Privacy Policy (United States)

Riding Places understands that your privacy is important to you and that you care about how your personal information is used. We respect and value the privacy of everyone who uses Our Platform ("Our Platform") and will only collect and use personal information in ways that are described here, and in a way that is consistent with our obligations and your rights under applicable law.

The Platform is owned and operated by Biomotion LLC (the "Company"), a Wisconsin limited liability company (converting to a Wisconsin corporation), with its principal place of business in Madison, Wisconsin.

Please read this Privacy Policy carefully and ensure that you understand it.

1. Definitions and Interpretation

In this Policy the following terms shall have the following meanings: "Cookie" means a small text file placed on your computer or device by Our Platform when you visit certain parts of Our Platform and/or when you use certain features of Our Platform, details of which are set out in Part 14, below. "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household; see Part 4. "Sensitive Personal Information" means the subset of Personal Information given heightened protection under certain US state privacy laws, including precise geolocation data; see Part 6. "Consumer Health Data" means the subset of Sensitive Personal Information given heightened protection under Washington's My Health My Data Act and Nevada's consumer health data law, including certain fitness, activity, and precise location data; see Part 6 and our separate Consumer Health Data Privacy Notice.

2. Information About Us

Our Platform is owned and operated by the Company, a Wisconsin limited liability company converting to a Wisconsin corporation, with its principal place of business at 25 W Main St Suite 800, Madison, WI 53703 USA.

3. What Does This Policy Cover?

This Privacy Policy applies only to your use of Our Platform. Our Platform may contain links to other websites. Please note that we have no control over how your data is collected, stored, or used by other websites and we advise you to check the privacy policies of any such websites before providing any data to them.

4. What Is Personal Information?

There is no single federal definition of personal information in the United States. In this Policy, "personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. This is the definition used by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA/CPRA"), and it is similar to the definitions used by other US state privacy laws.

Personal information is, in simpler terms, any information about you that enables you to be identified. Personal information covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

5. What Are My Rights? (US State Privacy Rights)

There is no comprehensive federal privacy law in the United States. A growing number of states (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others) grant their residents specific privacy rights. Regardless of whether these laws currently apply to us, we voluntarily extend the following rights to all users of Our Platform in the United States, and we will always work to uphold them.

The right to know and access. You have the right to know what categories of personal information we collect about you, the sources of that information, the purposes for collecting it, the categories of third parties with whom we share it, and to request access to the specific pieces of personal information we hold about you. Part 13 will tell you how to do this.

The right to correct. You have the right to request that we correct inaccurate personal information we hold about you. Please contact us using the details in Part 15.

The right to delete. You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (for example, records we must keep to comply with legal obligations). Please contact us using the details in Part 15.

The right to opt out of sale or sharing. Certain state laws give you the right to opt out of the sale of your personal information or its sharing for cross-context behavioral advertising. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

The right to limit use of sensitive personal information. Certain state laws give you the right to limit the use and disclosure of sensitive personal information, such as precise geolocation and consumer health data, to what is necessary to provide the services you request. We only use your sensitive personal information and consumer health data to provide the services described in this Policy; see Part 6.

The right to data portability. Where required, we will provide the personal information you request in a portable and, to the extent technically feasible, readily usable format.

The right to non-discrimination. We will not discriminate against you for exercising any of these rights.

The right to appeal. If we decline to act on your request, you have the right to appeal our decision. To appeal, submit a written appeal using the contact details in Part 15, describing the request and the decision you are appealing. We will respond to your appeal within 60 days, extendable by an additional 30 days where necessary, and will explain the outcome in writing. If we deny your appeal, we will tell you how to submit a complaint to your state Attorney General.

Rights relating to automated decision-making and profiling. The Platform automatically determines whether your rides complete a location-based Ramble or GeoZone, and this determination is used to award points and gamification rewards. We use this automated determination only for gamification purposes; we do not use it, and we do not permit any Group to use it, to make decisions about your employment, credit, insurance, healthcare, or other decisions that produce legal or similarly significant effects concerning you. If you believe a Group has used your Platform activity in that way, please contact us using the details in Part 15.

For more information about our use of your personal information or exercising your rights as outlined above, please contact us using the details provided in Part 15. We will not require you to create an account to exercise these rights, and we will take reasonable steps to verify your identity before responding.

