Privacy Policy

Last updated: 1 November 2026

This Privacy Policy explains how HaloEdge ("HaloEdge", "we", "us") collects, uses, stores and protects personal data when you use the HaloEdge application and website, including activity data you choose to share from connected services such as Garmin Connect. It is provided in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and applicable Italian data protection law.

1. Data controller

HaloEdge di Andrea Anceschi
Reggio Emilia, Italy
P.IVA / VAT number: IT01782830358
Email: info@haloedge.it

2. Data we collect

• Account data: your email address and the information needed to create and manage your HaloEdge account.
• Authorization data of connected services: the access tokens issued by a connected service (for example Garmin Connect or Suunto) when you connect your account, and your user identifier on that service. We never receive or store your password for those services.
• Activity data from connected services: the original activity files (FIT format) and the related activity summaries of the workouts you record, such as e-bike rides and, as support is extended, runs and other sports. Depending on the activity and device, they may include GPS location and route, timestamps, distance, speed or pace, elevation, cadence, power, heart rate, running dynamics and other metrics recorded by your device.
• E-bike motor data: FIT files from your e-bike drive system that you upload or connect, which may include assistance level, motor power, battery state and related ride data.
• Technical data: basic logs (such as IP address, date and time of requests and error information) needed to operate and secure the service.

Some of this information, such as heart rate, may be considered data concerning health under Article 9 GDPR. We process it only with your explicit consent.

3. How we use your data

• To import your activities (for example e-bike rides and, when supported, runs) and keep the original files available to you.
• To bring together data recorded by different devices for the same workout, such as matching the activity recorded by your watch with the motor data of the same e-bike ride.
• To show you your activities, statistics and analyses within HaloEdge.
• To match your routes against public trail and road data from OpenStreetMap, in order to recognise the trails and segments you rode.
• Only if you enable it: to generate a short written summary of each activity using an AI language model (see section 6).
• Only if you join a group: to show your results to the other members of that group, for example in segment leaderboards (see section 5).
• To operate, maintain and secure the service and to provide support when you contact us.

We do not sell your data, we do not use it for advertising or profiling, and we do not use it for any purpose other than the ones listed above. When support for new types of activity is added, data will be used for the same purposes; if we ever need to use your data for a new purpose, we will ask for your consent first.

4. Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR) for account management and providing the service you request.
• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) for receiving and processing your activity data from connected services, including any health-related data. You give this consent when you authorize HaloEdge on each service, and you can withdraw it at any time.
• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) for AI-generated activity summaries, including the use of heart-rate-derived values for this purpose. This feature is off unless you enable it, and you can turn it off at any time.
• Consent (Art. 6(1)(a) GDPR) for sharing your results with the members of a group you choose to join. You can leave a group at any time.
• Legitimate interest (Art. 6(1)(f) GDPR) for keeping technical logs needed for the security and correct operation of the service.

5. Connected services

HaloEdge receives data from a connected service only after you explicitly authorize it through that service's own authorization page. You can revoke HaloEdge's access to any service at any time, from that service's account settings or from within HaloEdge. When access is revoked, we stop receiving new data from that service and delete its authorization tokens. Your activity data is deleted as described in section 7.

Garmin Connect. Once authorized, Garmin notifies HaloEdge when a new activity is available after you sync your device, and the original activity file is delivered to HaloEdge.

Suunto. Once authorized, workouts synchronised to the Suunto app are delivered to HaloEdge as activity files.

E-bike drive systems (for example DJI Avinox). Ride data recorded by the drive system, such as assistance level, motor power and battery state, is added to HaloEdge only by your choice and is used to complete the activity recorded by your watch for the same ride.

The processing of your data by each connected service is governed by that service's own privacy policy.

Groups and leaderboards. Your activities are private by default. If you choose to join a group, you give your consent to share your results with the other members of that group, for example your display name, segment times and dates in leaderboards. Heart rate and other health-related data are never shown to other users. If you leave a group, your results are no longer shown to its members.

All product names and trademarks mentioned are the property of their respective owners. HaloEdge is an independent application and is not affiliated with or endorsed by any of them.

6. Where your data is stored and who receives it

Your account and activity data are stored in databases located within the European Union. Data is encrypted in transit (HTTPS/TLS) and access is restricted to what is strictly necessary to run the service.

We use the following service providers. Where they act as data processors under Article 28 GDPR, they may process data only according to our instructions.

• DigitalOcean (hosting of the HaloEdge application and databases), in a datacenter within the European Union.
• Google Gemini API (AI-generated activity summaries), only if you enable this feature. We send only aggregated activity metrics: sport type, distance, duration, elevation gain, speed and, only with your explicit consent, summary values derived from your heart rate such as a computed effort score. We do not send your name, email, user identifiers or GPS tracks. We use Google's paid API service, under which Google does not use the submitted content to improve its products.
• OpenStreetMap Overpass API (matching your routes with public trails and roads). We send the geographic coordinates of the area of your ride, without your name, email or user identifiers.
• Microsoft Azure (hosting of this website). The website does not collect personal data beyond technical request logs.

Some of these providers are based outside the European Union, or may process data outside it. In those cases data is transferred under the safeguards required by Chapter V GDPR, such as the European Commission's Standard Contractual Clauses included in the providers' data processing terms.

We do not sell your data and we do not share it with any other third party, except where required by law.

7. Data retention and deletion

• Activity and motor data are kept for as long as your account is active, so that you can access your activity history.
• If you disconnect a connected service, its authorization tokens are deleted immediately. You can also ask us to delete all activity data received from that service.
• If you delete your account, all associated personal data, including activity files, is permanently deleted within 30 days, except where retention is required by law.
• Technical logs are kept for a maximum of 90 days.

8. Your rights

Under the GDPR you have the right to:

• access your personal data and obtain a copy of it;
• rectify inaccurate data;
• request erasure of your data;
• restrict or object to processing;
• receive your data in a structured, machine-readable format (data portability);
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, write to info@haloedge.it. We will reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of your country of residence.

9. Age

HaloEdge is intended for users aged 18 and over.

10. Changes to this policy

We may update this Privacy Policy from time to time. The date of the latest update is shown at the top of this page. If changes are significant, we will inform registered users by email or within the application.

11. Contact

For any question about this Privacy Policy or about your data: info@haloedge.it