Privacy Policy
1. Introduction & Who We Are
Welcome to Hot Cogs, a cycling platform operated by Jollylamma FZE LLC, a UAE Free Zone company ("Hot Cogs", "we", "us", or "our"). Hot Cogs connects cyclists with providers of cycling products and services through our mobile applications (iOS and Android) and website at www.hotcogs.com.
This Privacy Policy explains what personal data we collect when you use Hot Cogs, how we use it, with whom we share it, and what rights you have regarding your data. This policy applies to all features of our platform, including My Bikes/Garage, Search, Library, Community (Marketplace, Rentals, Services, Bike Parks, Lost & Stolen Bikes, Activities & Events), Profile, Settings, and Subscription services.
We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable UAE data protection law. By using Hot Cogs, you agree to the practices described in this policy.
2. What Data We Collect
We collect the following categories of personal data:
| Category | Description |
|---|---|
| Account & Profile Data | Name, username, email address, profile photo, public profile status, and optional status message. Provided directly when you create or update your account. |
| Location Data | Your home location (city or region), used to localise Marketplace, Community, and Services features. We do not perform continuous GPS tracking. |
| Bike & Cycling Data | Bike make, model, year, size, and mileage — entered manually by you or synced from your Strava account when you choose to connect it. |
| Marketplace & Transaction Data | Listings you post, transaction history, and your phone number if you optionally provide it. Your phone number is revealed to the counterparty only after a deal is initiated. |
| Settings & Preferences | Language, currency (EUR by default), measurement system (metric/imperial), notification preferences, and appearance settings. |
| Device & Technical Data | Device identifiers for push notifications, IP address, device type and operating system, and anonymous usage and crash diagnostics to maintain platform stability. |
| Third-Party Integration Data | If you connect Strava, we receive an access token and associated bike/ride data. If you sign in with Google, we receive basic Google account data. Both are user-initiated integrations. |
| Communications | Messages and enquiries you send to us at info@hotcogs.com. |
3. How We Use Your Data
We use your personal data to:
- ▸Provide and operate the Hot Cogs platform — account management, Garage/bike tracking, Library, Community features, and Marketplace transactions.
- ▸Personalise your experience — localise Marketplace and Community results based on your home location, and surface relevant Library content.
- ▸Process transactions — facilitate deals between buyers and sellers, disclosing contact details only when a deal is initiated.
- ▸Manage subscriptions and billing — administer Free, Premium Trial, and Premium paid tiers via RevenueCat and the respective app stores.
- ▸Serve advertising — display ads to users on free and trial tiers only. Premium subscribers receive no advertising.
- ▸Send notifications — push notifications (subject to your device permissions and in-app preferences) about activity, deals, and platform updates.
- ▸Improve and maintain the platform — analyse anonymised usage data and crash diagnostics to fix bugs and develop new features.
- ▸Respond to communications — reply to your support enquiries and feedback.
- ▸Comply with legal obligations — meet applicable UAE and international legal requirements.
4. Legal Basis for Processing (GDPR)
Where the GDPR applies, we rely on the following legal bases:
Contract. Processing necessary to perform our contract with you — account creation, bike tracking, Marketplace transactions, subscription management.
Legitimate Interests. Platform security, fraud prevention, anonymised analytics, push notification delivery, and improving our services — balanced against your rights.
Consent. Strava and Google integrations (you connect them voluntarily), advertising identifiers (IDFA/GAID), and any marketing communications.
Legal Obligation. Processing required to comply with applicable UAE and EU law.
5. Third-Party Service Providers
We engage trusted third-party providers to operate our platform. All providers are contractually required to process your data securely and only for the purposes we specify.
| Provider | Purpose | Data Involved |
|---|---|---|
| AWS | Cloud infrastructure & hosting | All platform data |
| Netlify | Website hosting | Web traffic, IP addresses |
| MongoDB | Database storage | Account & platform data |
| RevenueCat | Subscription & billing management | Subscription status, purchase history |
| Apple / Google | In-app purchase billing | Handled by app stores directly |
| Advertising networks | Ad delivery (free & trial users only) | Device identifiers (IDFA/GAID) |
| Strava | Bike/ride data sync (user-initiated) | Bike data received from Strava only |
| Google Sign-in | User-initiated sign-in | Basic Google account data |
| 99spokes & data providers | Bike catalogue data | No user data shared |
Note: We receive data from Strava; we do not send your data to Strava. Catalogue data providers (99spokes and similar) supply bike reference data to Hot Cogs only — no user data is shared with them.
