Privacy PolicyCopy Anchor Link

Last updated: September 16, 2026

At sincrona, we take our users' privacy seriously. This Privacy Policy explains what personal data we process, what we use it for, how we protect it, and what rights users may exercise.

This information is provided in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and the applicable Spanish regulations.

1. Data controllerCopy Anchor Link

The controller of the personal data processed by sincrona is:

• Owner: Pablo Caraballo Llorente
• Address: Madrid, Spain
• Email: hola@sincrona.cc

For certain operations related to data that a Workshop enters and manages about its own customers, sincrona may act as a data processor on behalf of the Workshop. In these cases, the Workshop remains the controller for those processing activities.

This distinction is explained in more detail in this Policy.

2. What data do we process?Copy Anchor Link

The data processed depends on the type of User and how they use sincrona.

2.1. Workshop dataCopy Anchor Link

When a Workshop creates an account, we may process:

• the name by which the Workshop is identified;
• email address;
• telephone number, including the international dialing code;
• information necessary to manage the account and provide the service.

2.2. Cyclist dataCopy Anchor Link

The personal data associated with a Cyclist's account may include:

• name;
• surname(s);
• email address;
• phone number;
• international dialing code;
• communication preferences and channels.

Cyclists do not create their account directly. The account is created as a result of an invitation made by a Workshop and its use requires acceptance by the Cyclist.

2.3. Information from identity providersCopy Anchor Link

sincrona uses external authentication services to manage user identities. We currently use Auth0.

Depending on the method used to sign up or sign in, certain data may come from the identity provider chosen by the User.

For example, when the User uses Google or another social login provider, data such as first name, last name, or profile picture provided by that provider may be received.

Authentication credentials, such as passwords, are not accessible to sincrona.

2.4. Data from StravaCopy Anchor Link

sincrona currently allows a Strava account to be connected in order to synchronize information related to cycling activity.

When the User connects Strava, we may process:

• account and connection identifiers necessary to maintain the integration;
• access and refresh tokens (access_token, refresh_token) and other technical data required for authentication;
• bicycle identifiers and names;
• activity dates;
• distances;
• activity duration;
• the bicycle associated with each activity.

The User may disconnect Strava from sincrona at any time. Once the integration is disconnected, sincrona will stop performing new synchronizations with the Strava account.

Disconnecting Strava does not necessarily imply deleting information that has already been imported and stored in sincrona.

2.5. Information entered by WorkshopsCopy Anchor Link

Workshops may enter information related to bicycles and maintenance services.

This information may include:

• bicycle information;
• services performed;
• maintenance dates;
• mileage;
• components;
• maintenance observations;
• notes;
• documents, images, or other files associated with a service.

For example, a Workshop may record an observation such as:

"Chain at mid life. Tires replaced with new ones."

Workshops are responsible for the information they enter into sincrona and must avoid entering unnecessary personal data or specially protected data in notes, observations, or attached files.

When the Workshop enters personal information about its customers into sincrona to manage its relationship with them, the Workshop may act as controller and sincrona as processor, in accordance with the terms of the corresponding data processing agreement.

2.6. Technical and operational dataCopy Anchor Link

sincrona does not currently use third-party analytics systems.

However, certain technical data may be necessary to provide, protect, and maintain the service, including information related to operations performed on data, authentication, security, or system operation.

sincrona may in the future incorporate monitoring, security, or diagnostic tools that involve the processing of certain technical data.

3. Where do we obtain the data from?Copy Anchor Link

Personal data may come from different sources:

• directly from the User;
• from the Workshop that invites a Cyclist to use sincrona;
• from the identity provider used to sign up or sign in;
• from Strava, when the User connects their account;
• from the use of the service itself;
• from communications with sincrona.

When a Workshop enters information about one of its customers, the original source of that information may be the Workshop itself.

4. What do we use the data for?Copy Anchor Link

We use personal data and information associated with accounts for the following purposes.

4.1. Providing and managing sincronaCopy Anchor Link

We process the data necessary to:

• create and manage accounts;
• authenticate Users;
• allow access to the service;
• maintain relationships between Workshops and Cyclists;
• provide the contracted or requested features;
• synchronize information with external services;
• manage bicycles and maintenance services;
• generate maintenance calculations and alerts;
• manage communication preferences.

4.2. Maintaining securityCopy Anchor Link

We may process information necessary to:

• protect accounts;
• detect and prevent unauthorized access;
• detect fraudulent or abusive use;
• protect infrastructure;
• investigate security incidents;
• enforce our Terms and Conditions.