It is important that your personal information is kept accurate and up-to-date. If any of the personal information we hold about you changes, please keep us informed as long as we have that data.

If you have any cause for complaint about our use of your personal information, please contact us first, using the details in Part 15; we would welcome the opportunity to resolve your concerns ourselves. You may also have the right to complain to your state Attorney General or the Federal Trade Commission.

6. What Data Do You Collect and How?

Depending upon your use of Our Platform, we may collect and hold some or all of the personal information set out below, organized by the statutory categories of personal information used by the CCPA/CPRA and similar US state privacy laws. Retention periods are stated more fully in Part 8, and named recipients are described more fully in Part 10.

Identifiers, such as your name, email address, account identifier, IP address, and online identifiers including your Strava athlete ID and your Google or Apple account identifier where you use social login, and shipping details you provide at prize redemption, come from you directly, from social login providers, and from Strava if connected, and are used for account creation and authentication, communicating with you, and delivering the service.

Customer records, such as the name, shipping address, and phone number you provide at prize redemption, come from you and from Stripe, and are used to fulfill prizes you redeem and to bill for our services. We do not collect government identifiers such as a Social Security number, driver's license number, or passport number, and financial account information is handled by Stripe and is not stored by us.

We do not collect characteristics of protected classifications, such as race, color, national origin, religion, sex, gender, age, disability, or veteran status.

Commercial information, such as records of subscriptions purchased at the Group level and of prizes redeemed, comes from Stripe and from you directly, and is used for billing and prize fulfillment.

We do not collect biometric identifiers such as fingerprints, faceprints, or voiceprints.

Internet or network activity, such as your interactions with the Platform and performance and analytics telemetry, is collected automatically as you use the Platform, and is used to operate, secure, and improve the service and measure performance.

Precise geolocation data, treated as sensitive personal information and, where applicable, as consumer health data, consists of GPS traces of your rides, including ride start and end coordinates, recorded first-party by the mobile app's location tracking, including in the background while you record a ride, and, if you connect Strava, imported from Strava. We use this data to record your rides, determine whether your rides complete location-based Rambles and GeoZones, calculate points and estimated CO2 avoided, show your rides and routes to you, and show aggregated activity, including ride route geometry and ride start coordinates, to the Group or Groups you have joined.

Sensory data, meaning photographs you upload such as profile photos and banners, comes from you directly and is used to display your profile and your Group's branding.

Professional or employment information, meaning your membership in a Group where that Group is your employer or organization, reflects your own choice to join that Group and is used to enable employer or organization Rambles. We do not collect your job title, salary, or similar employment records.

We do not collect education records or non-public education information.

Inferences, such as points earned, Ramble progress, and estimated CO2 avoided, are generated by us from your ride data and used for gamification, leaderboards, and reporting aggregated activity to your Group or Groups.

Sensitive Personal Information and Consumer Health Data

Some of the information described above receives heightened protection under US law.

Precise geolocation data. We collect precise GPS traces of your rides. This data is recorded first-party by the Riding Places mobile app's location feature, including in the background while you are recording a ride, and, if you connect your Strava account, is also imported from Strava. We use this data to record your rides, to determine whether your rides complete location-based Rambles and GeoZones, to display your rides and routes to you, to calculate points and estimated CO2 avoided, and to show aggregated activity, including ride route geometry and ride start coordinates, to the Group or Groups you have joined. You control this collection through your device's location permission, which you can grant, deny, or change at any time in your device settings. On Android we show a disclosure describing this collection before requesting the permission; on iOS the system prompt presents our purpose strings explaining that location is used to track your rides, including in the background, and to show your position on the map. You can disconnect Strava at any time, after which we will stop receiving new ride data from Strava.

Fitness and activity data and consumer health data. Ride metrics, including distance, duration, elevation, and activity type, together with your precise location data, may constitute "consumer health data" under Washington's My Health My Data Act and Nevada's consumer health data law, because this combination of data can indicate health-related activity. If you are a Washington or Nevada resident, your consumer health data is also described in our separate Consumer Health Data Privacy Notice, and we will not collect your consumer health data until we have obtained your affirmative authorization for that collection, separate from your general acceptance of this Policy, as those laws require. Our GeoZones and Rambles features use configurable, Group-created location zones. We do not permit a GeoZone to be used to identify or track your presence at a health care facility, to collect your consumer health data based on that presence, or to send you a notification, message, or advertisement about your health status or health-related services based on your presence in a GeoZone, and creating a GeoZone for any of those purposes is a violation of our Terms of Service.

