Privacy policy

We collect different categories of data depending on your use of the Application:

1.1. Account Data • Email address (required) • Username (optional) • Password (stored hashed, never in clear text) • Profile photo (optional)

1.2. Sports Profile Data • Morphological data: age, weight, height (optional) • Maximum heart rate and heart rate zones • Trail experience level • Pace preferences and performances

1.3. Activity Data • Imported GPS tracks (GPX files) • Created race projects and strategies • Key points, aid stations, and alerts • Equipment and nutrition data

1.4. Location Data • GPS data contained in your tracks • Location during use (if authorized)

1.5. Health Data (if enabled) • Heart rate • Effort and recovery data • Data synchronized from third-party apps (Apple Health, Google Fit)

1.6. Technical Data • IP address and connection data • Device type, operating system, browser • Device identifiers • Usage logs and performance data • Crash reports (anonymized)

1.7. Payment Data For Premium subscriptions, payment data is processed directly by our provider Stripe. StratAlp does not store your banking data.

2.1. Contract Execution (Art. 6.1.b GDPR)

Processing necessary for service provision: • Creation and management of your account • Provision of Application features • Import and processing of your GPS tracks (excluding heart-rate channel) • Generation of race strategies (non-physiological parts) • Subscription and payment management • User support

2.2. General Consent (Art. 6.1.a GDPR)

Processing subject to your prior consent: • Sending newsletters and marketing communications • Use of non-essential cookies • Connection to third-party services (Strava, Garmin, COROS, SUUNTO) • Real-time geolocation

You may withdraw your consent at any time.

2.3. 🩺 Explicit Consent for Health Data (Art. 9.2.a GDPR)

Heart rate (max, resting, recorded during effort), heart-rate zones, weight and height qualify as data concerning health within the meaning of Art. 4.15 and Art. 9.1 GDPR (see CJEU C-184/20 and French CNIL deliberation 2019-160). Their processing is based exclusively on your explicit consent (Art. 9.2.a GDPR), collected via a dedicated check-box at the moment you enter your sports profile, separate from your general acceptance of the Terms. You may withdraw this consent at any time from the Application's settings; doing so immediately stops physiological computations and lets you erase the corresponding fields. A Data Protection Impact Assessment (DPIA) has been conducted for this processing, in line with CNIL guidance.

2.4. Legitimate Interests (Art. 6.1.f GDPR)

Processing based on our legitimate interests: • Application improvement and new feature development • Anonymized statistical usage analysis • Fraud prevention and service security • Dispute and litigation management

2.5. Legal Obligations (Art. 6.1.c GDPR)

Retention of billing data (10 years) Response to judicial requisitions

3.1. StratAlp Team

Only authorized StratAlp team members have access to your data, limited to what is necessary for their functions.

3.2. Technical Subcontractors

We use service providers for service operation:

*Transfers governed by Standard Contractual Clauses

3.3. Third-Party Services (with consent)

If you connect your account to third-party services: • Strava: Activity import/export • Garmin Connect: Watch synchronization • Apple Health / Google Fit: Health data

These services are subject to their own privacy policies.

3.4. We Never Sell Your Data

Your personal data is never sold, rented, or exchanged for commercial purposes with third parties.

3.5. Competent Authorities

We may be required to communicate your data to authorities upon judicial requisition.

Some of our providers are located outside the European Union, particularly in the United States.

4.1. Protection Guarantees

For these transfers, we implement appropriate safeguards: • Standard Contractual Clauses (SCC): Contracts approved by the European Commission ensuring adequate protection level • EU-US Data Privacy Framework (DPF): European Commission adequacy decision of 10 July 2023. Stripe is DPF-certified (see dataprivacyframework.gov), in addition to SCC • Additional technical measures: Data encryption in transit and at rest • Local legislation assessment: Analysis of local laws' impact on data protection

4.2. Data Location

Most of your data is hosted on servers located in France (OVH).

4.3. Additional Information

You can obtain a copy of implemented safeguards by contacting us at contact@stratalp.io

We retain your data for the following periods:

Account deletion (GDPR Art. 17). From your account settings, you can request deletion of your account at any time. The request opens a 30-day grace window during which the account is disabled but recoverable:

• you can cancel the deletion from your account ("Restore my account");
• no sign-in is possible during the window;
• no marketing email is sent.

After 30 days, the account is purged automatically along three distinct paths:

1. Full erasure — public profile, physiological settings, strategy projects, personal inventory templates, notification subscriptions, authentication tokens.
2. Anonymisation (records stay, link to your identity is severed) — page views and analytics sessions, admin audit logs, editorial authorship trails. These records can no longer be traced back to an identifiable person.
3. Retention under legal obligations (link to your identity severed) — invoices, subscription history, payments, kept for 10 years under Article L.123-22 of the French Code de Commerce. No new processing occurs after you leave.

Your public routes — at deletion time you choose what happens to them:

• Anonymise — routes stay accessible to users who bookmarked them, with no link to your identity;
• Delete — routes disappear immediately for everyone.

This choice is applied at request time and cannot be reversed, even if you cancel the deletion within the grace window.

Data export: Before deletion, you can export your data from your account settings.

