Privacy policy

Controller and scope

VisualBranding UG (haftungsbeschränkt), represented by Patrick Zasada, Birkenweg 9, 64678 Lindenfels, Germany, operates longrideapp.com. Contact app@visual-branding.eu or +49 174 6830864. This notice is dated 26 October 2026.

This notice covers this website, account access, purchase matching and the partner programme. The separate route planner and iPhone app provide additional information about routes, location, community and photos. Visiting these information pages does not upload private routes or health data.

Website access

This website is prepared for hosting by ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The web server processes connection information such as IP address, request time, requested file, browser information and HTTP status to deliver the site and investigate technical incidents. The legal basis is Article 6(1)(f) GDPR.

Fonts, images and scripts are served from the website hosting. Google Analytics is loaded only after consent, as described below. Advertising pixels and automatically loaded social networks are not embedded. Operational logs are retained as needed for operation and security; incident records may be kept until an incident is resolved. Actual technical log retention depends on the hosting configuration.

Account and sign-in

The account pages use the existing Supabase authentication service. Account creation and sign-in process first name, last name, email address, account identifier, verification status and security and session data. Passwords are transmitted over an encrypted connection and processed securely by the authentication service. We do not email passwords.

Essential local browser storage holds session tokens and protects the sign-in flow. Sign out to end the session. Verification, invitation and recovery emails use the existing ALL-INKL mail service. Processing is based on Article 6(1)(b) GDPR and, for abuse prevention, Article 6(1)(f). Essential browser storage supports the login you requested under section 25(2) TDDDG.

Providers and international processing

Supabase Pte. Ltd. provides the database, authentication and protected backend functions. The existing project uses the EU region eu-west-1 (Ireland). This is not a commitment that all support, security and operational information stays in that region.

International transfers are subject to the applicable provider agreements and safeguards, including data processing terms and, where applicable, standard contractual clauses. Details: https://supabase.com/legal/customer-resources/data-processing-addendum and https://supabase.com/legal/privacy-resources/data-residency-and-transfers-faq. Access to private account and billing data is restricted to authorised parties and necessary service providers.

Partner account and statements

Partner registration processes name, verified email, country, public channel, optional company and the accepted terms version. It also processes partner identifier, referral link, status, commissions, statement records, invoice details and recorded payouts. This supports the partner agreement and its accounting obligations under Article 6(1)(b) and (c) GDPR.

Partners see their own financial records. They do not receive purchaser email addresses or private Longride content. Authorised administrators can review statements and corrections, which are logged. Successful registration triggers a transactional welcome email and does not subscribe you to a newsletter.

Optional referral attribution

With your explicit consent, a referral link can be stored in your browser for up to 30 days and linked to your signed-in account. This storage does not happen without consent. We do not fingerprint devices. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG.

Before the first paid purchase, the latest valid consented referral applies. Server-side attribution requires a verified account and a supported order record.

You can withdraw optional attribution and remove the browser record in the partner or referral area. The scheduled server cleanup removes unused raw attribution seven days after expiry, which is 37 days after consent for the normal 30-day period. A withdrawal marker is retained until cleanup after 37 days from withdrawal to prevent an earlier ticket from being reactivated. Existing accounting evidence remains subject to applicable retention duties. Withdrawal takes effect for the future.

Referral attribution is chosen separately from Google Analytics in the privacy settings in the footer. We remember this choice without a partner identifier for up to 180 days. Each referral ticket remains valid for a maximum of 30 days. You can change the choice and remove the local ticket in the same settings. If you are signed out, withdrawal of a referral already linked to your account is completed when you next sign in with a verified account in the account area.

Contact and external links

We use your message and contact details to respond to an enquiry under Article 6(1)(b) or (f) GDPR as appropriate. Resolved enquiries are removed when no longer needed for their purpose or legal retention duties.

The route planner, zasada.cc and other links open separate websites on request. Their privacy notices apply there. This site does not silently embed external websites in an iframe.

Your rights

Subject to legal conditions, you may request access, correction, erasure, restriction and portability. You can object to processing based on legitimate interests on grounds relating to your circumstances. Consent can be withdrawn at any time for the future.

Contact app@visual-branding.eu. You can complain to a supervisory authority, including the Hessian Commissioner for Data Protection: https://datenschutz.hessen.de/service/beschwerde-uebermitteln. Unclear automated purchase checks can be reviewed by us.

