Privacy Policy

Effective Date: October 14, 2026

1. Introduction

ZEVEN AG ("ZEVEN", "we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose and protect information when you use the zeven.ai website, the Lucy portal (currently in beta), and related services (the "Services").

We comply with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU and UK General Data Protection Regulation (GDPR/UK GDPR).

Your use of the Services is also governed by our Terms of Service and, for beta participants, the Beta Tester Agreement.

Contact:

ZEVEN AG

Grafenauweg 8, 6300 Zug, Switzerland

Email: privacy@zeven.ai

2. Data We Collect

2.1 Information You Provide

When you use our Services, you may provide:

• Account data — your email address and name, from your sign-up and sign-in. The portal signs you in with single-use email links; there is no password.
• Training activity archives you upload — rides, runs, and the metrics inside them.
• Data synchronized from connected platforms — activities from the device platforms you connect: Wahoo, Hammerhead, Strava, TrainingPeaks, COROS and Suunto via our integration partner Terra, and Garmin, which we connect to directly and which can also provide sleep, wellness and body-composition data (see Section 10, Garmin Connect Data). You control these connections and can disconnect them at any time.
• Your athlete profile — details you enter or confirm through Lucy: date of birth, height, sex, weight and weigh-ins, and physiological thresholds such as FTP, critical power and heart-rate anchors.
• What you tell Lucy to remember — facts, preferences, decisions and free-text notes you ask Lucy to keep (for example your equipment, how a race went, an injury or a constraint), stored in your own words.
• Your plans and calendar — goals and target events, races, camps and travel, the hours and days you are available to train, and the sessions Lucy plans for you.
• Effort and wellbeing reports — how hard a ride felt (RPE) and what you say about it.
• Nutrition data — meals you log, foods and products you save, fueling and meal plans, and the answers you give in the nutrition interview (tested carbohydrate rates, caffeine, fluids, digestive history, dietary constraints, weight goals). If you log a meal with a photo, the image is stored under your account; camera photos can carry embedded location metadata (EXIF), which we never display or serve back.
• Location data for routes — the home location you set as a start point, the routes you draw or let Lucy plan, and the routes and workouts you send to your device.
• Communications with us.

Connections to Wahoo, Hammerhead, Strava, TrainingPeaks, COROS and Suunto are facilitated through Terra (Terra Enabling Developers Ltd.), which acts as our data integration provider enabling connections to external fitness platforms and devices. For more information on how Terra handles your data, please refer to Terra's End User Privacy Policy. Our direct Garmin connection does not pass through Terra; how we handle Garmin data is described in Section 10.

2.2 Waitlist and Sign-Up Data

When you use the "Keep me in the loop" form, we collect your name, email address, primary sport, country, and your marketing-communication preference. This data is stored securely in our managed databases (see Section 4) and is used to run the beta waitlist. Our waitlist entry for you also notes when we invited you, decided not to invite you or put you on the waitlist. "Delete my Data" keeps this entry while your account exists; "Delete my Account" deletes it.

2.3 Chat and AI Interactions

Our website features a demo chat. The text you type is sent to Anthropic, PBC (the maker of Claude) for processing, via our own servers — your IP address is not forwarded to Anthropic. Conversations are capped at a small number of turns, are not stored on our systems after your session ends, and are not used to train models under our agreement with Anthropic.

The question you type is handed to the chat page through your browser's session storage; only if your browser blocks that storage does it briefly appear in the page address (URL). Please do not include sensitive personal data in the demo chat.

Separately, in the Lucy portal: when you connect Lucy to an AI assistant of your choice (such as Claude, ChatGPT, Gemini, Perplexity or Grok, or another assistant that supports the Model Context Protocol) and ask about your training, your relevant training data is provided to that assistant so it can answer you. That platform's own privacy policy applies to your conversation there. For data from Garmin, see our AI Transparency Statement in Section 10.4.

2.4 Job Applications

Applications reach us by email to hello@zeven.ai. We process what applicants send us solely for the hiring process.

2.5 Technical Data

We collect server logs (IP address, timestamps, requests) needed to run and secure the Services. Your IP address is also used transiently, in memory, to rate-limit the chat and waitlist endpoints; it is not stored for that purpose. Your approximate location (country) is derived from server headers once per visit to apply the right consent settings for your region.

2.6 Health and Fitness Data

Through connected devices, uploaded activities and what you enter or tell Lucy, we process health-related data: heart rate and other physiological metrics (such as heart-rate variability, sleep, overnight blood oxygen and respiration, and stress), training load and performance indicators, body metrics (weight, height, sex, body composition), nutrition and dietary information, effort and wellbeing reports, and health-related notes you ask Lucy to remember (such as an injury, an illness or a digestive issue). This constitutes special category data under applicable law and is processed based on your explicit consent, for the sole purpose of providing you personalized performance, nutrition and coaching insights. You can withdraw that consent at any time by deleting the data or your account (Section 6); Lucy only asks for what a plan actually needs, and "I don't know" is always an accepted answer.

