To provide you with better experiences, we may collect two types of information:

• Information Collected Automatically: Some data is gathered automatically when you use our website, applications, or services. This includes technical details from your device and browsing activity.
• Information You Provide: This includes any details or personal information you actively share with us, such as when you sign up for a service, participate in a promotion, or contact us.

As you navigate through and interact with our websites, applications, or click on an email from us, we may use cookies, web beacons, and other automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Your device's IP address
• Browser type and version
• Pages you visit and how long you spend on them
• The date and time of your visit
• Any errors you encounter and related technical details
• Identifying when you return to our website
• Your preferences and settings

We use this data to improve our services, troubleshoot issues, and deliver better, more personalised experiences to you. While this data isn't intended to personally identify you on its own, it may be possible to link it with other information to identify you.

The technologies we use for this automatic data collection may include:

• Cookies: Small files stored on your device that help us remember your preferences and enhance your experiences.
• Local Storage: Information saved on your device to remember your settings and preferences.
• Session Storage: Temporary information stored only during your current visit.
• Log Files: Records of website activity that may include your IP address, browser type, and pages visited.
• Web Beacons: Small electronic images that help us understand how you interact with our emails and website(s).
• Embedded Scripts: Code that collects information about how you interact with our website(s) or services.

When you use our website or services, we may also automatically collect certain additional details about the device you're using, including:

• Device Type
• Device Settings
• Operating System
• Geo Location
• Unique Device Identifiers

The information we collect depends on your device's settings and software permissions. If you'd like to learn more about what data is shared, we recommend checking the privacy settings of your device and apps.

We may collect personal information that you voluntarily provide to us, such as when you create an account, subscribe to our newsletter, fill out a form, or contact our support team. This information may include:

• Name
• Email
• Phone or Mobile Number
• Date of Birth
• Home or Mailing Address
• Social Profiles
• Commercial Information (Purchase history, transaction records)

We only ask for the information necessary to provide our services, and we'll always let you know why we need it. Personal information that you provide may be associated with information that we collect automatically.

Some types of personal information are considered more sensitive and require extra protection. This includes details such as health information.

We take your privacy seriously and will only collect sensitive information if you give us explicit consent. If we do need this type of data, we'll let you know why and how it will be used. We only collect, use, or share sensitive information when legally required or permitted.

PedalPulse™ works out daily recovery and readiness for cyclists. To do that, with your permission we read health and fitness information from Apple Health on iPhone and Health Connect on Android, including:

• Sleep
• Heart rate and resting heart rate
• Heart rate variability (HRV)
• Stress
• Other recovery and readiness metrics, along with workouts and activity data

We use this to calculate your recovery, readiness and training load, and to shape the coaching guidance we give you. Nothing is read until you grant permission, and you choose which types of data to share.

Reading data in the background. With your permission, PedalPulse syncs this information roughly once a day in the background so your recovery scores are up to date when you open the app. Without background access your data would only refresh when you manually opened the settings screen and tapped Sync, which means stale recovery scores and training guidance based on old numbers. Background access is optional — the app still works without it, you would just need to sync manually.

Health data is special category personal data under UK data protection law, so we rely on your explicit consent to process it. You can withdraw that consent at any time by turning off individual permissions, or PedalPulse's access entirely, in your device's Apple Health or Health Connect settings. We will stop reading that data immediately.

We never use health or fitness data for advertising, and we never sell it. It is used to provide the coaching and analysis features described in this policy, and nothing else.

We use information that we collect about you or that you provide to us, including any personal information, for the following purposes:

• Website Functionality & User Experiences
• Email & Contacting Users
• Record Keeping & Administration
• Compliance & Dispute Resolution
• Security & Fraud Prevention
• Order & Delivery Fulfilment
• Payment Processing
• Login & Account Management
• Analytics & Market Research
• Improving Our Cycling Coaching Models (using anonymised data — see below)
• Advertising & Marketing
• Competitions, Sweepstakes, or Giveaways
• Product Development
• Recruiting
• Other Purposes with Your Consent

We may combine the personal information you provide with data we collect automatically or receive from trusted sources. For example, if you share your location with us, we might use this information alongside general data — such as local currency and language preferences — to personalise your experience and make our services more relevant to you.

Features such as Coach Winston, AI ride analysis, training-plan generation and food logging are powered by large language models provided by third parties. We use more than one provider so the service keeps working if one is unavailable. Those providers are:

• OpenAI, OpCo, LLC (United States)
• Google LLC — Gemini (United States)
• Anthropic PBC — Claude (United States)

When you use one of these features, we send the provider only what is needed to answer you. That typically includes the message or request you have written, and relevant training context such as ride metrics, workout history, training goals or the food description you have entered.