4.3. Service-related communicationsCopy Anchor Link

We may use contact details to send communications necessary for the operation of sincrona.

These may include, for example:

• invitations;
• confirmations;
• maintenance alerts;
• account-related notifications;
• technical communications;
• information necessary to use certain features.

We currently use Brevo for certain transactional emails and WhatsApp via Meta's API for certain communications when this channel is enabled and authorized by the User.

4.4. Commercial communicationsCopy Anchor Link

sincrona may in the future send commercial communications directly related to sincrona, such as information about new features, services, plans, or product updates.

These communications will be subject to the User's preferences and to the relevant opt-out or unsubscribe options under applicable law.

5. Service improvement and use of pseudonymized informationCopy Anchor Link

sincrona may use information generated through use of the service to improve its features, calculations, and algorithms.

Among other uses, this may include:

• analyzing wear patterns;
• improving maintenance calculations;
• developing prediction models;
• improving intervals and estimates;
• analyzing the technical behavior of components;
• developing new features;
• preparing aggregated statistics;
• detecting maintenance patterns;
• training and evaluating machine learning models.

Whenever possible and appropriate, these uses will be carried out using aggregated or pseudonymized information and without directly using identifying user data.

Technical information may be retained after an account is deleted when it has been separated from identifying data and may be used in a manner compatible with this purpose.

Pseudonymization does not by itself mean that data ceases to be personal data when additional information exists that allows it to be linked back to a person.

6. Legal bases for processingCopy Anchor Link

The legal basis used will depend on the specific purpose of the processing.

6.1. Performance of the contractCopy Anchor Link

We process the data necessary to provide sincrona, manage accounts, and deliver the features requested by the User on the basis of the performance of the contractual relationship.

6.2. Compliance with legal obligationsCopy Anchor Link

We may process certain data when necessary to comply with legal obligations applicable to sincrona.

6.3. Legitimate interestCopy Anchor Link

We may process certain data when necessary to satisfy the legitimate interests of sincrona or of third parties, provided that those interests do not prevail over the rights and freedoms of Users.

This may include, among other purposes:

• security;
• fraud prevention;
• protection of systems;
• defense of rights;
• improvement and maintenance of the service.

When we use legitimate interest as the legal basis, we will take into account the nature of the processing, its possible effects, and the User's reasonable expectations.

6.4. ConsentCopy Anchor Link

We will request consent when required under applicable law.

The User may withdraw their consent when the processing is based on it.

Withdrawal of consent will not affect the lawfulness of processing carried out before that withdrawal.

7. Workshops as data controllersCopy Anchor Link

An important part of the information managed through sincrona comes from Workshops.

When a Workshop uses sincrona to manage information about its own customers and determines the purposes for which that information is used, the Workshop may act as controller and sincrona as processor.

In these cases, sincrona will process the information following the Workshop's instructions and in accordance with the applicable data processing agreement.

The Workshop will be responsible for:

• determining the purposes of those processing activities;
• having an appropriate legal basis;
• providing its customers with the legally required information;
• ensuring that the data entered is adequate and relevant;
• not entering unnecessary information;
• avoiding the entry of special categories of data unless there is a legal basis allowing it and it is necessary;
• fulfilling the obligations applicable to the controller.

The contractual relationship between the Workshop and sincrona may be supplemented by a Data Processing Agreement (DPA).

8. Recipients and providersCopy Anchor Link

To provide sincrona, we may use technology providers that process data on our behalf or participate in certain services.

Currently, the main services used include:

• Auth0, for identity management and authentication;
• Brevo, for certain transactional emails;
• Meta, for communications made through WhatsApp;
• Strava, when the User connects their account and uses the relevant integration;
• social login providers, when the User chooses to use this authentication method.

These providers will only have access to the information necessary to provide the corresponding functions, in accordance with the conditions applicable to each service.

sincrona will select and manage its providers taking into account the guarantees required in terms of data protection.

9. International transfersCopy Anchor Link

sincrona will seek to ensure that personal data processing takes place within the European Economic Area whenever possible.

The Auth0 authentication service currently used by sincrona is configured in a tenant located in the European Union.

However, certain technology providers may perform processing operations from other countries or use subprocessors located outside the European Economic Area.

Where there is an international transfer of personal data, sincrona will apply the mechanisms and safeguards required by applicable law.

Information about providers and transfer mechanisms may be updated when the services used by sincrona change.

10. Data retentionCopy Anchor Link

We retain personal data for as long as necessary to provide the service and fulfill the purposes described in this Policy.

