similarly significant effects on you.

11. Garmin Connect

Optional, once the connection is available. You connect your own Garmin Connect account on Garmin's authorization page; we never see your Garmin password. When you connect, we ask you separately for consent to this data. Garmin is an independent controller of your Garmin Connect account.

• What we receive, once reading is available: completed activities (type, time, duration, distance, power, heart rate, cadence and the activity file, which can contain the GPS track of your route) and the daily health values you allow in Garmin Connect (sleep, HRV, resting heart rate, weight and body composition), as well as your Garmin Connect account identifier and the permissions you give Cycling Mentor. We keep only what is listed; other kinds of data Garmin may send us (for example stress, blood oxygen saturation or menstrual cycle data) we do not store.
• What we send: we write the planned workouts you confirm to your Garmin Connect calendar (workout name and description with cues, steps with power targets in watts computed from your FTP and cadence targets, and the workout day); before the first upload we point this out to you separately. Workouts Garmin already has stay in Garmin Connect after you disconnect or delete your account with us, until you delete them there.
• What for: only to coach you (training load, fitness, fatigue, readiness, planning). We do not sell Garmin Connect data, do not share it with anyone for their own use, do not share it with data brokers or analytics and advertising tools, and do not use it for advertising.
• Who receives or processes it: hosting is a server in the EU managed by BeFly (today a Mac computer with Time Machine copies, sections 6 and 7); there is no external hosting provider for this data. It is also received or processed by Cloudflare (Garmin's deliveries to our server and the dashboard traffic pass through its network, processor), Telegram (coach messages can carry values computed from it; the language model receives these messages as part of the conversation only if you choose processing by artificial intelligence) and Garmin (planned workouts). OpenRouter and the language model providers receive it only if you choose its processing by artificial intelligence (section 12). intervals.icu, Withings, Rouvy, Wahoo, Microsoft and the provider of our backup server do not receive data we receive through our own Garmin Connect connection or values derived from it. There are no other recipients.
• Retention: like your other ride and health data in your database, until your account is deleted, with the copies and periods in sections 7 and 15. When you disconnect, we delete the account identifier, the permissions and the access tokens; if we cannot deregister at Garmin at once, we keep a copy of the tokens only to retry the deregistration, for 24 hours after you disconnect (usually we delete it sooner); if the service is not running when that period ends, we delete it the first time it runs after that, without another deregistration attempt. Data received before you disconnect stays in your database until your account is deleted, unless you ask us to delete it earlier (info@befly.si).
• Disconnecting: you can disconnect at any time on the dashboard (Connections) or in Garmin Connect; after that we receive nothing more and send nothing more. When you withdraw consent or delete your account, we disconnect for you.
• Your rights for this data: access and export on the dashboard (Account), correction of device values in Garmin Connect or through info@befly.si, deletion by deleting your account or, on request, of the Garmin Connect data only, restriction and objection at info@befly.si, withdrawal of consent on the dashboard or with the /preklici command, and withdrawal of processing by artificial intelligence under Account (section 12).