We also process location data: the home location you set, the routes you draw, plan or send to a device, and the GPS tracks of your recorded activities (including those from Garmin). We use it only to plan, show and deliver your rides, and to tell whether your home is in the area where Lucy plans routes, which decides whether one of our tips is about route planning (Section 2.7). It goes to the map provider that draws your maps (Section 4), which for the map in the email we send after a ride (Section 3) receives only the map area, because our server draws that map; to a weather service (Open-Meteo), which receives a few points along a planned route, without your name or account, to forecast ride-day weather; to the device platform you choose when you send a route (Sections 4 and 10.6); and to the AI assistant you connect when it answers you (Sections 2.3 and 10.4). The map in the email after a ride shows your route as you see it in Lucy; there is none for an indoor or virtual ride. Our server draws it when the email is sent and when it is opened, keeps it in memory for at most an hour and never stores it, and the email's link to it stops working a year after the email at the latest, or earlier when you delete the ride, your data or your account. Meal photos can carry embedded location metadata; we never use, display or serve it.

2.7 Emails We Send You

We choose the emails about your use of Lucy (Section 3) automatically, from what Lucy knows about your setup and how you use it: for example, whether your training history has been read, whether your device is syncing, which features you have used, whether your home is in the area where Lucy plans routes, your race goal and your recent rides. We read this information when we choose, and when our staff preview the emails you would get next; what we keep is described in this section:

• A copy of each email as it was sent to you, or as we tried to send it if it could not be delivered: its subject, text and design, with everything it showed (such as the names of your device and AI assistant, dates, and numbers from your rides), but without your personal links and without the map of a ride, which we never store. We keep it for 12 months.
• A record of each email we send to your account, including the email when your training history is ready: which email it was, when it was sent, whether it arrived or was marked as spam, which ride, race, upload or sync break it was about, why we chose it, whether you unsubscribed or turned off ride emails through it, and anything our staff did about it. We keep it while your account exists, so that no automatic email reaches you twice.
• Your settings for these emails and a few dates: your choices under Notifications, a pause you asked for, any stop on these emails, and the member of our team who receives your replies or looks after you in person; when you were invited or signed up, and when these emails started for you; when you first connected an AI assistant, wrote to Lucy and had your history read; and, for each platform you told us you had asked for your data export, when you told us and whether you wanted a reminder. We keep them while your account exists.
• Our record of the automatic checks, which shows which email was or was not chosen for you, and why. We keep it for 60 days.
• Your answers to the question after your first month, with your name and email address: the answers you tap, when you tap them, and anything you write. We keep them until you delete your data or your account.

We keep these to help you if you ask about an email, to find and fix delivery problems (for example, by sending an email again that did not reach you), to check that our emails reach the right people at the right time, to show what we sent you, to make sure no automatic email reaches you twice, and to respect your choices and any stop. We also keep your answers to learn from them how to improve Lucy, and to act on them: a pause when you tell us you have no time, or a note of the AI assistant you would like Lucy to support. ZEVEN staff see this information, open the copies and preview the emails you would get next only for these purposes. Each time a staff member opens one of your emails or takes an action on them, we log who did it, when and what they did, and, when they record that one of these emails was sent to you by hand, the note they add, word for word. This log is kept for 30 days; deleting your data or your account does not delete it sooner.

These emails contain no tracking pixel, we do not monitor whether you open them, and, apart from our server logs, we record a link you tap only when it acts for you, such as unsubscribing you or recording your answer. Such a link carries a code that identifies your account and the email; the link to the map in an email after a ride names your account and the ride in the same way. Like every request to our servers, opening one of these links or loading an image from an email is recorded in our server logs (Section 2.5), so the record of loading a ride's map shows when it was loaded, usually when you opened the email; we do not use these records for that. These logs also note each email we send, with your account ID and what it was about (such as the ride or the race), but without its content or your address. They are deleted after 30 days; deleting your data or your account does not delete them sooner.

Deleting. "Delete my Data" deletes the copies of these emails, with what each one said, and, from the record of each email, which ride it was about, why we chose it, whether you unsubscribed or turned off ride emails through it and what our staff did about it; it also deletes our record of the checks about your account, the dates of your first steps and of the data exports you told us about, the reminders you asked for, and your answers. It keeps the record of which emails were sent to your account, when, whether they arrived or were marked as spam, and the date of the race, upload or sync break an email was about, so that a late report of a bounce or a spam complaint is still recorded and none is sent twice, together with your settings, the dates of your invitation or sign-up and of the start of these emails for you, and the date you deleted your data, after which we send you none of these emails. "Delete my Account" deletes all of it with your account. Both buttons also delete the copy of an invitation reminder we sent to your address before you signed up, what it said, why we sent it, what our staff did about it or about your invitation, and our record of the checks about your address. If our automatic checks are running when you use either button or when we delete your data at your request, their record about you can still be stored afterwards, under a one-way hash of your email address, and is kept for 60 days.

