Privacy Policy

1. Controller

Osium Tech LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA. Contact: contact@elyps.run.

As Elyps targets the European Union, a GDPR Article 27 representative must be appointed before European commercial launch. Its details will be published here.

2. Data processed

• Account: identity, email, language, settings, consents and subscription.
• Athlete profile: age, races, indexes, heart-rate zones and heart-rate values provided.
• Planning: GPX, routes, checkpoints, estimates, nutrition, equipment, assistance, weather and adjustments.
• Payment: customer and subscription IDs, status, amounts and invoices; full card data remains with the payment provider.
• Technical: IP, session, device, browser, important actions, errors and security.
• Support: messages, attachments and history.

3. Purposes and legal bases

• Contract: provide accounts, analyses, storage, imports and subscriptions.
• Separate explicit consent: process information that may be health data, including heart-rate values and zones.
• Legal obligation: accounting, tax, withdrawal and data-rights handling.
• Legitimate interests: security, fraud prevention, error diagnosis and measured service improvement.
• Consent: marketing and future optional trackers.

4. Recipients

Authorized Osium Tech LLC personnel and strictly necessary categories of providers may process data: hosting and infrastructure, payment, mapping and geolocation, weather, sports-result imports, communications and support. Some processing is triggered only at the user's request. The current processor list is available from contact@elyps.run. Elyps does not sell personal data.

5. International transfers

Osium Tech LLC is in the United States and providers may process data outside the EEA. Depending on the case, Elyps relies on an adequacy decision, the Data Privacy Framework, Standard Contractual Clauses or another GDPR safeguard. Relevant safeguards may be requested at contact@elyps.run.

6. Retention

• Active account, profile, GPX and races: while the relationship continues and the account is used.
• Inactive account: warning then deactivation after 2 years without activity, before deletion or justified limited archiving.
• Deleted account: prompt removal from active systems; residual backups purged within 12 months, except legally required records.
• Invoices and accounting: 10 years.
• Technical and security logs: rolling 12 months, except a specific incident, fraud or dispute.
• Support: up to 5 years after closure where evidence is needed.
• Consent and contract evidence: relationship duration plus applicable limitation period.

7. Your rights

You may request access, correction, deletion, restriction, objection, portability and withdrawal of consent at contact@elyps.run. Identity evidence is requested only where reasonably necessary. You may complain to the CNIL or your EEA supervisory authority.

8. Security

Elyps uses proportionate safeguards including encrypted communications, access controls, password hashing, backups, limited logging, updates and environment separation. No system is absolutely secure.

9. Cookies

Necessary cookies support authentication, security and language. Future optional trackers requiring consent will activate only after your choice. A policy and banner will be added before activation.

10. Changes

Material changes will be announced in Elyps or by email where necessary. The update date appears above.