Privacy Policy

1. Introduction

Cycbase ("we", "us", "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"). This policy explains what information we collect, why we collect it, and how we use and protect it.

2. Information We Collect

We collect the following categories of personal information:

• Account data: name, email address, password (hashed)
• Profile data: date of birth, weight, height, cyclist class
• Activity data: ride logs, bike details, service records, race results
• Technical data: IP address, browser type, access times (server logs)

We do not collect payment information, location tracking, or third-party social data.

3. Lawful Basis for Processing

We process your personal information on the following lawful grounds under POPIA:

• Contract: to provide the Service you signed up for
• Consent: for optional profile data you choose to provide
• Legitimate interest: to improve and secure the Service
• Legal obligation: to comply with applicable South African law

4. How We Use Your Information

• To provide, maintain, and improve the Service
• To authenticate your account and prevent unauthorised access
• To send transactional emails (password resets, verification)
• To analyse aggregate, anonymised usage patterns to improve the Service

We do not sell, rent, or share your personal information with third parties for marketing purposes.

5. Data Storage & Security

Your data is stored on servers within a secure environment. We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, or destruction, including encrypted password storage and HTTPS-only access. Notwithstanding these measures, no system is completely secure.

6. Data Retention

We retain your personal information for as long as your account is active. When you delete your account through the app, all personal data — including your profile, trips, bikes, service records, races, and photos — is permanently and immediately deleted from our systems. No backup copies are retained after deletion. This right is exercisable directly from your account settings at any time.

7. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

• Access: download all your data at any time via Profile → Export my data
• Correction: update your profile information directly in the app
• Deletion: permanently delete your account and all data via Profile → Delete my account
• Objection: contact us to object to any processing not covered above
• Complaint: lodge a complaint with the Information Regulator of South Africa

The Information Regulator can be contacted at: [email protected] or +27 (0)10 023 5200.

8. Cookies

We use strictly necessary cookies only — specifically an httpOnly authentication token cookie required for secure login. We do not use tracking, analytics, or advertising cookies.

9. Third-Party Services

The Service may send transactional emails through a mail delivery service. We do not share any personal information with advertising networks, analytics providers, or data brokers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email before they take effect. Continued use after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related queries, POPIA rights requests, or objections to processing, please contact us at [email protected]. We will respond within the timeframes prescribed by POPIA (generally within 30 days of receiving a request).