I2CS Inc. Privacy Policy

1. The information that we collect and/or receive:

We collect personal information through three methods: information you provide to us directly, information collected automatically by our systems, and information accessed via your mobile device permissions.

a. Personal information you provide to us.

We collect information that you voluntarily provide when using our services, including (as applicable):

• Identity & Profile: Name, age or date of birth, and profile picture.
• Contact Details: Email address, mailing address, and one or more phone numbers.
• Account Security: Account login credentials (username(s) and password(s)).
• Club Registration & Health Details: If you choose to provide information about your allergies, medications or medical conditions, we store it in your account to help authorized club personnel prepare for club activities and respond to health or safety incidents connected with those activities. This information is shared with a club only if you separately authorize access for that club.
• Emergency Contacts: We collect the name, phone number and relationship to you of emergency contacts associated with your account. You may provide this information yourself, or a club may provide it when inviting you to join. By providing the personal information of any third-party emergency contact, you represent, warrant, and confirm that you have obtained that specific individual’s explicit consent to provide their information to us and to the applicable club for the purposes and uses described in this Privacy Policy.
• Finances & Preferences: Payment or billing information, and marketing preferences.
• User Background & Interactions: Education or experience history (such as cycling experience, skill level), survey information, communications with our support team and any other information you provide when you complete forms on our website or apps.

b. Information collected automatically when you use our Services.

When you visit our website or use our applications, our systems automatically collect certain technical, transactional, and usage data required to run and secure our services. This may include:

• Transaction Information: Details about payments, club dues, and transactions made through the platform.
• Location Data: When you use certain optional features of our mobile application, such as ride check-in, we may request access to your device’s location. For example, if you choose the ride check-in feature, the app will perform a one-time location check to determine whether you are within a reasonable proximity (currently approximately 150 meters) of the ride start location. We do not continuously track your location or collect background location data for this feature.
• Communication Data: Information created when you communicate using our Services, including the content of such communications and exact time/date of the communication.
• Device & Network Identifiers Your Internet Protocol (IP) address, unique device identifiers (IDs), app version, mobile network information, web browser or device type, mobile operating system, and hardware and software settings and configurations.
• App Performance Telemetry & Installation Identifiers: A unique installation identifier (installation ID) generated by your device's push notification service (such as Google Firebase Cloud Messaging on Android or Apple Push Notification service on iOS), along with an associated push notification token, battery status, system crash logs, and diagnostic data. The installation ID and push token identify your specific app installation so that we can deliver push notifications to your device.
• Browsing & App Metrics: Information about how you interact with our platform, including referral URLs (the sites you visited just before ours), pages viewed, actions taken within the platform, and exact dates, times and duration of your use.

c. Mobile Application Permissions

To provide features within our mobile applications, our app may request access to certain features on your mobile device. You can choose to grant or deny these permissions at any time through your device operating system settings:

• Location Services: Used to provide optional location-based features or routing features, including confirming whether you are within a reasonable proximity (currently approximately 150 meters) of a ride start location when you choose to use the ride check-in feature. Location access is requested only while the app is in use. We do not use background location or tracking for ride check-in.
• Camera and Photo Library: Access is requested solely to allow you to capture or upload a profile picture for your account.
• Push Notifications: Used via a unique installation ID and associated push notification token to deliver club updates, ride changes, group messages, and important application announcements (such as app updates or required maintenance notices).

II. Cookies

We use cookies on our website and within our web-based applications. These are used to:

• Maintain your secure session and keep you logged into your account.
• Remember your preferences, custom settings, and search filters.
• Analyze usage patterns, monitor user engagement, and determine the popularity of specific content.
• Evaluate the effectiveness of our own marketing and optimize platform performance.

You can modify your web browser or device setting to block cookies or tracking tokens, though doing so may interfere with your ability to use certain features of our website and applications.

III. California Do Not Track Disclosures and Third-Party Tracking

Do Not Track. Some web browsers and devices offer a "Do Not Track" ("DNT") setting that sends a signal asking websites and online services not to track the user's online activities. There is no common standard for how to interpret these signals. BiciClub does not collect personal information about your online activities over time and across third-party websites or online services, and does not use information of that kind to deliver targeted advertising. Because our Services do not engage in that kind of tracking, they do not currently respond to DNT signals or similar mechanisms. We do collect information about how you use our own website and apps, as described in Section I.b, to run, secure and improve the Services.

