Summary
Before the full text, here are the essentials:
1. Who we are
This Policy describes how VRAN XR handles the personal information of people who use the VeluRun app and the velurun.com website.
VeluRun is an app for recording sports activity (running and cycling) via GPS.
2. Scope and applicable law
VeluRun is available internationally. Depending on the country you are in, your information is protected by different rules, and this Policy complies with all of them:
- Colombia: Law 1581 of 2012, Decree 1074 of 2015 and related rules.
- European Economic Area and Switzerland: Regulation (EU) 2016/679 (GDPR).
- United Kingdom: UK GDPR and Data Protection Act 2018.
- Brazil: Law 13.709/2018 (LGPD).
- California (USA): CCPA, as amended by the CPRA.
- Canada: PIPEDA and equivalent provincial laws.
Where any of these rules grants you broader rights than those described generally, we will apply the standard most protective of you.
3. What information we collect
3.1 Data you give us directly
- Account data: first name, last name, email, password and username. The password is stored encrypted by our authentication provider; we have no access to it in plain text.
- Profile photo (avatar) and photos you attach to an activity, if you choose to upload them.
- Social content: comments and reactions you post, and the connections you make with other users.
3.2 Location data
During an activity we collect your GPS location to record the route, distance, pace, speed and elevation.
- If you grant the relevant permission, we also collect your background location, so recording continues when you turn off the screen or switch apps. Without that permission the app still works, but recording stops when you leave VeluRun.
- The app only accesses your location while an activity is in progress. We do not track you outside an activity you started.
- To diagnose and improve measurement accuracy, we store the technical GPS readings associated with each activity (coordinates, altitude, accuracy and timestamp of each point, including those discarded for low accuracy). They are linked to your account and are deleted along with it.
3.3 Data generated by using the app
Metrics and records of your activities: time, distance, pace, speed, altitude, positive and negative elevation, estimated calories, route, per-kilometre splits and interval workout sessions.
3.4 Advertising identifier
The app includes Google AdMob components that may access the device advertising identifier (Ad ID).
3.5 Technical data
Basic information needed for operation and security: device model and manufacturer, operating system version, language, app version and error logs.
3.6 Notifications
If you enable notifications, we use that channel to tell you about interactions related to your activity within the app. You can turn them off at any time in your operating system settings.
3.7 Waitlist
Waitlist: if you leave your email address on the website so that we can notify you about the launch, we use it solely for that purpose. It is not used for any other purpose and is not combined with your VeluRun account unless you sign up with the same email.
4. What we use your information for and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your account | Account data | Performance of the contract |
| Record activities and show you routes, metrics and history | Location, metrics | Performance of the contract |
| Record with the screen off or the app in the background | Background location | Consent |
| Show the map of your routes | Route coordinates | Performance of the contract |
| Social features: profile, comments, reactions, connections | Profile, social content | Performance of the contract |
| Improve measurement accuracy and fix bugs | GPS readings, errors | Legitimate interest |
| Security, fraud and abuse prevention | Technical and account data | Legitimate interest |
| Advertising (not currently active) | Ad ID | Consent, when enabled |
| Comply with legal obligations | Those required by law | Legal obligation |
In Colombia, processing is carried out with your prior, express and informed authorisation, given when you create your account and accept this Policy, and for background location through the specific operating system permission.
5. Information visible to other people
VeluRun includes social features. Please note that:
- Your public profile — username, name, profile photo, city, country and main sport — is visible to other VeluRun users.
- The activities you share, with their metrics and their route on the map, may be visible to the people you connect with.
- The comments and reactions you post are visible to anyone with access to that activity.
6. Who we share your information with
We do not sell your personal information, and we do not share it with third parties for cross-site or cross-app behavioural advertising.
We share data only with the infrastructure providers strictly necessary to run the service, acting as processors on our behalf:
| Provider | What it processes | Location |
|---|---|---|
| Supabase | Authentication, database and photo storage | United States |
| Mapbox | Maps and route display | United States |
| Resend | Verification and password recovery emails | United States |
| Google (AdMob, Play) | Advertising components and Android system services | United States and others |
We do not build or publish heatmaps, aggregate statistics or datasets derived from our users’ routes.
We may also disclose information where legally required: at the request of a competent authority, to comply with a legal obligation, or to protect the rights, safety or integrity of users or third parties.
7. International transfers
VRAN XR is based in Colombia and its providers operate mainly in the United States. This means your information is transferred to and stored outside your country of residence.
Where the transfer involves data of people in the European Economic Area, the United Kingdom or Switzerland, we rely on the Standard Contractual Clauses approved by the European Commission, incorporated into our contracts with providers, together with the technical security measures described in section 9.
For people in Colombia, the transfer takes place with your authorisation and in compliance with the duties Law 1581 of 2012 imposes on the controller.
8. How long we keep your information
- Account data and activities: while your account is active.
- After account deletion: we delete your personal data and your activities within thirty (30) days of the verified request.
- Exceptions: we may keep for longer the information strictly necessary to meet legal obligations, resolve disputes or prevent fraud and abuse.
- Technical error logs: twelve (12) months maximum.
9. Security
We apply reasonable technical and organisational measures: encryption in transit (HTTPS/TLS), encrypted password storage, and database-level security rules restricting each user’s access to their own data only.
No system is completely foolproof. If a security incident affecting your personal data occurs, we will notify you and report it to the competent authorities within the deadlines required by applicable law.
10. Your rights
In general, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your data and your account.
- Object to certain processing or request its restriction.
- Withdraw your consent at any time, without affecting the lawfulness of prior processing.
- Portability: receive your data in a structured, commonly used format.
- Lodge a complaint with the competent supervisory authority.
Additional rights depending on where you are
Colombia. You may access, update, correct and delete your data, and revoke the authorisation given. We answer queries within a maximum of ten (10) business days and claims within fifteen (15) business days, extendable as provided by law. If you feel your request was not properly handled, you may turn to the Superintendence of Industry and Commerce (SIC).
European Economic Area, United Kingdom and Switzerland. In addition to the above rights, you may lodge a complaint with your country’s data protection authority. We will handle your request within the one-month period set by the GDPR.
Brazil. You may request confirmation that processing exists, anonymisation or blocking of unnecessary data, and information about the entities we share data with. The competent authority is the ANPD.
California (USA). You have the right to know what personal information we collect, to request its deletion or correction, and not to be discriminated against for exercising your rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA.
How to exercise your rights
Write to info@velurun.com from the email linked to your account. We may ask for additional information to verify your identity before handling the request. Exercising these rights is free.
11. Deleting your account and your data
You can request full deletion of your account and associated data by writing to info@velurun.com from your registered email address.
Deleting your account removes your profile data, your activities and routes, your photos, your workout sessions and your social content, within thirty (30) days, except for the legal exceptions set out in section 8.
12. Minors
VeluRun is not aimed at people under 16 and we do not knowingly collect information from anyone below that age. If we find an account belongs to someone younger, we will delete it. If you are a parent or legal guardian and believe a minor in your care has given us data, write to info@velurun.com.
13. Website and cookies
velurun.com is a static informational site. It uses no tracking cookies and no third-party analytics. It loads fonts from Google Fonts, which means Google may receive the IP address the request comes from.
14. Changes to this Policy
We may update this Policy. The current version will be published on this page with its update date. If the changes are substantial, we will notify you by reasonable means before they take effect.
15. Contact
General and privacy contact: info@velurun.com
← Back to home