Privacy Policy

Last updated: May 22, 2026

Welcome to Gruppetto.

Gruppetto is a cycling event and coordination platform built for amateur cyclists, clubs, and communities. This Privacy Policy explains what data we collect, why we collect it, and how we handle it.

We try to keep things simple:

• participation and rider data are private by default
• Gruppetto is not a public athlete tracking network
• organizations control their own member data
• we use minimal tracking
• we do not sell personal data

1. Data Controller

Gruppetto is operated by:

Kimin.info Email: gruppettoapp@gmail.com

For questions related to privacy or data protection, contact: gruppettoapp@gmail.com

2. What Gruppetto Does

Gruppetto helps cyclists and organizations:

• discover cycling events
• plan participation
• coordinate rides and race weekends
• manage club activities
• organize memberships and season planning

Gruppetto is not a public social network or public athlete database.

3. Who This Policy Applies To

This policy applies to:

• visitors of the website
• registered users
• clubs and organizations using Gruppetto
• users invited into organizations

4. Controller and Processor Roles

Depending on how Gruppetto is used, Gruppetto may act either as a data controller or a data processor on behalf of organizations.

Gruppetto as Controller. Gruppetto acts as controller for:

• account creation
• authentication
• subscriptions and billing
• public event discovery
• platform analytics
• infrastructure and security
• support communications
• AI-powered helper features

Organizations as Controllers. Cycling clubs and organizations using Gruppetto are typically responsible for:

• member management
• emergency contact information
• insurance or license details
• organization-specific visibility settings
• agreements and club administration

In these cases, Gruppetto acts as a processor providing the platform infrastructure.

5. Data We Collect

Depending on how you use Gruppetto, we may collect:

Account Information

• name
• email address
• profile information
• authentication provider identifiers

Organization Data

• club memberships
• participation status
• rider aliases
• organization roles
• event planning information

Event and Result Data

• events you join
• participation records
• race result associations
• rankings and placements visible within organizations

Location Data

• approximate location
• home city or region
• geocoded distance calculations

Exact home coordinates are not publicly visible.

Technical Data

• browser type
• device information
• log data
• IP address
• session information

Payment Information

Payments may be processed through third-party payment providers. Gruppetto does not store full payment card information.

6. Public and Private Data

Public Information. The following may be publicly visible:

• event pages
• event metadata
• organization names
• public event descriptions

Private / Organization-Scoped Information. The following is private by default and visible only inside organizations:

• participation status
• rider result associations
• member lists
• internal organization activity
• club coordination information

Gruppetto intentionally limits public visibility of rider identity and participation data.

7. Race Results

Gruppetto may process race result information in order to:

• help organizations track participation
• associate riders with events
• display organization-specific results
• assist season planning

Gruppetto aims to minimize stored race data and does not intentionally build public athlete profiles or public searchable rider databases.

8. Minors

Users must be at least 16 years old to create an account directly.

Organizations may manage junior riders or youth members within their own organization context.

Organizations are responsible for ensuring they have appropriate rights and permissions for managing junior member data.

Minor-related visibility may be restricted by default.

9. Legal Basis for Processing

Depending on the feature, Gruppetto processes personal data based on:

• performance of a contract
• legitimate interests
• legal obligations
• user consent where required

Legitimate interests may include:

• operating the platform
• maintaining security
• coordinating events
• improving usability
• providing event recommendations

10. Analytics and Tracking

Gruppetto aims to use minimal tracking.

We may use lightweight analytics and infrastructure monitoring to:

• improve reliability
• understand feature usage
• detect errors
• improve performance

Gruppetto does not currently use advertising tracking or sell personal data to advertisers.

11. AI Features

Gruppetto may use AI-powered features to assist users and improve platform functionality.

Examples may include:

• event recommendations
• summaries
• event discovery assistance
• parsing public event information
• organizational helper tools

AI features are intended to assist users rather than profile or evaluate individuals.

Third-party AI providers may process limited data necessary for these features.

12. Service Providers

Gruppetto uses third-party providers to operate the platform, including providers for:

• hosting
• authentication
• database infrastructure
• analytics
• AI services
• email delivery

Current providers may include:

• Vercel
• Supabase
• Anthropic

These providers may process personal data on our behalf.

13. International Transfers

Some service providers may process data outside the European Economic Area (EEA).

Where required, Gruppetto uses appropriate safeguards such as:

• Standard Contractual Clauses (SCCs)
• contractual protections
• provider compliance mechanisms

14. Retention

We retain personal data only as long as reasonably necessary for:

• operating the platform
• fulfilling legal obligations
• maintaining security
• resolving disputes

Typical retention periods may include:

• account data until deletion request
• infrastructure logs for limited periods
• billing records as required by law

Deleted accounts may remain in backups temporarily before permanent removal.

15. Your Rights

Depending on applicable law, you may have rights to:

• access your data
• correct inaccurate data
• request deletion
• restrict processing
• object to processing
• request data portability
• withdraw consent

You may exercise these rights by contacting: gruppettoapp@gmail.com

16. Organization Responsibility

Organizations using Gruppetto are responsible for:

• ensuring lawful use of member data
• obtaining necessary permissions
• managing organization visibility settings
• complying with applicable laws

17. Security

We take reasonable technical and organizational measures to protect personal data, including:

• access controls
• authentication systems
• encrypted connections
• infrastructure security measures

No online service can guarantee absolute security.

18. Cookies

Gruppetto uses cookies and similar technologies necessary for:

• authentication
• security
• session management
• basic platform functionality

Additional analytics or optional features may use additional technologies where permitted by law.

19. Changes to This Policy

We may update this Privacy Policy from time to time.

Material changes may be communicated through the platform or by email.

20. Contact

Questions or requests related to privacy may be sent to: gruppettoapp@gmail.com