InCycling
← Back to Home

Privacy Policy

Last updated: 28 September 2026

1. Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

InCycling GmbH
Gustav-Adolf-Straße 154
13086 Berlin, Germany

Phone: +4915150663825
Email: info@incycling.ai

Represented by its Managing Directors: Dr. Karym Zupan El Sayed and Sascha Karhöfer.

2. Data Protection Officer

We have not appointed a data protection officer because, based on our current processing activities, the statutory appointment requirements under Article 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG) are not met.

3. Website Hosting Through Lovable

We create, publish and host this website using the Lovable platform. The provider identified in Lovable's generally available Data Processing Agreement is:

Lovable Labs Incorporated
1 Lincoln Street
Boston, MA 02111
United States

Lovable's signed Data Processing Agreement provides the following data-protection contact:

Representative: Assenteo Ltd
c/o Lovable Labs AB
Box 190
101 23 Stockholm
Sweden
Email: dpo@lovable.dev

Lovable provides the technical platform and hosting environment and processes personal data arising from the operation of this website on our behalf. This may include the hosting and delivery of website content, processing of contact-form submissions, storage, security, error diagnosis, logging and deployment.

When you access the website, technical connection and log data may be processed. These data may include:

  • the IP address and approximate location of the requesting device;
  • the date and time of access;
  • the requested page, resource or API endpoint;
  • referrer information;
  • browser type and version, operating system and device information;
  • session or device identifiers;
  • usage, error and diagnostic information; and
  • information required to detect attacks, fraud or other misuse.

The purposes are to provide and deliver the website, process user requests, maintain availability and security, prevent misuse and troubleshoot technical errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and abuse-resistant operation of the website and our IT systems. Where processing is necessary to perform a contract or take steps at your request before entering into a contract, Article 6(1)(b) GDPR also applies.

Lovable uses infrastructure and other subprocessors to provide its services. According to Lovable's current subprocessor information, these include Amazon Web Services for customer applications, databases and file storage, and Cloudflare for global edge routing, DNS and related services. AWS therefore acts in this setup as a subprocessor of Lovable rather than as our direct hosting provider. Lovable may change or add subprocessors in accordance with its contractual terms. The current list is available at https://trust.lovable.dev/subprocessors.

The regular storage period for specific technical logs is determined by Lovable's applicable service configuration and contractual retention schedule. We retain personal data only for as long as necessary for the purposes described above. According to Lovable's Data Processing Agreement, customer personal data may be retained for the term of the agreement and is returned or deleted following a valid written request or termination, subject to limited backup, fraud-prevention, legal-defence and statutory-retention exceptions.

Processing Outside the EEA

Lovable Labs Incorporated is established in the United States, and Lovable's subprocessor list also includes providers or processing locations outside the European Economic Area (EEA). Where no adequacy decision under Article 45 GDPR applies, Lovable's Data Processing Agreement incorporates the European Commission's Standard Contractual Clauses, including Module Two for controller-to-processor transfers, pursuant to Article 46(2)(c) GDPR. Lovable also undertakes to impose corresponding data-protection obligations on its subprocessors.

Further information is available at:

4. Contact by Email or Contact Form

If you contact us by email or through the contact form, we process the information you provide, including your name, email address, company, role, contact details, message content and technically necessary metadata, in order to respond to your request.

Where your request concerns a contract or steps taken at your request before entering into a contract, the legal basis is Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is to communicate with persons who contact us and to process their enquiries. Where processing is necessary to comply with a legal obligation, Article 6(1)(c) GDPR also applies.

Lovable and its relevant subprocessors may process contact-form data to provide the technical form, transmission, storage and security functions described in Section 3.

We delete contact data when the enquiry has been conclusively dealt with and no further retention is necessary. This does not apply where contractual or statutory retention obligations apply or where the data are required to establish, exercise or defend legal claims. Commercial and tax-law records are retained for the period required by the applicable law.

5. Cookies and Similar Technologies

We use cookies, local storage and similar technologies where necessary to operate the website, remember your privacy selection, maintain security or provide a function requested by you.

Where storing information on, or accessing information from, your device is strictly necessary to provide a digital service expressly requested by you, no consent is required under Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Any related processing of personal data is based on Article 6(1)(f) GDPR, unless another legal basis applies. Our legitimate interest is to provide a functional and secure website.

For non-essential technologies, including optional visitor analytics, we obtain your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR before the relevant storage, access or processing takes place.