We retain sensitive personal information and consumer health data for the periods stated in Part 8. We do not use or disclose this data for purposes other than providing the services described in this Policy and the separate Consumer Health Data Privacy Notice where applicable, and we do not sell it or share it for cross-context behavioral advertising. If you are a Washington or Nevada resident, you may withdraw your authorization for the collection of your consumer health data at any time using the contact details in Part 15; withdrawing your authorization will limit or disable ride-recording features that depend on that data, as described in Part 12.

We do not knowingly collect personal information from children (see Part 17), and we do not collect data relating to criminal convictions and/or offenses.

7. How Do You Use My Personal Information?

We use identifiers, geolocation and fitness and activity data, and inferences to supply our services to you, including accounts, groups, Rambles, points, rewards, maps, and routes. We use identifiers, commercial information, and your shipping address to deliver prizes you redeem. We use commercial information to manage payments for our services. We use your contact identifiers to communicate with you regarding service and transactional messages and, with your consent, for email marketing.

Marketing Emails

We may use your personal information for marketing purposes, which may include contacting you by email with information, news, and offers on our services. You will not be sent any unlawful marketing or spam.

Consistent with the federal CAN-SPAM Act, every marketing email we send will identify us as the sender, will not use false or misleading header information or deceptive subject lines, and will include our postal address: Biomotion LLC, 25 W Main St Suite 800, Madison, WI 53703 USA. Every marketing email will include a clear and conspicuous way to opt out, and we will honor opt-out requests promptly and in any event within 10 business days. We will not send you further marketing emails after you opt out.

In practice, we go further than CAN-SPAM requires: we only send marketing emails to users who have affirmatively opted in to receive them, with marketing consent off by default and collected separately from your account registration, and you can withdraw that consent at any time via the unsubscribe link in any marketing email or in your account settings.

Transactional and service emails, for example account verification, password resets, and Ramble and reward notifications, are sent as part of operating the service and are not marketing emails.

Purpose Limitation

We will only use your personal information for the purpose or purposes for which it was originally collected unless we reasonably believe that another purpose is compatible with the original purpose and need to use your personal information for that purpose. If we do use your personal information in this way and you wish us to explain how the new purpose is compatible with the original, please contact us using the details in Part 15.

If we need to use your personal information for a purpose that is unrelated to, or incompatible with, the purpose or purposes for which it was originally collected, we will inform you and, where required by applicable law, obtain your consent.

In some circumstances, where permitted or required by law, we may process your personal information without your knowledge or consent. This will only be done within the bounds of applicable law and your legal rights.

8. How Long Will You Keep My Personal Information?

We will not keep your personal information for any longer than is necessary in light of the reason or reasons for which it was first collected. Identity information including your name, contact information including your email address, location data and fitness and activity data including GPS ride traces, and shipping address information provided for prize redemption are each kept until account deletion. Financial information is kept for up to seven years to satisfy legal and tax recordkeeping obligations. Technical information such as IP address, browser type, and operating system is not stored in our application database and is transient only.

Anonymized or aggregated data that cannot identify you may be retained for analytics purposes.

Your IP address is processed transiently by our hosting and security infrastructure, for example in server request logs used to deliver the service and prevent abuse. It is not stored in our application database and is not used to build a profile of you. Our page-view and performance analytics are anonymized and cookieless and do not identify you; see Part 10.

We erase the personal information listed above from our live systems when your account is deleted. For individual riders, deletion takes effect immediately and there is no post-deletion recovery period through the app. A Group owner can delete their Group account from Group settings, which erases the Group's and the owner's personal information from our live systems while leaving individual members' own data intact; see our Terms of Service. Residual copies may remain in our routine encrypted backups for up to 30 days before they are overwritten, and our payment processor retains billing records under its own terms; see our Terms of Service for the records we are legally required to keep. When your account is deleted, we also revoke our access to any Strava account you connected and delete your uploaded images from our media host.

9. How and Where Do You Store or Transfer My Personal Information?

Your personal information is processed and stored outside the United States. Our database and hosting infrastructure are currently located in the United Kingdom / European Union region: our database is hosted on Neon Postgres in the AWS eu-west-2 (London) region, and our application is hosted on Vercel, with its serverless functions pinned to the London (lhr1) region. This means that if you are a US user, your personal information will be transferred to, and stored in, a country other than the United States. The data protection laws of the United Kingdom and the European Union provide a high level of protection for personal information.