Under GDPR, you have the following rights:

6.1. Right of Access (Art. 15) Obtain confirmation that your data is processed and receive a copy.

6.2. Right to Rectification (Art. 16) Have your inaccurate or incomplete data corrected.

6.3. Right to Erasure (Art. 17) Request deletion of your data in certain cases (consent withdrawal, data no longer necessary, etc.).

6.4. Right to Restriction (Art. 18) Request suspension of your data processing in certain cases.

6.5. Right to Portability (Art. 20) Receive your data in a structured, machine-readable format (JSON, GPX).

6.6. Right to Object (Art. 21) Object to processing of your data based on legitimate interest.

6.7. Right to Withdraw Consent Withdraw your consent at any time for processing subject to it.

6.8. Post-Mortem Directives (Art. 85 of the French Data Protection Act) Under Article 85 of the French Data Protection Act (Law No. 78-17 of 6 January 1978), you may define directives on the fate of your personal data after death — general (registered with a CNIL-certified digital trustee, applicable to all controllers) or specific to StratAlp.

Specific directives at StratAlp may be set by email to contact@stratalp.io or from your account (Privacy → Post-Mortem Directives), specifying: identity of a designated trusted person; categories of data concerned; desired outcome (retention, transmission to heirs, erasure, anonymisation). You may amend or revoke them at any time.

In the absence of directives, your heirs may, upon production of a death certificate and proof of capacity, exercise access and rectification rights as needed to settle the estate (closure of account, objection to commercial processing, communication of necessary information). On notification of death, StratAlp may close the account, suspend communications and implement received directives.

How to exercise your rights: • In the Application: Settings > Privacy > My Data • By email: contact@stratalp.io • By mail: At the registered office address

We respond within a maximum of one month.

6.9. Complaint to CNIL If you believe your rights are not respected, you may file a complaint with the CNIL: • Website: www.cnil.fr • Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

We implement appropriate technical and organizational measures to protect your data:

7.1. Technical Measures

• Encryption in transit: TLS 1.3 for all communications • Encryption at rest: AES-256 encryption of sensitive data • Password hashing: bcrypt algorithm with salt • Strong authentication: 2FA option available • Network segmentation: Environment isolation • Updates: Regular application of security patches

7.2. Organizational Measures

• Limited access: Principle of least privilege • Traceability: Logging of data access • Training: Team awareness on data protection • Procedures: Security incident response management

7.3. Breach Notification

In case of data breach presenting a risk to your rights, we will inform you promptly and notify the CNIL within 72 hours.

8.1. Imported GPS Tracks

When you import a GPS track (GPX file), we process the geolocation data it contains: • GPS coordinates (latitude, longitude, altitude) • Point timestamps • Supplementary data (heart rate, cadence, etc.)

This data enables: • Display of your route on map • Elevation and distance calculation • Generation of your race strategy

8.2. Real-Time Geolocation

If you enable geolocation, we collect your position to: • Display your position on map • Suggest nearby routes • Provide localized weather information

You can disable geolocation at any time in your device settings.

8.3. Anonymization

For global statistical analyses (trail traffic), we use only aggregated and anonymized data.

9.1. Nature of Data

If you choose to synchronize health data, we may collect: • Heart rate (resting, max, zones) • Effort and recovery data • Sleep data • Caloric expenditure

9.2. Explicit Consent

Collection of health data requires your explicit consent. You may withdraw it at any time.

9.3. Use

This data is used to: • Personalize your heart rate zones • Estimate your energy expenditure • Adapt your nutritional recommendations • Analyze your performances

9.4. Enhanced Protection

Health data benefits from enhanced protection: • Systematic encryption • Strictly limited access • Minimal retention

The Application uses cookies and similar technologies. For more details, consult our Cookie Policy.

10.1. Essential Cookies Necessary for Application operation: • Authentication and session maintenance • User preferences (language, theme) • Security (CSRF prevention)

10.2. Analytics Cookies (with consent) Allow us to improve the Application: • Audience measurement • User journey analysis • Error identification

10.3. Cookie Management You can manage your preferences: • In the Application: Settings > Privacy > Cookies • Via your browser settings

11.1. Minimum Age

The Application is intended for persons aged at least 16 years.

11.2. Minors 16-18 Years

Minors aged 16-18 may use the Application subject to their legal representative's agreement for paid subscriptions.

11.3. Minors Under 16

We do not knowingly collect personal data from minors under 16. If you become aware that a minor under 16 is using the Application, please contact us immediately at contact@stratalp.io so we can delete their account and data.

11.4. Parental Control

We encourage parents to monitor their children's Internet use.

12.1. Evolutions

This Privacy Policy may be updated to reflect: • Service evolutions • Regulatory changes • User feedback

12.2. Notification

In case of substantial modification, we will inform you by: • Email to the address associated with your account • Notification in the Application • Display upon login

12.3. Update Date

The last update date is indicated at the top of this document.

12.4. Previous Version

You may request previous versions of this policy by contacting us.

For any questions regarding this Privacy Policy or your personal data:

Data Protection Officer: Email: contact@stratalp.io

Mail: Jérôme BUISINE 129 Impasse des Embrunes 74230 Dingy-Saint-Clair France

Supervisory Authority: Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy, TSA 80715 75334 Paris Cedex 07 www.cnil.fr