12. AI transparency statement (Garmin Connect data, optional, once the choice is available)

• By default no artificial intelligence processes this data: data we receive through our own Garmin Connect connection and anything derived from it (numbers, summaries, coach messages, conversation logs) is not sent to the language model or any other artificial intelligence service.
• Only with separate explicit consent: with a separate box under Account that is unticked by default you can choose that the coach also uses it in the conversation. Before you choose, no artificial intelligence processes it. The choice is not a condition of the service: you connect and use Garmin Connect without it too, only the coach does not know this data in the conversation.
• Nature and purpose: if you choose it, the Claude language model (Anthropic) through OpenRouter receives, in the conversation and for training questions, summaries that the code prepares from this data, in the same way as summaries from intervals.icu (section 10), so that it can explain your rides, wellness and plan and advise you. A part of the service for which no zero-retention provider is available (today the weekly review) does not receive this data. Training numbers and safety limits are still computed by code; the model does not decide on clearing your health screening.
• Who then receives it: OpenRouter (OpenRouter, Inc., United States) and only model providers headquartered in the EU or the United States that do not keep prompts (zero data retention, ZDR) and do not collect data (data_collection: deny): today Google (Vertex AI) and Amazon Web Services (Bedrock), both headquartered in the United States; they may also process data outside the EEA. We do not use the GLM model or providers headquartered outside the EU and the United States for this data. The transfer outside the EEA rests on the Standard Contractual Clauses with OpenRouter (section 9).
• No training: we do not use this data or anything derived from it, and do not pass it to anyone, to train, test, evaluate, benchmark or improve artificial intelligence models or systems; we do not put it into training or evaluation datasets, do not build an artificial intelligence knowledge base from it and do not keep it in any way that would enable that later. It does not go into the occasional review of how the coach is helping you or into tests of the coach. The same applies to prompts, responses, summaries and conversation logs that contain this data or are derived from it.
• Withdrawal: you can withdraw the choice under Account at any time, as easily as you give it, without a reason and without consequences for other parts of the service. From the withdrawal on, we send the model no more Garmin Connect data or anything derived from it, also not in the recent messages of the conversation. Withdrawal does not affect the lawfulness of processing before it. Withdrawing your whole consent, disconnecting Garmin Connect or deleting your account also ends the choice; when you reconnect or give consent again, the box is unticked again.
• Changes: we update this statement when the law, Garmin's rules or our use of artificial intelligence change; for any new use we ask for new consent (section 17).
• The statement does not apply to data that intervals.icu imports from your account through the Garmin Connect link you set up in intervals.icu: we process those like other intervals.icu data, including with the language model (section 10). If we receive the same ride both ways, we treat it as Garmin Connect data.

13. Rouvy and Wahoo

Optional, once the connection is available. You connect your own Rouvy or Wahoo account on that service's authorization page, only if you choose to; we never see your password. Rouvy and Wahoo are independent controllers of your accounts: we send data to them on your instruction, and their privacy policies apply (Rouvy, Wahoo).

• What we read: completed rides (time, duration, power, heart rate, cadence, training load and the ride file, which can contain the GPS track of your route), from your profile only FTP if you allow it (we do not store other profile data), and your account identifier and the permissions you give when you connect.
• What we send: planned workouts (steps with power and cadence targets, cues and the workout day).
• We process rides from Rouvy and Wahoo like other ride data, including with the language model (section 10), and keep them in your database until your account is deleted.
• You can disconnect at any time on the dashboard or in that service's settings; after that we read and send nothing more and delete the access tokens. Workouts we have sent stay in Rouvy or Wahoo until you delete them there.

14. Who at BeFly sees your data

In the account overview the person at BeFly who runs the service sees the state of your account and connections and the date of your last ride, with no health data; receives system alerts with your account's internal label; and sees the outcome of the PAR-Q+ questionnaire when clearing you for training; with automatic clearance only if you ask for a review or if needed to fix an error. Because that person runs the Mac, they can technically read all your data. No one else who uses Cycling Mentor sees your data.

15. How long

• Your data in the database: until your account is deleted.
• Hashed record of your password: as long as you have an account; a new password replaces it, and we delete it when your account is deleted.
• Daily copies on the Mac: 14 days.
• Sign-in records (codes, links for sign-in, signup confirmation and setting a password, sign-in attempts, IP address): once older than 30 days, we delete them at the next start of the dashboard or the next sign-in.
• Program logs (they carry your account's internal label; they are not encrypted): 90 days, then we delete them. Error records that the program writes about your account into BeFly's management database hold only the kind of error, and some also a label that changes every day, not your account's internal label or the error text. That label can be linked to your account only through the program log, so for at most 90 days, and after that by no one. This database has an encrypted copy on another server in the EU, which we do not delete.
• Audit trail and consent records: 5 years after you stop using the service, as evidence for possible claims within the limitation period.
• Erasure list (your account's internal label and the date): as long as a copy exists from which your data could come back. Because we do not delete the copies of BeFly's management database on our server, the label and the date also remain there afterwards.
• Time Machine: as described in section 7; the same applies to the account register and its key. We do not delete the encrypted key copies on the VPS: the register key can open the register's Time Machine copies and the live register, in which after deletion only what is listed below remains; the key of BeFly's management database can open that database's copies on the VPS (erasure list and error records).