6. Advertising
Hot Cogs displays advertising only to users on the free tier and during the Premium trial period. Premium subscribers receive a completely ad-free experience.
Ads may be delivered using standard advertising identifiers — the Identifier for Advertisers (IDFA) on iOS and the Google Advertising ID (GAID) on Android. You can limit ad tracking or reset your advertising identifier at any time through your device's privacy settings (iOS: Settings > Privacy & Security > Tracking; Android: Settings > Privacy > Ads).
We do not build individual advertising profiles, and we do not sell your data to advertisers. Ad networks receive only the identifiers necessary to serve and measure ads.
7. Data Sharing — What We Do NOT Do
We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We do not sell data to data brokers. We share your information only with the service providers listed in Section 5 (under strict data processing agreements), with other users where you have chosen to make information public (e.g. public profile, Marketplace listings), with counterparties in a transaction (phone number only, and only after a deal is initiated), or where required by applicable law or legal process.
8. Your Rights
Regardless of where you are located, we extend the following rights to all Hot Cogs users. Users in the EU/EEA/UK have these rights under the GDPR:
| Right | How to Exercise |
|---|---|
| Access | Request a copy of your personal data |
| Rectification | Correct inaccurate data in your Profile or Settings |
| Erasure | Delete your account via Profile > Delete Account |
| Portability | Export your data via Profile > Export My Data |
| Restriction | Request we limit processing of your data |
| Objection | Object to processing based on legitimate interests |
| Withdraw Consent | Disconnect Strava/Google or adjust ad settings at any time |
| Lodge a Complaint | With your local data protection authority |
To exercise any right not available directly in the app, contact us at info@hotcogs.com. We will respond within 30 days.
9. Children's Privacy
Hot Cogs is rated PEGI 3 and is designed to be suitable for all ages. However, certain features of our platform involve commercial transactions and community interactions.
- ▸We do not knowingly collect personal data from children under 13 without verifiable parental or guardian consent.
- ▸Users in the European Union under the age of 16 must have parental or guardian consent before using Hot Cogs.
- ▸If you are a parent or guardian and believe your child has provided us with personal data without consent, please contact us at info@hotcogs.com and we will promptly delete the data.
10. Data Retention
We retain your personal data for as long as your account is active. When you request account deletion — whether through the in-app Delete Account option or by contacting us — we will permanently delete your personal data within 30 days of receiving the request.
We may retain certain anonymised or aggregated data (which cannot identify you) for analytical purposes after account deletion. We may also retain specific data for a longer period where required by applicable legal or regulatory obligations.
11. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:
- ▸TLS encryption for all data in transit between your device and our servers.
- ▸Encryption at rest for stored personal data.
- ▸Access controls limiting access to personal data to authorised personnel only.
No method of transmission or storage is 100% secure. If you have concerns about the security of your account, please contact us at info@hotcogs.com.
12. International Data Transfers
Hot Cogs is operated from the United Arab Emirates. Your personal data may be processed in the UAE and in the United States (via AWS, Netlify, MongoDB, RevenueCat, and advertising partners).
When we transfer personal data from the European Economic Area (EEA) to countries that do not have an adequacy decision from the European Commission, we apply appropriate safeguards, including Standard Contractual Clauses (SCCs) or equivalent mechanisms recognised under applicable data protection law. By using Hot Cogs, you acknowledge that your data may be transferred internationally in accordance with these safeguards.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, features, or legal requirements. For material changes, we will provide at least 30 days' notice before the change takes effect, via email to the address on your account and/or through an in-app notification.
We encourage you to review this policy periodically. Continued use of Hot Cogs after a change takes effect constitutes your acceptance of the revised policy. The current version is always available at www.hotcogs.com.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
We will acknowledge your request within 5 business days and respond fully within 30 days.
EU/EEA users who are not satisfied with our response have the right to lodge a complaint with their local data protection supervisory authority.