Third-party tracking. We do not allow advertising networks, data brokers, analytics providers or other third parties to collect personal information about your online activities over time and across other websites or online services through our Services, and none currently does. The service providers described in Section VIII, such as hosting, push notification delivery and email delivery providers, handle information only on our behalf to provide the Services. Separately, your device's operating system may report crash and diagnostic data to Google or Apple under your device settings and their privacy policies. BiciClub does not control that reporting, and we receive those reports only in the form those companies make available to developers.

Health information. We do not use the health information you provide (such as allergies, medications and medical conditions) for advertising, analytics or profiling, and it is not made available to any tracking technology. It is shared only as described in Section VIII and in our Consumer Health Data Privacy Policy.

Advertising. If we advertise our Services, we use conventional paid placements, such as advertisements on a cycling association's website or in its newsletter, that are not based on tracking your activity on our Services. We do not use personal information collected through our Services to target advertising to you on other websites or apps.

Changes. If we begin using analytics or advertising tools that involve tracking technologies or third-party collection, we will update this section and the rest of this Privacy Policy before we do so.

IV. How We Use Your Information

We only use your personal information for the following purposes:

• Provide and Manage Services: Create, manage, and verify your account login credentials, process your profile updates (including picture, name and age), and maintain the core technical functions of our website and mobile applications. We also use personal information to administer account lifecycle requests, including account updates, account deletion requests, and related security verification.
• Administer Club Registrations: We use your registration, membership, contact, emergency contact and cycling background information, and technical telemetry to help the clubs you join manage membership, activities and participation. Authorized club personnel can access this information according to their roles.
• Support Health and Safety at Club Activities: If you choose to store medical information and separately authorize a club to access it, we make that information available to the club’s authorized administrators while your membership is active. Assigned ride leaders and ride leaders in training may access it for eligible participants during that club’s medical information access window, to prepare for activities and respond to health or safety incidents connected with them.
• Fulfill Contractual Obligations: Establish, perform, maintain, or fulfill our contractual commitments and obligations directly with you, including delivering specific software services, verifying membership eligibilities (if applicable), and ensuring account terms are honoured.
• Process Financial Transactions: Manage and execute your payment or billing information, process membership dues, event fees, billing credentials, and financial transactions.
• Deliver Customer Support: Review and address your direct communications with customer support, troubleshoot technical issues, and resolve customer support requests.
• Analyze and Optimize Platform Operations: Monitor technical telemetry (such as your app version, browser type, operating system, network configuration, and battery status), alongside browsing metrics (referral URLs, actions taken, and the dates/times of access) to ensure software stability, optimize performance, and resolve any issues.
• Communicate and Manage Marketing Preferences: Manage your marketing preferences to deliver promotional communications, marketing materials, updates, and news regarding our Services. We also use your app installation ID and push notification token to send alerts regarding club updates or changes, , and process feedback from voluntary survey information to improve our services, and important application updates or announcements.
• Legal Proceedings, Requirements, and Operating Commitments: Investigate or address claims or disputes relating to your use of the Services, satisfy requirements under applicable law, operating licenses, regulatory frameworks, or commercial agreements, and respond to active government proceedings or official regulatory requests.
• Anonymized & Aggregated Data: aggregate, anonymize, or otherwise use personal information without identifying you for any purpose permitted by applicable law. This includes generating non-identifying statistical insights, tracking overall sport or cycling usage patterns, and sharing de-identified analytics with third parties or affiliates.
• Ride Check-In: If you choose to use the optional ride check-in feature, we use your device’s current location to verify whether you are within a reasonable proximity (currently approximately 150 meters) of the ride start location so that you may check in for the ride. We do not use this feature to continuously monitor or track your location.

V. Knowledge and Consent (Opt-Out Options)

We explain the purposes for which we collect, use and disclose personal information and seek consent where required. Creating an account or registering with a club does not, by itself, authorize us to store your medical information or share it with a club.

• Medical Information Choices: If you wish to save or update information about your allergies, medications or medical conditions, we ask you to make a separate storage choice. You may then separately authorize each club in which you are an active member to access that information. Both choices are optional, and sharing is off for each club unless you authorize it. In Settings, you can stop a particular club’s future access without leaving the club, or withdraw storage consent. Withdrawing storage consent removes the medical information from your active account profile and ends all club sharing grants. These actions cannot retrieve copies already made by club personnel or immediately remove backup or legally retained records.
• Opting Out of Communications: You can opt-out of receiving marketing or promotional communications from us at any time by following the links provide in the messages, by updating your account preferences or by contacting us directly at [email protected]. Please note that even if you opt out of marketing messages, we will continue to send you transactional, operational or service-related announcements (such as password resets or registration receipts) necessary to manage your active account.
• Withdrawing General Consent: You may withdraw your consent to our overall data collection and processing practices at any time, subject to legal or contractual restrictions, by closing your account or contacting us directly at [email protected]. Note that withdrawing core processing consent will prevent you from using our platform to register for, manage, or participate in cycling clubs.

