Privacy Policy
Principles of personal data processing and protection in the Alone in Drag platform
1. Data Controller
The controller of personal data processed within the Alone in Drag platform (ERP system and Client Portal) is Alone in Drag.
For any questions regarding personal data protection or the exercise of your rights, you may contact the Controller by email at: office@aloneindrag.com.
2. Scope and Categories of Processed Data
The Controller processes personal data strictly necessary to provide aerodynamic optimization services (aerofitting), manage client accounts, fulfill billing requirements, and maintain system security.
Client identification and contact details (clients table): first name, last name, email address (email), identity account email (identity_email), phone number (phone), residential or company address (street, postal_code, city, country), company name and tax ID (nip, company_name), as well as operational notes and referral source (notes, referral_notes).
Aerofitting measurement and biometric session data (aerofitting_sessions and runs tables): rider weight in kilograms (rider_weight_kg), recorded physical parameters, aerodynamic drag coefficient CdA, test speeds, power output in watts, time savings, and specifications of tested equipment and cycling positions.
Multimedia materials (session_media and session_videos tables): photographs and video recordings capturing rider position during test runs in the wind tunnel, on the velodrome, or on the road, including chapter detection data and timestamps.
Authentication and session credentials (identity_sessions and identity_magic_links tables): cryptographically signed tokens, public session identifiers, IP addresses, client user agent headers, single-use authentication codes, and activity and expiration timestamps.
Electronic communication logs (email_logs table): history of system notifications, dispatched passwordless magic links, and session report deliveries.
3. Purposes and Legal Grounds for Processing
Contract performance and service delivery: processing measurement data, preparing aerofitting reports, and providing Client Portal access are carried out to perform a service contract or take steps at the client's request (Article 6(1)(b) GDPR).
Compliance with legal obligations: processing billing and invoicing data (including tax ID, address, and transaction records) is based on statutory tax and accounting regulations (Article 6(1)(c) GDPR).
Legitimate interests of the Controller: ensuring IT and network security, fraud prevention, identity verification, establishing or defending legal claims, and technical diagnostics (Article 6(1)(f) GDPR).
User consent: when loading optional third-party multimedia players, data is processed based on voluntary consent (Article 6(1)(a) GDPR).
4. Data Processors and Third-Party Recipients
To maintain reliable platform operations, personal data may be entrusted to specialized technical and operational service providers.
Hetzner Online GmbH (Germany, EU) — server infrastructure and database hosting.
Cloudflare, Inc. (USA / EU) — secure cloud storage for multimedia files, session videos, and generated reports via Cloudflare R2 Storage.
Resend, Inc. — delivery of transactional email communications (including login magic links and session reports).
inFakt Sp. z o.o. (Poland) — electronic invoicing and integrated sales accounting services.
Fireworks AI — automated optical character recognition and text data extraction from commercial documents (OCR).
Functional Software, Inc. (Sentry) — application error tracking and stability monitoring with active personal data filtering.
Google LLC — optional embedded playback of archival session videos (Google Drive) within the Client Portal, activated only upon user consent.
5. Data Retention Period
Client account data, aerofitting session history, and measurement reports are retained for the duration of service provision and portal access, and thereafter until the statutory limitation period for claims expires.
Financial and accounting records are stored for 5 years, starting from the end of the calendar year in which the tax payment deadline expired.
Active authentication sessions (identity_sessions) remain valid for 30 days from last activity, subject to a hard cap of 90 days from creation, or until explicitly revoked by the user.
6. Data Subject Rights
Every data subject has the right to access their personal data, request rectification, erasure (right to be forgotten), restriction of processing, and data portability.
Users have the right to object to data processing based on the Controller's legitimate interests.
If you believe your data processing violates GDPR provisions, you have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO) in Poland.
Clients may request an export of their personal data or account deletion at any time by contacting the Controller at office@aloneindrag.com.