Privacy policy

Data controller

M. Lavoisier, Entrepreneur individuel (French sole trader), Rue de Margnolles, 69300 Caluire-et-Cuire, France. For any question, or to exercise your rights: contact@pacingcarbs.com.

What we collect

Account: your email address and a hashed password, managed by Supabase Auth.
Races: the GPX file you upload, your race settings and the plan generated. A GPX track can reveal places you frequent — your home, your training habits: it is never published without an explicit action from you.
Payment: handled by Stripe. We keep only a customer identifier and your subscription status, never card data.
Waiting list: your email address and the sport concerned.

Purposes and legal bases

Account and race data are processed to perform the contract. Billing records are kept to meet legal and accounting obligations. Joining the waiting list relies on your consent, which you may withdraw at any time.

Sharing and processors

Your plans are private by default. A plan is reachable by public link only if you turn sharing on. Our processors are Supabase (data hosting), Vercel (application hosting) and Stripe (payments). No data is sold or passed on for advertising.

Transfers outside the European Union

Vercel Inc. and Stripe, Inc. are established in the United States. Transfers to these providers are covered by appropriate safeguards under Chapter V of the GDPR — European Commission standard contractual clauses and, where applicable, certification under the EU-U.S. Data Privacy Framework. The database is hosted in Supabase's European region.

Retention

Account and race data are kept for as long as the account exists, then deleted. Accounting records are kept for the applicable statutory period of ten years.

Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data. Deleting your account deletes your races and plans with it. Exercise these rights at the address above; you may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr), or with your own national authority.

Cookies

Only cookies strictly necessary for the service are set: they keep your session signed in. These require no prior consent. No advertising cookies are used, and no analytics tool setting a tracker is in place; introducing one would come with a consent banner and an update to this page.