Privacy policy

1. Who we are

Victo is a running and fitness app that helps you train, record your runs, and follow structured workouts and plans. This Privacy Policy explains what personal data we collect, why we collect it, and what you can do about it.

Victo is operated by Victo B.V., a company registered in the Netherlands.

Address: Street 123, 1234 AB Amsterdam
Chamber of Commerce (KvK) number: 12345678
Privacy contact: privacy@victo.run

When we say “Victo,” “we,” “us,” or “our,” we mean Victo B.V. When we say “you,” we mean you, the person using our app or website.

Under data protection law, Victo is the data controller for your personal data. This means we're responsible for how it's collected and used, and for keeping it safe.

2. The short version

We've written this policy to be readable, but here's the gist if you're short on time:

• We collect the data you give us (like your account details) and the data your workouts generate (like your runs, routes, and heart rate).
• We use it to make Victo work: to record and show your activities, build your training plans, and improve the app.
• We never sell your data, and we don't use it for advertising or ad-tracking.
• Your health and fitness data is only processed with your explicit consent.
• Some of the services we rely on to run Victo are based outside Europe, including in the United States. We explain this below.
• You're in control: you can access, correct, export, or delete your data at any time.

The rest of this policy fills in the detail.

3. What data we collect

We only collect what we need to run Victo well. Here's what that includes.

Data you give us

• Account information, such as your email address and the sign-up details you provide when you create an account. Depending on the sign-up method you choose, this may come directly from you or from a third-party login provider (for example, Sign in with Apple).
• Profile information, such as a profile photo, if you choose to add one.
• Messages you send us, for example when you contact support.

Data from your activity

• Health and fitness data, such as your workouts, heart rate, pace, distance, and other performance metrics. On Apple devices, this is recorded through Apple HealthKit with your permission.
• Location and route data. When you record a run, we use your device's GPS to map your route. This data can be sensitive because it can reveal places like your home, so we handle it with care.

Data we collect automatically

• Device and technical information, such as your device type, operating system, app version, and similar technical details.
• Usage and diagnostic information, such as how the app is performing and crash reports, which help us find and fix problems.

We do not collect data for advertising, and we don't use third-party tracking or ad SDKs.

4. Why we use your data, and our legal basis

Data protection law requires a valid reason, a “legal basis,” for every way we use your data. Here's what we use your data for, and the basis for each.

Running Victo and giving you its features

Legal basis: our contract with you. This covers:

• Recording your runs and showing your activity feed
• Syncing your activities to Apple Health
• Managing your subscription if you have one (your payment itself is processed by the app store you downloaded Victo from, not by us)
• Sending you service messages that are part of using the app, such as reminders about your scheduled runs and important account notices

Using data you've given us permission for

Legal basis: your consent. This covers:

• Processing your health and fitness data, such as heart rate, workouts, and performance metrics, which receives extra protection under the law because it's considered sensitive
• Sending you marketing emails, such as a newsletter, if you've opted in

You give this consent during sign-up or in your settings, and you can withdraw it at any time. See “Your rights” below.

Keeping Victo secure and making it better

Legal basis: our legitimate interests. This covers:

• Diagnosing crashes, fixing bugs, and preventing abuse
• Keeping your account safe
• Understanding how features are used so we can improve the app

We use as little personal data as possible to do this.

5. Third-party services and sharing

We don't sell your data, and we never share it for advertising. We only share personal data in the situations described below.

Services that help us run Victo

We use trusted third-party companies to provide parts of our service, such as hosting our databases, storing files, sending emails, and helping us diagnose crashes and technical problems. These providers only process your data on our instructions, and only to the extent needed to do their job. They include providers of:

• Cloud hosting and databases
• File and media storage
• Email delivery
• Crash reporting and diagnostics

Services you connect

Victo can send your activities to other platforms when you choose to connect them, including Apple Health, Strava, Garmin, Coros, and Suunto. You decide whether to connect these, and you can disconnect them at any time. Once your data reaches one of these platforms, it's handled under that platform's own terms and privacy policy, not ours.

