Privacy Policy
- 1. Who We Are
- 2. Information We Collect
- 3. How We Use Your Information
- 4. Location & GPS Data
- 5. Payment Information
- 6. Sharing Your Information
- 7. Third-Party Services
- 8. Data Retention
- 9. Data Security
- 10. Your Rights (UK GDPR)
- 11. Cookies & Tracking
- 12. International Data Transfers
- 13. Children's Privacy
- 14. Account Deletion
- 15. Changes to This Policy
- 16. Contact Us
Who We Are
This Privacy Policy explains how (Ride) Vaulta Ltd ("Vaulta", "we", "us", or "our") collects, uses, and protects your personal information when you use the Vaulta mobile application and ridevaulta.com (together, the "Service").
(Ride) Vaulta Ltd is registered in Scotland under company number SC894353, with its registered office at Office 524/18, Young Street, Edinburgh, EH2 4JB, Scotland. We are the data controller responsible for your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Information We Collect
We collect the following categories of information:
| CATEGORY | EXAMPLES |
|---|---|
| Account information | Name, username, email address, date of birth, password (encrypted) |
| Profile information | Profile photo, country/location, cycling type, bio |
| Ride & fitness data | GPS routes, distance, speed, elevation, duration, calories, heart rate (if connected via integrations) |
| Health & wellness data | Weight entries, fitness goals (optional, user-provided) |
| Payment information | Subscription status, billing history (processed via Stripe — we do not store full card details) |
| Usage data | App interactions, device type, operating system, crash logs |
| Content you create | Community posts, comments, kudos, photos you upload |
How We Use Your Information
We use your information to:
- Provide, operate, and maintain the Service, including ride tracking and the monthly leaderboard
- Calculate and administer the monthly reward pool, including verifying eligibility and processing payouts
- Process subscription payments via our payment processor, Stripe
- Detect and prevent fraud, cheating, or abuse of the Service
- Communicate with you about your account, including service updates and, where you have consented, marketing communications
- Improve and develop the Service through aggregated, anonymised analysis of usage patterns
- Comply with our legal obligations
Location & GPS Data
When you use Vaulta's ride tracking features, we collect precise GPS location data to record your route, distance, speed, and elevation. This data is essential to the core functionality of the Service and to verifying ride authenticity for leaderboard and reward pool purposes.
You can control location permissions through your device settings at any time. Disabling location access will prevent ride tracking from functioning, but will not affect your ability to use other parts of the app.
Depending on your privacy settings within the app, your route and start/end locations may be visible to other users. You can adjust these settings at any time within the Privacy section of the app.
Payment Information
All subscription payments are processed by Stripe, Inc., a PCI-compliant third-party payment processor. We do not store your full card details on our servers. Stripe's use of your information is governed by their own privacy policy.
We retain records of your subscription status and billing history for accounting and legal purposes.
Sharing Your Information
We do not sell your personal information. We may share your information in the following limited circumstances:
- With other users: information you choose to make public (profile, rides, posts) in accordance with your privacy settings
- With service providers: trusted third parties who help us operate the Service (such as Supabase for database hosting, Stripe for payments, and Resend for email delivery), under appropriate confidentiality and data protection obligations
- For legal reasons: where required by law, regulation, legal process, or governmental request
- In connection with a business transaction: such as a merger, acquisition, or sale of assets, subject to confidentiality protections
Third-Party Services
Vaulta integrates with third-party services to provide certain features, including:
- Strava — for automatic ride synchronisation, where you choose to connect your account
- Stripe — for secure payment processing
- Supabase — for secure data storage and authentication
If you connect a third-party integration, that service's own privacy policy will also apply to the information shared with them. We encourage you to review the privacy policies of any third-party services you choose to connect.
Data Retention
We retain your personal information for as long as your account remains active, and for a reasonable period afterward to comply with legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements.
When you delete your account, we permanently delete your personal data, including your profile, ride history, and authentication credentials, as described in Section 14.
Data Security
We implement appropriate technical and organisational measures to protect your personal information, including encryption in transit, secure authentication, row-level database access controls, and restricted administrative access.
While we take reasonable steps to protect your data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your Rights (UK GDPR)
Under the UK GDPR, you have the right to:
- Access the personal information we hold about you
- Rectify inaccurate or incomplete information
- Erase your personal information ("right to be forgotten")
- Restrict or object to certain processing of your information
- Port your data to another service in a structured, machine-readable format
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, please contact us at hello@ridevaulta.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.
Cookies & Tracking
Our website, ridevaulta.com, may use essential cookies necessary for the site to function. We do not currently use third-party advertising or tracking cookies. Our mobile app does not use cookies but may use device identifiers for essential functionality such as authentication and crash reporting.
International Data Transfers
Your information may be stored and processed in countries outside the UK, including via our service providers. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, to protect your information in accordance with UK GDPR requirements.
Children's Privacy
Vaulta is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have inadvertently collected information from someone under 18, we will take steps to delete it promptly.
Account Deletion
You can permanently delete your account at any time from Privacy → Delete Account within the app. This action is irreversible and will permanently remove your profile, ride history, achievements, and authentication credentials from our systems.
Some information may be retained for a limited period where required for legal, accounting, or fraud-prevention purposes, after which it will also be deleted.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of material changes via the app or by email where appropriate.
Contact Us
If you have questions about this Privacy Policy or how we handle your personal information, please contact us at hello@ridevaulta.com.
DATA CONTROLLER
(Ride) Vaulta Ltd
Company Number: SC894353
Registered in Scotland
Registered Office: Office 524/18, Young Street, Edinburgh, EH2 4JB, Scotland