Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Hosting and technical infrastructure

Website and web application (Vercel). The website and the web application are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Upon each visit, Vercel processes the connection data technically required to deliver the service and to ensure operational security (IP address, date and time of access, requested resource, browser and device identifiers) in server log files. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and stable provision of the service. Log files are deleted automatically after a short period. Vercel is certified under the EU-U.S. Data Privacy Framework; in addition, EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR have been concluded.

Database (Supabase). All account, training, and health data are processed in a database operated by Supabase Inc., 970 Toa Payoh North #07-04, Singapore, acting as a processor pursuant to Art. 28 GDPR. The data is stored exclusively in the eu-central-1 region (Frankfurt am Main, Germany). A data processing agreement is in place; EU Standard Contractual Clauses have been concluded for any access from third countries.

Email communication (IONOS). Email mailboxes are operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, as a processor, in data centers located in Germany.

3. Website access and web analytics

Cookies. No cookies are used on the website for analytics or advertising purposes. The web application uses only technically necessary cookies and local storage mechanisms for session management (login). Their use does not require consent pursuant to Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the associated data processing is based on Art. 6(1)(b) GDPR.

Reach measurement (Vercel Web Analytics). Vercel Web Analytics is used to measure website usage in aggregate (visitor numbers, referral sources, pages viewed). The method operates without cookies and without device-based recognition; IP addresses are not stored. No combination with other data and no profiling takes place. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the statistical evaluation of the service's reach.

4. Account, training data, and health data

Registration and account. Use of 4000Watt requires the creation of a user account. The data processed comprises the email address, name, and the details stored in the profile (in particular body weight, FTP value, and maximum heart rate). The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement). Registration is reserved for persons who have reached the age of 18; confirmation of the minimum age is obtained during registration.

Training data. During training sessions, data from connected devices is processed – in particular power output (watts), cadence, and smart trainer control data – together with the metrics calculated from it (in particular training load values). The legal basis is Art. 6(1)(b) GDPR.

Health data (heart rate). Heart rate data – recorded during training, as part of recovery measurements, or from imported activities – constitutes health data within the meaning of Art. 9(1) GDPR. Such data is processed exclusively on the basis of explicit consent pursuant to Art. 9(2)(a) GDPR, which is obtained separately during registration. The processing purposes are limited to the provision of the training features: display and analysis of training sessions, calculation of training load, and derivation of training recommendations. Storage takes place exclusively in the database in Frankfurt am Main referred to in Section 2. The data is neither transferred to third parties nor used for advertising purposes. Consent may be withdrawn at any time with effect for the future in the settings. Without this consent, the heart-rate-based features are unavailable; all other use of the service remains unaffected.

5. Strava Connect

Users may voluntarily connect their Strava account to 4000Watt. Without this connection, no data is exchanged with Strava.

Import. Once authorization has been granted, 4000Watt retrieves the activities of the last 30 days as well as all future activities of the connected account via the official Strava API. Data categories processed: activity name, sport type, date, duration, distance, heart rate, and power. GPS tracks, segments, and data of other athletes are not retrieved. The imported data serves exclusively to display the respective user's own training history and to calculate that user's training load, and is visible only to that user. The legal basis is consent pursuant to Art. 6(1)(a) GDPR and, with respect to heart rate data, explicit consent pursuant to Art. 9(2)(a) GDPR.

Export. At the user's instigation, completed 4000Watt workouts are automatically transferred to the user's Strava account. Strava, Inc. is the independent controller responsible for the subsequent processing of this data; Strava's privacy policy applies (https://www.strava.com/legal/privacy).

Deletion. If an activity is deleted on Strava, it is also removed from 4000Watt within 48 hours. If the connection is disconnected – in the application or on strava.com under Settings → My Apps – all imported Strava data is deleted immediately and permanently; the user receives a confirmation once the deletion is complete.

4000Watt and Strava act as separate, independent controllers; no joint controllership within the meaning of Art. 26 GDPR exists. Further information: https://4000watt.app/strava

6. Payment processing

Paid subscriptions are processed via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland; parent company: Stripe, Inc., USA – certified under the EU-U.S. Data Privacy Framework, supplemented by EU Standard Contractual Clauses). Payment data (in particular card details) is entered by the user directly with Stripe and is at no time transmitted to 4000Watt in full; 4000Watt receives only a payment confirmation and the details required for invoicing. The legal bases are Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (statutory retention obligations).

7. Waitlist and product information

Upon signing up for the waitlist, the email address is processed for the purpose of providing notification of the market launch of 4000Watt and sending product information at irregular intervals. Sign-up follows a double-opt-in procedure: it becomes effective only upon confirmation via the link sent by email; the time and IP address of the confirmation are logged for evidentiary purposes. The legal basis is consent pursuant to Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future via the unsubscribe link contained in every email; the email address is deleted in that case.

8. Contact

When contact is made by email (in particular to support@4000watt.com), the information provided is processed for the purpose of handling the inquiry. The legal basis is Art. 6(1)(b) GDPR where the inquiry relates to a contractual relationship, and otherwise Art. 6(1)(f) GDPR. The correspondence is deleted once the inquiry has been conclusively handled and no statutory retention obligations apply.

9. Contact form

Data submitted through the contact form on 4000watt.app is used solely to process the request.

Data processed: name, email address, subject, message text, language of the request and time of submission.

The legal basis is Art. 6(1)(b) GDPR where the request serves the initiation or performance of a contract. In all other cases Art. 6(1)(f) GDPR applies – the legitimate interest in responding to requests.

Submission is delivered as an email to support@4000watt.com. The sender address is website@send.4000watt.com. Resend (Resend, Inc., San Francisco, USA) acts as processor for delivery. Transfers to the USA are based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The mailbox is operated by 1&1 IONOS SE, Montabaur, Germany.

To prevent automated submissions, the IP address is processed exclusively as a cryptographic hash and deleted after ten minutes. The legal basis is Art. 6(1)(f) GDPR – the legitimate interest in preventing abuse. The IP address is neither transmitted with the message nor stored.

The request is not stored in the 4000Watt database. The message remains in the mailbox and is deleted once the request has been fully processed and no statutory retention obligations apply, at the latest after 24 months.

Name and email address are required in order to answer the request. Without them no reply is possible. Requests can alternatively be sent directly to support@4000watt.com.

10. Storage periods and deletion

Personal data is stored only for as long as necessary for the stated purposes or as required by statutory retention obligations. In detail:

• Account, training, and health data: until deletion of the user account. Account deletion may be initiated at any time in the settings; all data is completely deleted within 30 days.
• Strava data: as set out in Section 5 (48 hours or immediately, respectively).
• Invoicing-related data: 10 years pursuant to Section 147 of the German Fiscal Code (AO).
• Waitlist addresses: until consent is withdrawn.

11. Rights of data subjects

Data subjects have the rights of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR). Processing based on Art. 6(1)(f) GDPR is subject to the right to object under Art. 21 GDPR. Consent given may be withdrawn at any time with effect for the future pursuant to Art. 7(3) GDPR; the lawfulness of processing carried out prior to withdrawal remains unaffected. An email to support@4000watt.com is sufficient to exercise these rights.

Furthermore, pursuant to Art. 77 GDPR, there is a right to lodge a complaint with a data protection supervisory authority. The supervisory authority competent for the controller is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, https://www.ldi.nrw.de.

12. Changes to this privacy policy

This privacy policy will be amended whenever the data processing or the legal situation changes. The version published at https://4000watt.app/datenschutz (German) is authoritative; the current English translation is available at https://4000watt.app/privacy.