The security of your personal information is essential to us, and to protect your data, we take a number of important measures, including limiting access to your personal information to those employees, agents, contractors, and other third parties with a legitimate need to know and ensuring that they are subject to duties of confidentiality, and maintaining procedures for dealing with data breaches, including notifying you and/or the applicable regulator where we are legally required to do so under applicable US state data breach notification laws. If a breach involves your consumer health data and you are a Washington resident, Washington's My Health My Data Act requires us to notify the Washington Attorney General regardless of the number of Washington residents affected, in addition to any notice owed to you directly.

10. Do You Share My Personal Information?

Service providers that process your personal information. We use the following third-party service providers, each of which processes personal information on our behalf under contractual terms that restrict its use of your data to providing services to us: Neon, for Postgres database hosting and storage of account and ride data; Vercel, for application hosting and delivery; Stripe, for payment processing for Group subscriptions, without storing your full payment card details; SendGrid, for delivery of transactional and marketing emails; and Cloudinary, for storage and delivery of user-uploaded images.

Technical and mapping services. The following third parties receive only limited technical or location data, not linked to your account, name, or email address, and are contractually restricted from using that data for their own independent purposes: Vercel Analytics and Speed Insights, which receive anonymized, cookieless page-view and performance telemetry; MapTiler, which receives your browser's IP address and the map area you view for map tiles, and a typed address or coordinates for geocoding; Usercentrics, which receives your browser's IP address and your cookie-consent choices; Stadia Maps, which receives route waypoint coordinates sent from our servers for bicycle route calculation; and Open Topo Data and Open Elevation, which receive route and ride coordinates sent from our servers for elevation lookups.

Login providers. If you sign in with Google or Apple, that provider authenticates you and returns basic identity claims, such as your email address and a stable account identifier. Google and Apple act as independent controllers of your interaction with them, governed by their own privacy policies.

Strava is not a processor acting on our behalf. It is a separate service that you may choose to connect to your Riding Places account. When you connect Strava, ride data flows one-way from Strava to Riding Places; your use of Strava is governed by Strava's own privacy policy and terms.

Groups you join. When you join a Group, for example a bike shop, club, employer, or event organizer, that Group's administrators can see your participation in their Rambles through their dashboard. This includes your name; your aggregate activity statistics, such as points, distance, number of rides, commute count, estimated CO2 avoided, and GeoZones joined or completed; the route geometry of your qualifying rides and their start locations, shown on the Group's heat map, which may allow a Group to infer your home or workplace location, particularly in a small Group; and, if you redeem a physical prize in one of that Group's promotions, your email address and the postal address and phone number you provide for delivery. Where a Group is your employer, we require the Group to agree, under a data processing agreement with us, that it will not use your Platform activity data to make decisions about your employment, and that it will not use it in any way that violates Washington's or Nevada's consumer health data laws.

A Group only sees rides you take after you join it, and never sees your data before you join. You choose which Groups to join, and once you join a Group, you are automatically enrolled in every Ramble that Group runs while you are a member, including Rambles the Group publishes after you join, without a separate step to opt in to each one. If you are a Washington or Nevada resident and a Ramble involves the collection of your consumer health data, we will provide you a further, specific authorization opportunity at that time, separate from your original decision to join the Group, as described in our separate Consumer Health Data Privacy Notice. A Group may export or download the information described above, for example as a spreadsheet, to run its promotions or fulfill prizes. Once a Group exports your information in this way, that copy is held by the Group under its own control, outside our systems; deleting your Riding Places account removes your data from our systems but does not remove copies a Group has already exported.

If any of your personal information is shared with a third party, as described above, we will take steps to ensure that your personal information is handled safely, securely, and in accordance with your rights, our obligations, and the third party's obligations under applicable law.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising; see Part 5.

If we sell, transfer, or merge parts of our business or assets, your personal information may be transferred to a third party. Any new owner of our business may continue to use your personal information in the same way or ways that we have used it, as specified in this Privacy Policy.