Requests are linked to an internal user reference rather than to your name or email address, so these providers never receive details that directly identify you. That reference is meaningless outside our systems — but because we can still connect it back to your account, this information remains your personal data under UK data protection law and is protected as such. It is pseudonymised, not anonymous.

We use these providers under business terms which mean your information is not used to train their own general-purpose AI models. They may retain it briefly for security and abuse monitoring in line with their own terms before deleting it.

Our lawful basis for this processing is performance of our contract with you — it is how we deliver the coaching features you have asked to use. Because these providers are based in the United States, your information is transferred outside the UK; see “ International Data Transfers” above for how we protect those transfers.

Please avoid entering sensitive personal details, or information about other people, into Coach Winston — it is designed for questions about your cycling and training.

PedalPulse™ is built around cycling coaching that gets better as it learns what actually helps riders improve. To do that, we use information about training and performance — such as ride and workout data, training responses, and how coaching guidance is used — to develop and improve our coaching models, training plans and analysis.

We only use anonymised, non-identifiable information for this purpose. Before information is used to improve our models it is stripped of the details that identify you — such as your name, email address, account identifiers and precise location — and is combined with data from other riders so that it becomes statistical rather than personal. It is not used to build a profile of you, and the models do not reproduce your individual data back to other users.

Because this information no longer identifies you once it has been anonymised, it falls outside data protection law and we may retain and use it indefinitely, including after you close your account. Deleting your account removes your personal information as described in this policy, but it cannot retrospectively remove anonymised statistical data that can no longer be linked back to you.

Our lawful basis for the step of anonymising your information is our legitimate interest in improving the service we offer. You have the right to object to processing carried out on this basis — see “How to Exercise Your Rights” below, or contact us using the details at the end of this policy.

We only collect and use your personal information when we have a legitimate reason to do so. This means we only gather the data necessary to provide you with our services, improve our offerings, or meet legal and regulatory obligations. We never collect more information than we need for these purposes.

We take your privacy seriously and use industry-standard security measures to protect your personal information from loss, theft, unauthorised access, disclosure, copying, misuse, or modification.

While we do our best to keep your data secure, it's important to understand that no online system or method of data storage is completely foolproof. We cannot guarantee absolute security, but we continuously work to safeguard your information.

You also play a role in keeping your information secure. If you create a password for our services, make sure it's strong and keep it private. Additionally, be mindful of what personal details you choose to share publicly through our platform.

We only keep your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy. In some cases, we may need to keep your information for longer periods of time, including for legal, accounting, or regulatory reasons, or for public interest, research, or statistical purposes. When this happens, we ensure that appropriate safeguards are in place.

The information we collect is stored and/or processed in United Kingdom, United States, Switzerland or where we or our partners, our affiliates, or our service providers operate. As a result, your personal information may be transferred to, stored, and/or processed in a country other than your own, including countries that may not have laws providing specific protection for personal data or that have different legal rules on data protection.

By providing us with your personal information, you agree to this transfer, storing, or processing. We take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

When we do transfer your information internationally, we will take appropriate measures to protect your privacy and ensure that your information is handled securely as outlined in this Privacy Policy. These measures may include using data transfer agreements, standard contractual clauses, binding corporate rules, or other approved mechanisms.

We may share your information with the following parties when necessary:

• Companies within our corporate group, including parent companies, subsidiaries, or affiliates.
• Trusted third-party service providers who help us operate our business, such as IT services, data storage, web hosting, email service providers, ad networks, analytics providers, error loggers, debt collection agencies, technical support, marketing partners, professional advisors, and payment processors.
• Our employees, contractors, and related entities who need access to perform their work.
• Business partners, agents, and affiliates who help us deliver services or collaborate on projects.
• Sponsors or organisers of promotions, sweepstakes, or competitions that we run.
• Credit reporting agencies, courts, and regulatory authorities, if required, such as when payments are overdue for services provided.
• Legal and regulatory authorities, including law enforcement, courts, or government agencies, when required by law or for legal proceedings.
• Third-party providers who assist with delivering products, services, or marketing communications.
• Data processing and collection partners that help us analyse and improve our services.
• A potential buyer or successor in the event of a business sale, merger, or transfer of assets.
• Other third parties with your consent or as directed by you.

We only share your information when necessary and always in accordance with privacy laws. Aggregated or anonymised data that does not personally identify you or any individual may be shared with third parties for analysis, marketing, or other business purposes.