Sharing you choose

If you use Victo's share feature to post a run to social media or another app, you're publishing that content yourself. Once shared, it's governed by the terms and privacy policy of the platform you shared it to.

Our own social channels

If you interact with Victo on social media, such as our accounts on other platforms, those platforms process that interaction under their own policies.

Legal reasons

We may disclose personal data if we're required to by law, or where necessary to protect the rights, safety, or property of Victo, our users, or others.

6. Where your data is processed

Victo is a Dutch company, but some of the providers we rely on to run the service are located outside the European Economic Area (EEA), including in the United States. This means some of your personal data may be transferred to and processed in those countries.

When we transfer personal data outside the EEA, we make sure it's protected by appropriate legal safeguards, such as:

• transfers to countries or providers recognised by the European Commission as offering an adequate level of protection (including providers certified under the EU-US Data Privacy Framework); or
• Standard Contractual Clauses approved by the European Commission, which contractually commit the provider to protecting your data.

You can contact us at privacy@victo.run if you'd like more information about these safeguards.

7. How long we keep your data

We keep your personal data for as long as your account is active and we need it to provide Victo.

When you delete your account, we permanently erase your personal data. This can't be undone. Some content, such as images, is placed in a deletion queue and removed shortly afterwards. Copies may remain in our secure backups for a limited period, normally up to 30 days, before those backups are overwritten, after which the data is gone for good.

Payments for paid features are handled by third-party app stores and payment providers, not by us, so we don't store your payment details. Where we're legally required to keep certain records, such as for tax or accounting, we keep only what the law requires and no longer.

8. Your rights

You have a number of rights over your personal data, and we'll always help you exercise them. You can:

• Access the personal data we hold about you, and request a copy
• Correct data that's wrong or incomplete
• Delete your data, which you can do directly in the app by deleting your account
• Object to or restrict certain processing, including anything based on our legitimate interests
• Withdraw consent at any time, where we rely on your consent, such as for health and fitness data or marketing. Withdrawing consent doesn't affect anything we did before you withdrew it

Where our processing is based on your consent or our contract with you, you can also ask us for a copy of the activity data you've added to Victo, so you can move it elsewhere. You can already export individual activities as .fit files in the app, and you can contact us for a broader copy.

To make a request, contact us at privacy@victo.run. We'll respond within the timeframes required by law.

You also have the right to complain to a data protection authority. In the Netherlands, that's the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You can also contact the authority in your own country if you're in the EEA.

9. How we keep your data safe

We take the security of your data seriously and use appropriate technical and organisational measures to protect it. These include encrypting data in transit, restricting who can access it, and relying on established infrastructure providers with strong security practices.

No service can promise perfect security, but we work to protect your data and to respond quickly if something goes wrong. If a data breach ever affects your personal data and puts you at risk, we'll notify you and the relevant authority as required by law.

10. Children

Victo isn't intended for children. You must be at least 16 years old to use Victo, and by using it you confirm that you are. If you believe someone under 16 has used Victo and provided us with personal data, please contact us at privacy@victo.run and we'll take appropriate steps to delete it.

11. Cookies and tracking

We keep tracking to a minimum.

In our app, we use only what's necessary to keep you logged in and to keep the app working. We don't use advertising cookies or third-party ad-tracking, and we don't track you across other apps or websites.

On our website, victo.run, we currently use only essential cookies needed for the site to function. If we later introduce analytics or other non-essential tracking, we'll ask for your consent first, where the law requires it, and update this policy.

12. Marketing and communications

We'll send you messages that are part of the service, such as reminders about your scheduled runs, important account notices, and updates you need to know about. These come with using Victo.

If we ever send marketing messages, such as a newsletter or tips to get more out of Victo, we'll only do so if you've opted in, and every marketing message will include an easy way to unsubscribe. You can change your mind at any time.

13. Changes to this policy, and how to reach us

We may update this policy from time to time, for example if we add new features or change how we work. When we make significant changes, we'll let you know through the app or by email, and we'll always update the date at the top.

If you have any questions about this policy or your data, we're happy to help:

Victo B.V.
Street 123, 1234 AB Amsterdam
privacy@victo.run