App Privacy Policy
Last updated: June 2026
This policy explains how the VlastLap mobile app handles your data. For the website and waitlist, see our website Privacy Policy.
1. Controller
The controller responsible for processing your data in the app is:
VCZ Software und Systementwicklung UG (haftungsbeschränkt) i. G.
Fritz-Frey-Straße 2
69121 Heidelberg
Deutschland
Email: [email protected]
2. Data the app processes
- Account information. If you create an account, we process your name and email address to identify you and sync your data across devices.
- Location data. When you record a session, the app uses your device's precise GPS location to measure lap times, speed and track position. This is the core function of the app. Location is processed while you are recording; you control this permission at any time in iOS Settings.
- Connected devices & sensors. If you pair external sensors or devices (e.g. via Bluetooth), the app processes the data they send in order to record your sessions.
- Session data. Your recorded laps, sessions and settings. These are stored on your device and, if you enable sync, in your account.
- Diagnostics & usage. Crash reports and basic, aggregated usage data to keep the app stable and improve it.
- Purchases. Subscriptions and in-app purchases are processed by Apple. We receive confirmation of your entitlement, not your payment card details.
3. Why we process it and legal bases
We process your data to provide the app and the features you request — recording and timing sessions, managing your account and purchases, and providing support. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for the app's functionality and your account; legitimate interest (Art. 6(1)(f) GDPR) in keeping the service stable and secure for diagnostics.
4. Sharing and processors
We do not sell your data and we do not use it for advertising. We use the following processors under data-processing agreements:
- Apple, Inc. — App Store distribution, purchases and push notifications.
- Amazon Web Services (AWS) — hosting and storage of your account and synced session data, in an EU region (Frankfurt, Germany).
- Resend (Plus Five Five, Inc.) — transactional emails (e.g. account confirmation).
Your account and session data are stored on AWS servers located in the European Union. Where a processor is US-based (e.g. Apple, Resend), any transfer is safeguarded by EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
5. Retention
We keep your account data for as long as your account is active. Session data stored only on your device is removed when you delete it or uninstall the app. Synced data is deleted when you delete your account (see below).
6. Account and data deletion
You can delete your account and all associated data at any time from within the app under Settings → Account → Delete account, or by emailing [email protected]. We will process your request without undue delay.
7. Your rights
You have the right to access, rectification, erasure, restriction, data portability, and to object to processing, as well as to withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority.
8. Children
The app is not directed to children under 16 and we do not knowingly collect their data.
9. Changes
We may update this policy as the app evolves. The “Last updated” date above reflects the latest version.
10. Contact
To exercise your rights or for any privacy question, email [email protected].
