01Who we are
FTP500 is operated by MB Velolaikas, a company registered in Lithuania (“we”, “us”, “our”). We are the data controller responsible for your personal data.
If you have any questions about this policy or how we handle your data, contact us at info@velolaikas.lt.
02Information we collect
Account information: when you sign in with Google, we receive a stable account identifier and your profile name; we do not request your Google email address or password. If you choose email sign-in, we process the address to send a one-time link and retain only a protected one-way identifier of it in our local store; we never store a password.
Training information: the structured details you enter to generate a plan, such as your goal, experience level, weekly hours, available days, race dates and, optionally, your FTP and recent training load.
Imported activity data: if you upload .fit files, we process and store the ride summary they contain — such as date, duration, distance, power, heart rate, cadence and elevation — to analyze your training load. Heart-rate data can relate to your health, so we process it only to provide the analysis you ask for, and you can delete any ride at any time.
Payment information: when you buy a plan, our payment provider Stripe collects your card and billing details. We receive only limited information such as your plan, the amount paid, tax and a transaction reference — never your full card number.
Technical information: basic data needed to run the service securely, such as your language preference and a session cookie that keeps you signed in.
03How and why we use your information
To provide the service — creating your account, generating and storing your training plans, and letting you manage and change them. Legal basis: performance of our contract with you.
Health status and heart-rate data are special-category data. We process them only after your separate, explicit consent under GDPR Article 9(2)(a), solely for the training analysis you request. Refusing consent does not affect account access; you can use FTP500 without importing rides. You may withdraw consent at any time by disconnecting Strava, deleting uploaded rides, or contacting info@velolaikas.lt.
To process plan payments and manage access, including tax and invoicing. Legal basis: performance of a contract and compliance with legal obligations.
To keep the service secure, prevent abuse and fix problems. Legal basis: our legitimate interests in running a safe, reliable service.
04How your training plan is generated
FTP500 does not use artificial intelligence to create training plans or process your training data. Plans and workouts are produced by our deterministic training engine, which applies published endurance-coaching rules to the details you enter. Your training data is not sent to OpenAI or any other AI provider.
Plan reviews and updates may use your race calendar, health status, logged workouts, imported rides, current training load, the date and upcoming sessions. The engine applies fixed rules to that current context; it does not send this data to an AI provider.
05Strava connection (optional)
You can optionally connect your Strava account so we can import summaries of your own recent rides — date, duration, distance, power, heart rate, cadence, elevation, laps and per-second power/heart-rate streams — to calculate your training load. We do not import GPS locations or maps, and raw streams are analyzed in memory only: we store just the resulting ride summary.
Rides imported from Strava are not shown to other users and are never sent to any AI provider. We access Strava under its API Agreement, using access tokens you can revoke at any time.
Disconnecting Strava in Settings immediately deletes the connection and every ride imported from it; revoking FTP500's access on strava.com has the same effect, and deleting your account deletes this data as well. Strava's own processing of your data is governed by Strava's privacy policy.
Strava may monitor and collect data about how FTP500 uses the Strava API, and may use that usage data for its own business purposes, including support, platform improvements and compliance checks. This disclosure is required by Strava's API Policy.
06Payments
Payments are processed by Stripe, a certified PCI-DSS Level 1 payment provider. Your card details are entered directly on Stripe's secure checkout and are never stored on our servers. Stripe's handling of your data is governed by its own privacy policy.
07Cookies
We use essential cookies to keep you signed in, protect Google sign-in, and secure restricted administrator access. We do not use advertising, analytics or third-party tracking cookies. These cookies are strictly necessary to provide and protect the service, so they do not require consent.
08Who we share your information with
We do not sell your personal data. We share it only with the service providers who help us operate FTP500, acting as our processors: Stripe (payments), Resend (delivery of requested sign-in emails), Sentry (error monitoring — technical error reports without your personal details), Backblaze (off-site backups of our database, stored in the European Union) and our hosting provider.
We may also disclose data where required by law, or to protect our rights, our users or the security of the service.
09International data transfers
Some of our processors, including Stripe, Sentry and Backblaze, are based in the United States, and Stripe and Sentry also process data there. Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
10How long we keep your information
We keep your account and training data for as long as your account is active. Payment and invoicing records are retained for as long as required by applicable tax and accounting law. When you delete your account, we remove your account, saved plans and imported rides from our active systems. Residual copies may remain temporarily in protected backups until they expire under our normal backup-retention schedule; they are not used for other purposes.
After account deletion, we retain a one-way identity marker for up to 24 months solely to prevent repeated free-trial abuse. It cannot be used to recover your account data and is then deleted.
11Your rights
Under the GDPR you have the right to access, correct, delete or export your personal data, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. You can delete your account and data at any time from the Settings page.
To exercise any of these rights, contact us at info@velolaikas.lt. You also have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija) or your local supervisory authority.
12Data security
We use appropriate technical and organizational measures to protect your data, including encrypted connections and restricted access. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.
13Children's privacy
FTP500 is not intended for anyone under 18 or anyone who has not reached the age of majority where they live, and we do not knowingly collect their data. If you believe an ineligible person has provided us with personal data, please contact us and we will delete it.
14Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you. Your continued use of the service after changes take effect means you accept the updated policy.
15Contact us
For any privacy questions or requests, contact MB Velolaikas at info@velolaikas.lt.