Specific periods will depend on the nature of the data and the purpose for which it is processed.

When a User deletes their account, sincrona will delete the personal data that identifies them and that is associated with their identity.

Technical and operational information may be retained in pseudonymized or aggregated form when it is no longer linked to the User's personal identity and its retention is necessary or compatible with the purposes described in this Policy.

Certain information may be retained for additional periods when necessary to:

• comply with legal obligations;
• address legal liabilities;
• resolve disputes;
• prevent fraud or abuse;
• ensure security;
• maintain necessary technical records.

11. Account deletionCopy Anchor Link

The User may request the deletion of their account.

Deletion implies the deletion of their identity from the authentication system used by sincrona and of the personal data associated with that account that allows them to be identified.

Identity information is currently managed through Auth0.

Deleting the identity does not necessarily imply deleting all technical information generated during use of the service.

For example, information about bicycles, maintenance services, notifications, calculations, or wear may be retained using random technical identifiers, provided that it has been separated from the data that makes it possible to identify the User personally.

This architecture makes it possible to retain historical and statistical service information without keeping it directly associated with the deleted personal identity.

12. Users' rightsCopy Anchor Link

Users may exercise, where applicable, the following rights:

• access to their personal data;
• rectification of inaccurate data;
• erasure of the data;
• restriction of processing;
• objection to processing;
• data portability;
• withdrawal of consent when processing is based on it;
• not being subject to certain decisions based solely on automated processing, where applicable.

The exercise of these rights will depend on the nature of the processing and the role in which sincrona processes the data.

In particular, when sincrona acts as processor on behalf of a Workshop, certain requests must be handled by the Workshop as controller. sincrona will cooperate with the Workshop under the terms established in the relevant data processing agreement.

To exercise rights in relation to sincrona, you may write to:

hola@sincrona.cc

We may request additional information to reasonably verify the identity of the person making the request.

13. Cyclist data managed by a WorkshopCopy Anchor Link

When a Cyclist uses sincrona through an invitation from a Workshop, certain data may initially have been provided by that Workshop.

Acceptance of the invitation allows the Cyclist to access sincrona and establish the corresponding relationship.

The Cyclist may revoke the Workshop's access to their information at any time.

Revoking the Workshop's access does not amount to deletion of the Cyclist's account, nor does it necessarily imply deletion of the associated technical information.

14. SecurityCopy Anchor Link

sincrona applies technical and organizational measures intended to protect personal data against unauthorized access, loss, destruction, alteration, or improper disclosure.

Among other things, sincrona seeks to:

• limit access to personal information;
• separate identity information from operational information where appropriate;
• protect credentials and authentication mechanisms;
• apply access controls;
• protect communications;
• maintain measures intended to prevent unauthorized access;
• review and improve security measures as the service evolves.

Security measures will be reviewed taking into account the risks associated with the processing and technical developments.

15. MinorsCopy Anchor Link

sincrona is intended exclusively for persons over 18 years of age.

We do not knowingly seek to collect personal data from minors under 18 in order to allow them to use the service.

If you believe that a minor has created an account or provided personal data to sincrona, you may notify us at hola@sincrona.cc.

16. Email and WhatsApp communicationsCopy Anchor Link

Communications necessary to provide the service may be made through the channels available and authorized by the User.

We currently use:

• email, through Brevo for certain transactional messages;
• WhatsApp, through Meta's API, when the User has enabled this channel.

The User may modify their communication preferences from sincrona when this functionality is available.

Communications strictly necessary to provide the service may still be sent when necessary to perform the contractual relationship or comply with other applicable obligations.

17. Cookies and similar technologiesCopy Anchor Link

sincrona does not currently use third-party analytics systems.

Specific information about cookies and similar technologies used by the service is set out in the Cookie Policy.

18. Changes to this PolicyCopy Anchor Link

We may modify this Privacy Policy to reflect changes in:

• the service;
• the processing carried out;
• the providers used;
• applicable law;
• our privacy practices.

When changes are relevant, we will adopt reasonable measures to communicate them to Users when necessary.

The date of the latest update will appear at the beginning of this Policy.

19. ComplaintsCopy Anchor Link

If you believe that the processing of your personal data does not comply with applicable regulations, you may first contact sincrona to try to resolve the situation.

You also have the right to lodge a complaint with the competent supervisory authority.

In Spain, the supervisory authority is the Spanish Data Protection Agency (AEPD).

20. ContactCopy Anchor Link

For any questions related to this Privacy Policy or the processing of personal data, you may contact:

Email: hola@sincrona.cc