Google Analytics for audience measurement

With your consent, we use Google Analytics to measure use of the public website and completed purchases. The provider is Google Ireland Limited, Ireland; Google companies in the United States may also process data. The Google tag loads only after consent and records page visits and selected actions on permitted public pages. Google may receive technical browser and device data, IP address information and an identifier stored in analytics cookies. Private pages and addresses with query parameters are excluded from page measurement. Of URL fragments, only #offer and #angebot are permitted; our events send the page address without a fragment.

A purchase is recorded only after our backend confirms that checkout is complete and you have given consent. The data sent to Google is limited to a pseudonymous transaction identifier, the selected monthly or annual plan, the net amount and the included tax in EUR. We do not send names, email addresses, postal addresses, card details or route data. Purchase measurement loads the Google tag in a separate technical measurement frame served from the same website origin. The contents of your private account area are neither loaded into that frame nor sent to Google.

To prevent duplicate purchase events, we store pseudonymous transaction identifiers in your browser for up to 180 days. Your selection and analytics cookies may be stored for up to 180 days; browser restrictions may shorten this period. In the Analytics property event data is retained for two months and user data for fourteen months. Renewed activity resets the retention period for user data; aggregated standard reports may have different retention periods. Google may transfer data to the United States. The legal basis for optional analytics is your consent. You may refuse or withdraw it at any time using Privacy settings in the footer, with effect for the future. No Google Analytics request is sent before your consent.

Checkout, payments and subscription management with Stripe

When you start checkout, we send Stripe your verified Longride account identifier, email address, selected plan and any verified discount. Stripe processes the billing and payment information entered at checkout and technical information for payment processing and fraud prevention. Full card details and bank login credentials are not stored in the Longride database.

Depending on the service, Stripe acts as a processor or an independent or joint controller. For European customers, the relevant entities include Stripe Technology Company, Limited and Stripe Payments Europe, Limited in Ireland and the applicable regulated Stripe entity. Information on entities, international transfers and safeguards is available at https://stripe.com/privacy and https://stripe.com/legal/privacy-center. The data processing agreement is available at https://stripe.com/legal/dpa.

We collect your billing name and confirmed billing address on the Longride website and retain them securely with the relevant checkout. Original invoices and credit notes, including their PDF files, invoice data and delivery records, are stored in a protected archive for contract administration, email delivery and statutory recordkeeping.

We receive the customer, subscription, invoice and payment identifiers, plan, amounts, tax, payment and refund status and term and cancellation data necessary for the contract and access entitlement. Protected reconciliation assigns them to your verified Longride account. The legal bases are GDPR Article 6(1)(b) for the contract, (c) for statutory records and (f) for preventing abuse. Unclear payment records can be reviewed by us.

PayPal as a payment method

If you choose PayPal at checkout and it is available for your subscription, PayPal processes the account and transaction information required for payment and recurring debits under its own privacy terms. For customers in the European Economic Area, the relevant entity is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Selecting it initiates the required communication with PayPal; browsing our information pages does not initiate a PayPal payment.

PayPal may process information outside the EEA for payments, security checks and its legal obligations. Its recipients, transfer safeguards and your rights are explained at https://www.paypal.com/de/legalhub/paypal/privacy-full. Our transfer for your selected payment method is based on GDPR Article 6(1)(b); statutory records are based on Article 6(1)(c).

Cancellation, withdrawal and contract records

For cancellation and withdrawal, we process your name, information identifying the contract, confirmation email, statement and receipt time. Extraordinary cancellations also include the reason you provide. Please include only information necessary for your request. The forms do not require sign-in.

We retain the statement and delivery evidence, acknowledge receipt and process it after secure identification. Limited technical abuse-prevention values help protect the service without disclosing contracts to third parties. The legal bases are GDPR Article 6(1)(b) and (c), and (f) for abuse prevention. Invoices and accounting records are generally retained for eight years from the end of the year in which they arose, subject to any applicable different or extended statutory period. Other contract records are kept only as long as needed for the contract, legal obligations or unresolved claims.

Partner codes at checkout

When you deliberately enter a partner code at checkout, we verify it and attribute an eligible purchase to that partner. Storing a referral link in your browser continues to require your separate voluntary consent. Partners do not receive customer email addresses, payment details or private Longride content. Necessary accounting evidence remains subject to statutory retention requirements.