We advertise PedalPulse™ on OpenAI's advertising network. To understand which adverts lead people to download the app, we use the OpenAI measurement pixel supplied by OpenAI, OpCo, LLC.

These are non-essential advertising cookies and technologies, so we only load the pixel after you accept cookies. If you decline, it is not loaded at all and none of the information below is collected or shared.

With your consent, the pixel:

• Sets a first-party cookie named __obref that identifies the advert you arrived from.
• Records pages you view on our website and certain actions you complete, such as subscribing to our newsletter.
• May send OpenAI a hashed (SHA-256) version of your email address when you enter it in one of our forms. This is used to match your activity to an advert. We do not send your email address in a readable form.
• May pass the __obref value into our mobile app when you install it from a link on this website, so an app install can be connected to the advert that led to it.

OpenAI handles this information under its own privacy policy, which we encourage you to read. We also use Google Tag Manager to load measurement tags, which is likewise only loaded once you have accepted cookies.

You can withdraw your consent at any time by clearing the cookies for this site in your browser, which will cause the consent banner to appear again so you can decline. Withdrawing consent stops any further collection, but does not undo processing that has already taken place.

From time to time we run sponsored offers, competitions, or features in partnership with third-party sponsors. Where you choose to take part — for example, by entering a sponsor's competition or opting into a sponsor's offer — and only with your explicit consent, we will share your name and email address with that sponsor. We will always identify the specific sponsor to you at the point you give your consent.

Once your information is shared in this way, the sponsor acts as an independent data controller of that information. This means they process your name and email for their own purposes and under their own privacy policy, not this one. We encourage you to review the sponsor's privacy policy before giving consent, so you understand how they will handle your information.

Giving this consent is entirely optional — you can use our services without taking part in any sponsored offer, and you can withdraw your consent at any time. Withdrawing consent will stop further sharing, but it will not affect any processing the sponsor has already carried out, which remains governed by the sponsor's own privacy policy.

We comply with the EU General Data Protection Regulation (GDPR) and the UK GDPR along with the Data Protection Act 2018, ensuring that your personal information is processed lawfully, fairly, and transparently.

Under certain data protection laws, organisations that handle personal data can fall into two categories:

• Data Controllers: Entities that determine the purposes and means of processing personal data.
• Data Processors: Entities that process personal data on behalf of a Data Controller.

We, Sock Drawer ltd, act as a Data Controller when handling your personal data for our own business purposes. In some cases, we may also act as a Data Processor when handling personal data on behalf of another entity.

We only process your personal data when we have a lawful basis to do so. Our lawful bases include:

• Consent: Processing based on your explicit consent for specific purposes such as marketing communications or optional features.
• Performance of a Contract: Processing necessary to fulfil our contractual obligations to you or to take steps at your request before entering into a contract.
• Legitimate Interests: Processing necessary for our legitimate business interests, provided these interests are balanced against your rights and freedoms.
• Legal Obligations: Processing necessary to comply with legal or regulatory requirements.

As a resident of the EEA, UK, or Switzerland, you typically have the following rights regarding your personal data:

• Right to Access: Request a copy of your personal data.
• Right to Be Informed: Receive information about how your data is collected, processed, shared, and stored.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data under certain circumstances.
• Right to Restrict Processing: Limit how we use your data in certain situations.
• Right to Data Portability: Receive your data in a structured, commonly used format in certain cases.
• Right to Object: Object to processing based on legitimate interests, direct marketing, or public interest.
• Rights Related to Automated Decision-Making: Request human intervention for significant automated decisions.

To exercise any of these rights, please contact us by email using the details provided below or by accessing our privacy tools that may be available to you.

We may need to verify your identity before processing your request and will respond to your request within one month, but may extend this period for complex requests. If we need more time, we will notify you and explain the reason for the extension.

If you are not satisfied with our response or if you believe that we've mishandled your personal data, please contact us with additional details. You also have the right to lodge a complaint with a data protection authority:

• UK residents can contact the Information Commissioner's Office (ICO): ico.org.uk
• EEA residents can contact their national Data Protection Authority (DPA)

We may update this Privacy Policy from time to time to reflect changes in our business practices, industry standards, or legal requirements. Any updates will be posted here at the same link where you are currently viewing this policy.

If any changes significantly affect how we use your personal information, we will notify you and, if required by law, seek your consent or provide you with the option to opt in or out of the updated practices. We encourage you to review this policy periodically to stay informed about how we protect your privacy.

If you have questions or concerns about our Privacy Policy or our data practices, you can reach out to our Privacy Officer: