Privacy policy

Who is responsible

[[CLEM: company name and legal form]],[[CLEM: registered address]]. Privacy questions:[[CLEM: privacy contact email address]].

This policy covers the PANORA apps for Apple TV, iPhone, iPad and Mac and this website.

What we store about you

• Your account: your email address (your sign-in name) and a random account id. If you use Sign in with Apple, also Apple's user id for PANORA and the name Apple shares the first time you sign in. If you use Apple's Hide My Email, your email address is Apple's relay address.
• Sign-in codes: a code we email you is stored only as a cryptographic hash and is valid for 10 minutes. We count sign-in attempts to limit misuse.
• Your profile: your display name and avatar once you choose them, your rider weight (a default of 75 kg unless you agree to store your own), your height if you enter it and agree to store it, the date you created your account, and the region that stores your data.
• Your settings: for example units, trainer difficulty, power smoothing, display and capture options, who may see your weight, heart rate and training history, and your consents with the time you gave or withdrew them and the version of the text you saw.
• Health data, only with your consent: your weight and height, the history of their changes, and your heart rate. See "Health data" below.
• Emails we send: sign-in codes, a notice when a deletion is scheduled and when it is complete, and the download link of a data export.

Health data

We ask for three separate consents, each off until you turn it on: (a) storing your weight and height, (b) keeping the history of their changes, (c) storing your heart rate. Without (a) we keep the default weight and no height, and your own values stay on your device. You can withdraw a consent at any time in the app; withdrawing it deletes what it covered. We record each consent with its time and the version of the text you saw.

Where your data is stored and who processes it

Your account and your data are stored with Amazon Web Services (AWS) in the EU, in Frankfurt.

• Amazon Web Services (AWS), EU (Frankfurt): hosting of the PANORA backend, sign-in and your data.
• Postmark (United States): sends our emails (sign-in codes and account notices).
• Apple (Sign in with Apple): confirms your Apple ID when you sign in with Apple. When you delete your account, we revoke PANORA's Sign in with Apple authorisation at Apple.

The static pages of this website are delivered through Amazon CloudFront's global edge network: your IP address is processed at the nearest edge location to serve the page, and we keep no access logs. Account data goes only to the PANORA API and to Amazon Cognito in Frankfurt.

Transfers to the United States rely on an adequacy decision.[[CLEM: name the framework (EU–US and Swiss–US Data Privacy Framework) and confirm each US processor's certification]]

No tracking

This website sets no cookies and uses no analytics, advertising or tracking. When you sign in on the account page, your sign-in lives only in the open page: reloading or closing it signs you out. For our own statistics we keep pseudonymous records without health data, names, email addresses or Apple ids; once your account is deleted, nothing links them to you. Our logs contain no email addresses, names, account ids or sign-in codes.

Your rights

A copy of your data: in the app or on the account page you can request one machine-readable file with everything we store about you. It is prepared in the background; we also email you a download link that is valid for 7 days. You can request one copy every 24 hours, also while a deletion is pending.

Deleting your account: in the app or on the account page you choose to delete your account in 30 days or now. You confirm by signing in again. When you request a deletion, every device is signed out. During the 30 days you can cancel the deletion; signing in alone never cancels it. We email you when the deletion is scheduled and when it is complete. The deletion removes your account, your profile, your settings and consents, all data stored for you, your files and your sign-in records.

Sign in with Apple: if you delete your Apple ID, we delete your PANORA account at once. If you stop using Sign in with Apple for PANORA, we sign you out and remove the link to your Apple ID; your account stays.

Consents: you can withdraw a health-data consent at any time; that deletes what it covered.

[[CLEM: further rights (access, correction, objection, complaint to a supervisory authority) and how to exercise them — lawyer]]

How long we keep data

We keep your data until you delete your account. After a deletion, a record that it was completed stays for 2 days. Export files are deleted after 8 days. Sign-in codes expire after 10 minutes.

Changes

[[CLEM: effective date and version of this policy]]