After your account is deleted, the following remain until those 5 years run out: the row of your account in the register (internal label, without e-mail or Telegram), the record of this consent and of any withdrawals, the audit trail (who did what and when; it also holds the numbers of your intervals.icu and Withings accounts, settings changes with old and new values, and reasons the operator enters) and closed alerts, for example that you submitted the PAR-Q+ questionnaire. Lines with your account's internal label in program logs remain until their 90 days run out. In annual reports already sent to PAR-Q+ Collaboration your outcomes remain only as part of a total from which you cannot be identified.

16. Your rights

You have the right of access to your data, rectification, erasure, restriction of processing, data portability and the right to object to processing based on our legitimate interest.

• Export (access and portability): on the dashboard (Account) you can download your data in a JSON file at any time. The export does not contain the hashed record of your password or other security keys.
• Correction: you correct your profile on the dashboard or in the chat, rides and wellness in intervals.icu.
• Withdrawing consent: on the dashboard or with the /preklici command in Telegram. Processing stops at once; the data stays until deletion, and you can still read and export your dashboard. You withdraw only the choice of automatic clearance or of processing Garmin Connect data by artificial intelligence under Account.
• Human review of a decision about your health screening: under Account (Consent) or at info@befly.si (section 10).
• Deletion: request it on the dashboard or with the /izbrisi command in Telegram; we complete it within 7 days. When we delete, we at once delete your database and its copies on the Mac, sign-ins, connections and your key. Your encrypted copies in Time Machine thereby become unreadable to anyone without the Mac's sign-in password; because Time Machine also copies the key store, BeFly can still open them with the Mac's password until those copies expire. We cannot delete these copies one by one: until they expire we do not open them or restore your data from them. When a deletion starts, we write only your account's internal label and the date of deletion into a separate list, without your email or other data. If we ever have to restore the system from a copy, right after the restore we use this list to repeat your deletion in full (database, copies, key, folder). On request we also delete future Cycling Mentor workouts from your intervals.icu calendar; past ones stay. When we delete your account, we always delete our keys and access tokens for intervals.icu, Withings, Rouvy and Wahoo. We also revoke the access at the service itself, but only where both the service and our connection to it support this. Today this applies to none of these four, so please disconnect in each of them yourself. We disconnect Garmin Connect for you when we delete your account; workouts we have sent to Garmin Connect, Rouvy or Wahoo stay there until you delete them there. Messages stay in your Telegram app until you delete them.
• Restriction, objection and other questions: info@befly.si.
• Complaint: Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si.

17. Changes

For a new purpose of processing, new kinds of health data or of other data we process on the basis of consent, a transfer of health data to a country outside the EEA or a longer retention period, we ask for your consent again; until you give it, we do not process your data in the new way.

We tell you about other changes that affect you, namely a new processor, a new hosting provider with servers in the EU or EEA, new kinds of account data, or a change of contact details or of how you exercise your rights, by e-mail or in Telegram at least 30 days in advance; until then you can withdraw consent or request deletion, and if you request deletion before the date of the change, we do not move your data to the new provider. We use a shorter notice only when the change is urgent for security or a legal obligation; then we tell you at once and give the reason. Switching to another model of a provider already named in this consent, or dropping a provider, is not a change we tell you about in advance; we publish it on the Privacy page with its date.

Corrections that do not change the processing are published on this page with a date and version number; this page also keeps the current list of our processors (section 8).

A consent of version v3, given up to 28 October 2026 or while version v3 was again the current version, stays valid until you accept version v4 under Account. This page applies to it, except that with it the Garmin Connect, Rouvy and Wahoo connections, automatic clearance of your health screening and the processing of Garmin Connect data by artificial intelligence are not available: a person clears your screening. The text of consent v3 says that the conversation runs on the GLM model. Since the morning of 28 October 2026 that is no longer so: the conversation with your coach, training questions and the weekly review run on Claude models (Anthropic) through OpenRouter, and the provider of the GLM model receives nothing. Anthropic was already named as a provider in consent v3. The previous Privacy page (version 1.0), which describes consent v3, is at cyclingmentor.com/privacy/v3.

Cycling Mentor does not replace medical care.