Sign up

Legal

Privacy Policy

How ColVelo collects, uses, and protects your personal information. This policy covers both our general practices and your specific rights under GDPR and U.S. state privacy laws.

Last updated: October 2026

Quick summary. ColVelo is a marketplace. We collect the data needed to run accounts, process orders, and secure the platform. We don't sell your personal information. You can exercise your privacy rights at any time by emailing admin@ColVelo.com. The full legal text follows.

1. Who we are

ColVelo (“we,” “us,” “our”) operates www.ColVelo.com, a specialized online marketplace for bicycles, e-bikes, components, and cycling accessories. We connect buyers with independent sellers and bike shops across the United States.

Data Controller:
ColVelo
211 East 43rd Street, 7th Floor
New York, NY 10017
Email: admin@ColVelo.com

ColVelo is not a party to any transaction between users. We provide the platform. Sellers are independent and solely responsible for the products they list.

2. Data we collect

Depending on how you use ColVelo, we may collect the following:

2.1 Information you provide directly

  • Account data: first name, last name, email, phone number, password, country, and (for sellers) business name.
  • Address data: billing address, shipping address, ZIP code.
  • Listing data: photographs, descriptions, prices, and any specifications you provide when creating a listing.
  • Message data: the content of conversations you send through the platform chat.
  • Payment data: processed directly by Stripe, Inc. — we never see or store your full card number. We receive a confirmation of successful payment and a transaction reference.
  • Support data: any information you include when you contact us via email or our contact form.

2.2 Information we collect automatically

  • Usage data: pages viewed, time on page, referring URLs, clicks, and general interaction with the site.
  • Device data: browser type and version, operating system, IP address, device type, and screen size.
  • Location data: approximate location derived from your IP address. Precise location is only used if you explicitly grant permission (e.g., for the “bikes near me” filter).
  • Cookies and similar technologies: see Section 7.

2.3 Information from third parties

  • Google Sign-In: if you use Google to authenticate, we receive your name, email, and profile picture.
  • Stripe: payment confirmation data, billing country, and fraud-screening results.

3. How we use your data

We use your personal data for the following purposes:

  • Operating the marketplace: creating your account, publishing listings, processing orders, and enabling buyer-seller chat.
  • Payments: processing transactions and issuing refunds through Stripe.
  • Trust & safety: detecting fraud, preventing abuse, and enforcing our Terms of Use.
  • Communication: sending transactional emails (verification codes, order confirmations, password resets) and, if you opt in, marketing emails.
  • Improving the service: understanding which features are used and how we can make them better.
  • Legal compliance: responding to lawful requests and complying with tax and reporting obligations.

We do not use your data for automated decision-making that produces legal or similarly significant effects without human review.

If you are in the EU/UK, our processing relies on one or more of the following legal bases:

  • Contract: processing necessary to provide the service you requested (e.g., account creation, order fulfillment).
  • Legitimate interests: fraud prevention, security, service improvement, and customer support.
  • Consent: marketing emails and non-essential cookies. You can withdraw consent at any time.
  • Legal obligation: tax, accounting, and regulatory requirements.

5. Who we share your data with

We share data only where necessary. Recipients include:

  • Stripe, Inc. — payment processing, fraud screening.
  • Cloud hosting providers (e.g., Neon for database, Vercel/Firebase for app hosting) — storing data on our behalf.
  • Resend — sending transactional and notification emails.
  • Cloudinary — storing and serving uploaded images.
  • Google LLC — if you use Google Sign-In or our embedded Google Maps widget.
  • Law enforcement or regulators — when required by law or to protect our rights.

We do not sell your personal information to third parties for monetary consideration. Where U.S. state law treats certain analytics or advertising cookies as a “sale” or “sharing,” you can opt out via the cookie banner at the bottom of the site, or by emailing admin@ColVelo.com.

6. How long we keep your data

  • Account data: kept while your account is active, plus up to 10 years after closure to meet tax and legal obligations.
  • Order data: retained for at least 10 years for tax and warranty purposes.
  • Messages: retained while the account is active; deleted within 90 days of account closure.
  • Marketing preferences: kept for 24 months from the date you consented, then we'll ask you to reconfirm.
  • Usage logs: typically 12–24 months.

When data is no longer needed, we delete it or anonymize it so it can no longer be linked to you.

7. Cookies & tracking

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the site is used. When you first visit ColVelo, a banner lets you accept all cookies, reject optional ones, or customize them. Your choice is remembered for one year.

  • Strictly necessary: always on — required for login, cart, and security.
  • Analytics: optional — helps us measure site usage.
  • Marketing: optional — used for advertising measurement (currently not active).

You can change your cookie preferences at any time by clearing your browser storage, or by emailing us at admin@ColVelo.com.

8. Security

We use industry-standard safeguards to protect your data: TLS encryption in transit, encrypted password storage, role-based access controls, and regular review of our infrastructure. Payment data is never stored on our servers — it is handled entirely by Stripe. However, no system is perfectly secure; if you believe your account has been compromised, contact us immediately.

9. Your rights under GDPR (EU/UK users)

If you are located in the European Economic Area or the UK, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your data (“right to be forgotten”) where no legal obligation requires us to keep it.
  • Restrict or object to processing in certain circumstances.
  • Port your data to another controller in a machine-readable format.
  • Withdraw consent at any time for processing based on consent.
  • Lodge a complaint with your national data protection authority.

To exercise any of these rights, email admin@ColVelo.com. We respond within 30 days. You will not be charged a fee unless your request is manifestly unfounded or excessive.

10. Your rights under U.S. state privacy laws

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and Montana have the following rights to the extent required by their state law:

  • Right to know what personal information we collect, use, and share.
  • Right to access a copy of the specific information we hold about you.
  • Right to correct inaccurate information.
  • Right to delete your information, subject to certain exceptions.
  • Right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
  • Right to limit the use of sensitive personal information (California only).
  • Right to non-discrimination for exercising any of these rights.

To exercise a right, email admin@ColVelo.com with the subject line “US Privacy Rights.” We may need to verify your identity before we can act on your request.

Global Privacy Control (GPC): we honor GPC signals sent by your browser for opt-out-of-sale requests.

11. Children's privacy

ColVelo is not intended for children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page, and where required, we'll notify you by email. The “Last updated” date at the top of this page always reflects the most recent version.

13. Contact us

Questions about this policy or your data? Email admin@ColVelo.com. You can also write to:

ColVelo
211 East 43rd Street, 7th Floor
New York, NY 10017

See also our Terms of Use.