VI. Children’s Privacy

Protecting the privacy of children is of paramount importance to us. Our Services are not designed or intended for independent use by children under the age of 13 years (“Children”).

• Parental Consent Required: If you are registering a youth rider under the age of 13 years, the registration profile and required technical forms must be completed entirely by a parent or legal guardian. By submitting a minor’s information, you confirm that you are the child’s legal parent or guardian and explicitly consent to the collection, use, and disclosure of the child’s personal and sensitive information on their behalf.
• Medical Information: The medical information feature is available only to account holders who confirm that they are at least 18 years old. Users under 18 cannot add or update medical information through this feature or authorize a club to view it. The feature does not currently allow a parent or guardian to make those medical information choices on a minor’s behalf.
• Inadvertent Collection: We do not knowingly collect personal information directly from Children. If we discover that a child under 13 has provided personal information to us directly without verified parental consent, we will take immediate steps to delete the data from our server infrastructure.

VII. Information Not Covered by this Privacy Policy

Certain categories of information and interactions are entirely excluded from this Privacy Policy and are not covered by our data protection practices. This includes:

• Third Party Links and External Services: Our Services contain links to external third-party websites, applications, plug-ins, or tools (such as provincial cycling associations, race registration platforms, or fitness networks like Strava or RideWithGPS) that are not owned, operated or controlled by I2CS Inc. Once you click an external link and leave our platform, any data you provide is governed strictly by their respective privacy policies.
• Publicly Shared Content: Any text, messages, or information that you choose to post publicly within communal areas of the Services (such as open club message boards, forums, public event pages or other similar features available from time to time through our website or apps) becomes viewable by other users and is completely outside our confidentiality controls. None of the information you provide through the use of these features is protected by this Privacy Policy, including any Personal Information.
• Independent Club Data Use: While our platform provides the technical environment for clubs to manage their programs, individual cycling clubs operate as separate legal entities. Once an authorized club administrator reviews, downloads, or acts upon your profile information (including sensitive medical information and emergency contacts), that data use is subject to that specific club’s internal privacy policies and liability waivers. I2CS Inc. does not control or accept legal liability for how individual clubs manage your profile data outside the technical framework of our website and applications.
• Offline or Direct Interactions: Any information you choose to share directly with other participants, individual clubs, coordinators or ride leaders outside of the technical framework of our applications and website (such as private emails, offline paperwork or face-to-face transactions).

We do not control, endorse, or accept any legal liability for the privacy and data security practices of third-party platforms or independent offline interactions.

VIII. Data Sharing and Third-Party Disclosures

We do not sell, rent or lease your personal information to third parties for marketing or advertising purposes. We only share your personal information under the following strict conditions:

• Access by Clubs You Join: Authorized personnel at a club you join may access the account and membership information needed to manage your participation, according to their roles. Joining a club does not give it access to your medical information. If you separately authorize medical sharing with that club, its authorized administrators may view your medical information while your membership is active. Designated ride leaders and ride leaders in training may view it only for eligible participants during the club’s medical information access window.
• Third-Party Vendors, Consultants, and Service Providers: We may share your information with third-party vendors, service providers, contractors or agents who perform services for us or on our behalf and require access to such information to do that work. This includes infrastructure support (such as DigitalOcean and MongoDB), payment processing, data analysis, push notification delivery (such as Google Firebase Cloud Messaging and Apple Push Notification service), email delivery, hosting services, customer service and marketing assistance.
• Business Transfers, Mergers, and Restructuring: We may share or transfer your information in connection with, or during negotiations of, any mergers, sale of company assets, financing, restructuring, reorganization, dissolution, or acquisition of all or a portion of our business to another company.
• Legal and Regulatory Compliance: If required to do so by a Canadian court, law enforcement agency, or government authority to comply with a valid subpoena, warrant, court order, or legal investigation.
• Protection of Rights and Safety: If disclosure is necessary to protect your immediate physical safety during an event, public safety, or to defend the legal rights, property, and security of I2CS Inc., our users, or the public.

IX. International Data Transfers

Your personal information is securely stored using managed database infrastructure hosted on commercial cloud infrastructure provided by third-party service providers. Your personal information may be transferred to and processed in jurisdictions outside your province, state, or country where privacy laws may differ. If you use the Company’s Services from outside Canada, you acknowledge that your personal information may be transferred to or accessed from Canada, and consent to such transfer or access.