In some limited circumstances, we may be legally required to share certain personal information, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

11. How Can I Control My Personal Information?

In addition to your rights under US state privacy laws, set out in Part 5, when you submit personal information via Our Platform, you may be given options to restrict our use of your personal information. In particular, we aim to give you strong controls on our use of your data for direct marketing purposes, including the ability to opt out of receiving emails from us, which you may do by unsubscribing using the links provided in our emails and in your account settings.

You can disconnect your Strava account at any time from your account settings, after which we will stop receiving new ride data from Strava.

Do Not Track. Some browsers transmit "Do Not Track" signals. There is no industry standard for responding to them, and Our Platform does not currently respond to Do Not Track signals.

12. Can I Withhold Information?

You may restrict our use of Cookies; see Part 14. You may also choose not to connect Strava. Ride-based features (points, Rambles, rewards) rely on ride data, which the Riding Places app records first-party using your device's location; connecting Strava is one optional way to import rides, not a requirement. If you decline location permission, or if you are a Washington or Nevada resident and decline or withdraw your consumer health data authorization, the app cannot record rides, and ride-based features will not function.

13. How Can I Access My Personal Information?

If you want to know what personal information we have about you, you can ask us for details of that personal information and for a copy of it, where any such personal information is held. This is known as a verifiable consumer request or access request.

All access requests should be made in writing and sent to the email or postal addresses shown in Part 15. We will take reasonable steps to verify your identity before responding, and you may designate an authorized agent to make a request on your behalf.

There is not normally any charge for an access request. If your request is manifestly unfounded or excessive, for example if you make repetitive requests, a fee may be charged to cover our administrative costs in responding, or we may decline the request, as permitted by applicable law.

We will respond to your access request within 45 days of receiving it. If we need more time, up to an additional 45 days, we will inform you of the reason and extension period in writing.

14. Cookie Policy

Our Platform places and accesses certain Cookies on your computer or device. Most are first-party Cookies placed directly by us; in addition, our cookie-consent platform, Usercentrics, sets its own cookies to record your consent choices, and it runs in your browser. We use Cookies to facilitate and improve your experience of Our Platform and to provide and improve our services. We have carefully chosen these Cookies and have taken steps to ensure that your privacy and personal data is protected and respected at all times.

Before non-essential Cookies are placed on your computer or device, you will be shown a cookie prompt requesting your consent to set those Cookies. US law does not generally require opt-in consent for cookies; we provide the prompt as a matter of good practice, consistent with our practice in other markets. By giving your consent to the placing of Cookies you are enabling us to provide the best possible experience and service to you. You may, if you wish, deny consent to the placing of Cookies; however certain features of Our Platform may not function fully or as intended.

Certain features of Our Platform depend on Cookies to function; these are strictly necessary Cookies, for example login and session cookies. Your consent will not be sought to place these Cookies, but it is still important that you are aware of them. You may still block these Cookies by changing your internet browser's settings as detailed below, but please be aware that Our Platform may not work properly if you do so.

In addition to the controls that we provide, you can choose to enable or disable Cookies in your internet browser. Most internet browsers also enable you to choose whether you wish to disable all Cookies or only third-party Cookies. By default, most internet browsers accept Cookies, but this can be changed. For further details, please consult the help menu in your internet browser or the documentation that came with your device.

You can choose to delete Cookies on your computer or device at any time, however you may lose any information that enables you to access Our Platform more quickly and efficiently, including but not limited to login and personalization settings.

It is recommended that you keep your internet browser and operating system up-to-date and that you consult the help and guidance provided by the developer of your internet browser and manufacturer of your computer or device if you are unsure about adjusting your privacy settings.

15. How Do I Contact You?

To contact us about anything to do with your personal information and privacy, including to make an access, correction, or deletion request, please use the following details:

Biomotion LLC (the "Company"), 25 W Main St Suite 800, Madison, WI 53703 USA.

Email: support@riding-places.com.

16. Changes to this Privacy Policy

We may change this Privacy Policy from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal information protection.

Any changes will be posted on Our Platform. We recommend that you check this page regularly to keep up-to-date. Where changes are material, we will take reasonable steps to bring them to your attention, including by email or in-app notice.

This Privacy Policy will be dated as of its publication date at US launch.

17. Children's Privacy

Our Platform is not directed to children. You must be at least 18 years old to use Riding Places, as stated in Section 1 of our Terms of Service. We do not knowingly collect personal information from anyone under 18, and, consistent with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 18, we will delete it. If you believe a child has provided us with personal information, please contact us using the details in Part 15.