Privacy Policy

Version of 2026-09-18. It applies to the vistavel.com website and to the Vistavel apps for Android and iOS.

1. Who is responsible

The data controller is Vistavel. For any question about your data, or to exercise your rights: contact@vistavel.com.

2. What we do not do

No advertising, no profiling, no third-party audience measurement, no sale of data. The only cookie set is the account session cookie (section 3.2).

3. The data processed

3.1 The account

Data: e-mail address; account identifier (drawn at random); password hash (salted PBKDF2-SHA256: the password itself is never kept); language; date and version of the Terms of Use accepted; current plan, subscription state and end date; Stripe customer and subscription identifiers, if you have any.
Why: to open and secure your account, to recognise the features it gives access to, and to find your content on all your devices.
Legal basis: performance of the contract (the Terms of Use).
Retention: until the account is deleted.

3.2 The session

A cookie named evtp_session (HttpOnly, secure) keeps you signed in for 30 days. It contains only your signed account identifier. It is strictly necessary for the service and is removed when you sign out.

3.3 Sign-in security

We count failed sign-ins attached to an e-mail address: at the fifth, sign-in is blocked for 15 minutes. This counter is erased at the next successful sign-in or when the account is deleted. Legal basis: legitimate interest (protecting accounts).

3.4 Your saved content

Data: the routes you save (track, start and end points, settings, associated places and photos), including the GPX tracks you import and then save; your favourite places (name and coordinates); the rides you record while riding and choose to keep (time-stamped GPS track, distance, duration, elevation).
Where: always on your device; also in your account when you are signed in, so that you find them on your other devices.
Legal basis: performance of the contract.
Retention: until you delete them, or until the account is deleted. Deleting a route or a favourite also deletes it from the account.

3.5 Your precise location

Vistavel uses your device's location only if you allow it, to choose the starting point, to guide you during a ride and to record a ride. It is processed on your device. It only leaves the device in three cases:

when you keep a recorded ride in your account (section 3.4);
during a group ride: your first name and your position are sent to the other members of the group by our group service, which keeps no account and forgets everything 5 minutes after your last position;
as a starting point or a point of the route, sent to the routing, weather and map services (section 4).

Legal basis: your consent, given through the location permission and withdrawable at any time in the settings of your device or browser.

3.6 Support messages

Data: what you write in the contact form or to contact@vistavel.com (message, optional rating, topic); your e-mail address if you give it to receive an answer; the type of browser; and, only if you tick the box (unticked by default), the settings of the current route: starting point, end, distance, type of bike. The starting point may be your home: only tick the box if you agree to share it.
Where: sent by e-mail to our mailbox, with a copy in a Gmail mailbox (Google).
Legal basis: legitimate interest (answering you and improving the service).
Retention: 3 years after the last exchange.

3.7 Payment

Payment for a plan is processed by Stripe, which acts as the controller of its own processing. We never receive or store your card number: only the customer and subscription identifiers (section 3.1). Stripe keeps payment data according to its legal obligations.

3.8 The number of visitors present

The website shows how many people are using it right now. This number relies on a truncated, non-reversible hash of the IP address, the browser and the date. It identifies no one, is never logged, and disappears 90 seconds after the page's last sign of life.

3.9 Hosting

Our host, Cloudflare, processes IP addresses to route requests and protect the service. We keep no request logs.

4. Services that receive data

To build and display a route, your device queries the services below directly. Each receives your IP address and the request described. None receives your e-mail address or your account identifier.

Valhalla (FOSSGIS e.V., Germany) and BRouter: the start, end and via points, to compute the bike route and elevations.
Overpass (overpass-api.de, FOSSGIS e.V., Germany; overpass.kumi.systems): the area or the track of the route, to find places, services and trails. If these servers cannot be reached, the request goes through our server, which also forwards it to the maps.mail.ru mirror (VK, Russia), without your IP address or any identifier.
Photon (komoot, Germany) and Nominatim (OpenStreetMap Foundation, United Kingdom): the text you type in the place search, the map area to refine the search, and the coordinates of a point to name.
Open-Meteo (Switzerland): points of the route and the start time, for the weather.
MapTiler (Switzerland): the map area displayed (map tiles, 3D flyover).
Esri (United States): the area displayed in satellite imagery (satellite base map, 3D flyover).
Google Street View (Google, United States): the coordinates of the places for which a street view is shown.
Panoramax (IGN and OpenStreetMap France): the coordinates of the places for which a free street view is shown.
Wikimedia (Wikidata, Wikipedia, Wikimedia Commons; United States): the area of the route and the places, for their descriptions and photos.
Other base maps, only if you choose them: OpenStreetMap France and Germany, CyclOSM, OpenTopoMap, Thunderforest, IGN, swisstopo, Kartverket, National Library of Scotland, BKG, USGS. 3D flyover terrain: Mapzen's Terrarium tiles, hosted by Amazon Web Services.

Our processors: Cloudflare (hosting of the website, the accounts, your saved content and group rides; sending e-mails), Google (Gmail mailbox receiving a copy of support messages). Stripe processes payments (section 3.7).

5. Transfers outside the European Union

Cloudflare, Google, Esri, Stripe, Wikimedia and Amazon Web Services may process data in the United States. Depending on the provider, these transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses. Switzerland, the United Kingdom and Norway benefit from an adequacy decision. The maps.mail.ru mirror (Russia) receives no personal data: only the area of a request, without IP address or identifier.

6. Retention periods

Account, saved content, Stripe identifiers: until the account is deleted, or until you delete the content.
Session cookie: 30 days at most.
Failed sign-in counter: until the next successful sign-in.
Position during a group ride: 5 minutes after the last position.
Visitor-present hash: 90 seconds after the last sign of life.
Support messages: 3 years after the last exchange.
Technical backup copies at our host: erased at most 30 days after deletion.

7. Deleting your data

A recorded ride: at the end of the ride, the "Ride recorded" summary offers "Delete"; the ride is then kept nowhere. A ride already kept is deleted like a route.

A route, a kept ride, an imported GPX track: in "My saved rides", tap ✕ ("Delete") next to the item. It is erased from the device and, if you are signed in, from your account.

A favourite place: in "Map content", section "My favourite places", tap ✕ ("Remove from favourites"), or use the same button in the place's bubble on the map.

Your account: on the vistavel.com website as in the Vistavel app, open "Account", then "Delete my account", and confirm with your password. You can also write to contact@vistavel.com from your account's address. Deletion immediately erases the account, your routes, your favourite places, your recorded rides, your session and the related indexes; a current subscription is cancelled before erasure. Data kept on your device is erased by uninstalling the app, or by clearing the website's data in your browser.

8. Your rights

You can ask for access to your data, its rectification, erasure, portability and the restriction of its processing, object to processing based on legitimate interest, and withdraw your consent to location. Write to contact@vistavel.com or use the Support page: we answer within one month. You may also lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.

9. Data on your device

Vistavel keeps your routes, your favourites, your display preferences and the draft of the ride being recorded on your device, so that it works offline. This data is only sent to our server in the cases described above.

10. Changes

We may change this policy. The version in force is the one published on this page; its date is shown at the top. An important change is announced when you sign in.