You can change or withdraw your consent at any time with effect for the future using the “Cookie Settings” link in the website footer. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Lovable Visitor Analytics

Subject to your prior consent, we use the visitor-analytics functionality provided as part of the Lovable platform. Lovable describes the information generated by this functionality as “App Usage Data” and processes it on our behalf.

Depending on Lovable's current implementation and configuration, the analytics instrumentation may process information about visits and page views, pages or features used, visit duration, traffic source or referrer, approximate location, device and browser type, session identifiers and technical performance information. The purpose is to understand how the website is used and to improve its content, usability and technical performance.

The legal bases are your consent under Article 6(1)(a) GDPR and, for storing information on or accessing information from your device, Section 25(1) TDDDG. Visitor analytics must remain blocked until you have given consent. You can withdraw your consent at any time through the cookie settings.

Lovable and the relevant infrastructure or analytics subprocessors may process these data as described in Section 3. Lovable states that App Usage Data are user data controlled by the customer and are not used to train Lovable's AI models. Lovable may produce de-identified information for service improvement and comparative insights in accordance with its contractual and privacy terms.

Further information is available at https://lovable.dev/privacy.

7. External Fonts – Temporary Disclosure

This website currently retrieves the “Inter” font from Google Fonts. The provider for users in the EEA is:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4, Ireland

When the font stylesheet or font files are retrieved, the user's IP address, browser information and the requested resource are transmitted to Google in order to deliver the font. Google may involve Google LLC and other providers outside the EEA.

The current implementation must not contact Google before the visitor has given any consent required under Section 25(1) TDDDG and Article 6(1)(a) GDPR. Consent may be withdrawn through the cookie settings. Information about Google's international data-transfer mechanisms is available at https://policies.google.com/privacy/frameworks.

To avoid this external request and the associated transfer, we intend to host the font files locally. Once this has been implemented and verified, this section will no longer apply.

8. Recipients and Service Providers

We disclose personal data only where necessary for the purposes described in this privacy policy, where we are legally required to do so, or where you have consented.

Recipients or categories of recipients may include:

  • Lovable Labs Incorporated or the Lovable entity identified in our contract, for website creation, hosting, deployment, forms, visitor analytics, logging, security and technical support;
  • Lovable's relevant infrastructure and service subprocessors, including Amazon Web Services and Cloudflare;
  • Google Ireland Limited and Google LLC for the external font delivery described in Section 7, until the fonts are locally hosted;
  • providers supporting website maintenance, development, IT security and technical support; and
  • authorities, courts, advisers or other recipients where disclosure is legally required or necessary to establish, exercise or defend legal claims.

Where a service provider acts as our processor, it is contractually bound in accordance with Article 28 GDPR. International transfers are protected as described in the relevant sections above.

9. Storage Periods

We retain personal data only for as long as necessary for the relevant purpose and subsequently delete or anonymise them, unless a statutory retention obligation or the establishment, exercise or defence of legal claims requires longer retention.

The principal periods are:

  • Lovable hosting, security and operational data: according to the applicable Lovable service configuration and contractual retention schedule;
  • contact enquiries: until the enquiry has been conclusively dealt with, followed by any applicable contractual or statutory retention period; and
  • consent records: for as long as necessary to demonstrate that valid consent was obtained and to establish, exercise or defend legal claims.

10. Your Rights

Subject to the applicable statutory requirements, you have the right to:

  • obtain access to your personal data under Article 15 GDPR;
  • request rectification of inaccurate or incomplete data under Article 16 GDPR;
  • request erasure under Article 17 GDPR;
  • request restriction of processing under Article 18 GDPR;
  • receive data you have provided in a structured, commonly used and machine-readable format and transmit those data to another controller under Article 20 GDPR; and
  • object to processing under Article 21 GDPR.

Right to Object

Where we process your personal data on the basis of Article 6(1)(f) GDPR, you may object at any time, on grounds relating to your particular situation, to that processing. We will then cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you may object at any time to such processing, including related profiling. We will then no longer process your personal data for direct marketing.

Where processing is based on consent, you may withdraw that consent at any time with effect for the future under Article 7(3) GDPR. The lawfulness of processing carried out before withdrawal is unaffected.

To exercise your rights, contact us using the details in Section 1.

11. Right to Lodge a Complaint

You have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.

The supervisory authority responsible for our registered office is:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin, Germany
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Website: https://www.datenschutz-berlin.de/

12. Changes to This Privacy Policy

We may update this privacy policy where necessary due to changes in our processing activities, services or applicable law. The current version will be made available on this website. Where required by law, we will separately inform you of material changes or obtain renewed consent.