X. Protecting and Retaining Your Personal Information

We are committed to ensuring the security of your personal information and take its protection seriously.

• Restricted Internal Access: We restrict internal access to your personal information to authorized officers, directors, employees, consultants, and agents of I2CS Inc. who require that data to fulfill their job responsibilities, maintain our systems, or support our operations. All such personnel are bound by strict confidentiality obligations.
• Security Measures & Disclaimers: We utilize standard, industry-recognized physical, technical and operational safeguards to protect your personal information against unauthorized access, loss, or alteration. While we work diligently to secure our website and mobile applications, it is important to remember that no data transmission over the internet can be guaranteed completely secure. We encourage you to take personal care when sharing sensitive information via unencrypted emails, choose strong account passwords, and notify us immediately if you suspect any unauthorized activity on your profile.
• Data Retention Practices: We retain personal information for as long as reasonably necessary for the purposes described in this Policy and for applicable legal, security and recordkeeping needs. Retention periods vary by type of record. Removing medical information from your account does not necessarily remove records of your consent choices, medical-access audit records, backups or copies previously made by a club.
• Incidents & Response Planning: We monitor our systems closely to prevent unauthorized access to your account. In the unlikely event of a security incident that impacts your personal information, we are committed to acting quickly to secure our platform and will notify you and the appropriate regulatory authorities as required by applicable laws.
• Account Deletion: When you request account deletion, we will disable access to your account immediately and begin deleting or anonymizing the personal information associated with your account. We may retain limited information where necessary to comply with law, prevent fraud or abuse, resolve disputes, enforce our agreements, maintain security, or preserve the integrity of certain service records.

For example, if you participated in a club, event, notice, message, or similar activity through the Services, some related records may remain in our systems in anonymized form so that the Services and related historical records continue to function properly. In such cases, those records will no longer identify you as an active account holder and may appear as "Deleted User" or a similar label.

Final cleanup of account deletion requests is generally completed within 7 days of the request, unless a longer period is required by law or for a legitimate business purpose described in this Privacy Policy.

XI. Assumption of Risk and Limitation of Liability (Sporting Activities)

I2CS Inc. provides club management software and administrative tools. While our digital platform facilitates the online registration, scheduling, communication and tracking of cycling clubs, group rides and related sporting activities, we do not own, physically manage, supervise or control the real-world execution of these events.

You acknowledge that cycling and related sporting activities carry inherent dangers and physical risks, including the risk of property damage, personal injury or death.

To the maximum extent permitted by applicable Canadian law, by choosing to use our platform features to register for, coordinate, host or participate in any club activity, you agree that I2CS Inc. (including its officers, directors, employees, and agents) assumes no responsibility or liability whatsoever for any injury, loss, harm, damage, or accidents that occur during your physical participation in any cycling or sporting activity. Your participation in any physical club program facilitated by our Services is entirely at your own risk.

By accessing the Services and providing us with Personal Information and other data, you expressly and unconditionally release and hold us harmless from any and all liability for any injuries, loss, or damage of any kind arising from or in connection with the use and/or misuse of such information.

XII. Your Rights, Access, and Accuracy

Under Canadian privacy laws, you have the right to request access to the personal information we hold about you, challenge its accuracy, request corrections to errors, or ask us to delete it from our systems (subject to our legal or financial retention obligations). Please direct all privacy-related inquiries, access requests, or compliance complaints to our designated Privacy Officer at: [email protected].

XIII. Updates to this Privacy Policy

This Privacy Policy is effective as of the date stated at the top of this Privacy Policy. We may update or make other changes to this Privacy Policy from time to time, without notice. We will notify you about changes that significantly impact our use of your personal information by placing a prominent notice on our website or mobile application(s) or by sending you an email. We recommend revisiting this page periodically to make sure that you have the most recent information regarding our collection and use of your personal information. To the extent permitted under applicable law, we will understand your use of our Services after an update to this Privacy Policy to reflect your consent to the practices described in this Privacy Policy. For the avoidance of doubt, disputes arising as considered in this document will be resolved in accordance with the Privacy Policy in effect at the time the dispute arose.

XIV. Governing Law and Jurisdiction

This Privacy Policy and any disputes arising out of or relating to it, including any dispute concerning the collection, use, disclosure, or protection of personal information, shall be governed by and construed in accordance with the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of law principles. You agree that any legal action or proceeding arising out of or relating to this Privacy Policy shall be brought exclusively to the courts of the Province of Ontario, and you hereby irrevocably submit to the jurisdiction of those courts.

XV. Contact Us

Please contact us with any questions, comments or concerns about this Privacy Policy or our use of your personal information by e-mail at [email protected].