What stays. Under a one-way hash of your email address (not the address itself), we keep, with no time limit and whatever you delete: whether an invitation reminder may still go to the address (none may once it has had a Lucy account, once our team turned the reminder off for it or once we deleted its place on the waitlist); whether a member of our team looks after it in person; the dates of the invitations and invitation reminders we sent to it, and whether they arrived or were marked as spam; and any stop on it after a bounce or a spam complaint about an email we sent to it before it had an account, because Amazon SES lists it, or because our team stopped these emails to it (for example at your request). We keep these so that an address gets at most one invitation reminder, and none once it has had an account, once our team turned the reminder off or deleted its place on the waitlist, or while our team looks after it in person, and so that these stops keep applying, also to a new account at that address. Your unsubscribe, your choices under Notifications, and a stop after a bounce or a spam complaint about an email to your account belong to your account and are deleted with it.

Our log of account actions keeps a note, with your email address, the date and who did it, each time you use "Delete my Data" or "Delete my Account", and each time our team decides not to invite you from the waitlist, suspends your account or lifts its suspension, or deletes your account or your place on the waitlist (for example at your request). We keep these notes with no time limit, whatever you delete, so that our team can see what was done, when and by whom, and so that no invitation reminder goes to an address whose account or place on the waitlist was deleted or that we decided not to invite. If an email to your address bounces permanently, or you mark one of our other emails, such as a sign-in email, as spam, Amazon SES, which delivers our emails, keeps the address itself on its list of addresses it does not deliver to, until we remove it. If you are on the list of people who get these emails while we test them, your address stays on that list until we take it off, whatever you delete.

3. How We Use Your Data

We use your data to:

• Provide and improve the Services
• Build your training profile and answer the questions you ask Lucy
• Plan your training, nutrition and routes, remember what you tell Lucy, and deliver workouts and routes to the devices and calendars you choose
• Run the beta waitlist and send you the updates you asked for
• Send you emails about your use of Lucy (Section 2.7): a reminder if you have not yet accepted your invitation, help with your setup (including a reminder you can ask for while a platform prepares your data export), a few tips about features you haven't used yet, one question after your first month, a note when an upload is about to expire or your device stops syncing, an email the day after your goal race, and an email after your first ride that reaches Lucy by live sync (after every ride, if you turn that on in that email or in your account). Every tip and every ride email carries a one-click unsubscribe. In your account under Notifications, Activity Debrief turns the emails after every ride on or off, and Beta Tips all the others, the email after your first ride included.
• Understand how our website is used
• Ensure security and prevent abuse
• Comply with legal obligations

Legal Basis:

• Contract performance (to provide the Services)
• Legitimate interests (to improve and secure our platform, and to send you the tips, the question after your first month and the emails about your rides and your race described above, which you can turn off at any time)
• Consent (for marketing communications, analytics where consent is required, and special-category health data)
• Legal obligations

4. Data Sharing

We do not sell your personal data. We do not share it for advertising, and we do not use targeted advertising — including as "selling" or "sharing" are defined by the California Consumer Privacy Act.

We share data only with:

• Amazon Web Services (AWS) — hosting and email delivery (SES); primary region EU-Frankfurt (eu-central-1)
• TigerData — managed PostgreSQL database services for our platform, running on AWS infrastructure
• Google LLC — website analytics (Google Analytics 4; see Section 9, Cookies, Analytics and Storage)
• Contentsquare (Hotjar) — website behavior analytics: heatmaps and session replays (see Section 9, Cookies, Analytics and Storage)
• Anthropic, PBC — demo-chat processing
• Terra Enabling Developers Ltd. — device-platform integration, and the platforms you choose to connect or import from through it (Wahoo, Hammerhead, Strava, TrainingPeaks, COROS, Suunto), and an earlier Garmin connection made through Terra (Section 10.1); when you send a workout or a route to one of those devices, its content travels the same way
• Garmin — only if you connect Garmin: the workouts and routes you choose to send to your Garmin device (see Section 10.6)
• Mapbox, Inc. — map rendering for route and activity cards and for the map in the email after a ride: the route geometry and map area to draw (for a recorded activity, a simplified copy of its GPS track; for that email, only the map area), and your IP address when the interactive map loads in your browser. Mapbox does not receive your name or account
• Open-Meteo — ride-day weather forecasts: a few points along a planned route and the planned day, without your name or account
• Your calendar provider — only if you choose to add a planned session to your calendar; the event details go to the provider you pick
• The AI assistant platform you personally connect Lucy to — their own terms and policies apply to your conversation there
• Content delivery servers — static assets and the homepage 3D scene load from cdn.jsdelivr.net and Unicorn Studio, which see your IP address as part of serving that content (see Section 9.5)
• Legal authorities when required by law

The service providers above that host, store or process data for us (AWS, TigerData, Google, Contentsquare, Anthropic, Terra and Mapbox) are contractually obligated to protect your data and use it only as instructed. Garmin, your calendar provider and the AI assistant you connect receive data only when you ask us to send it, and they use it under their own terms and privacy policies.

5. International Data Transfers

Our primary infrastructure is hosted on AWS in the EU (Frankfurt, eu-central-1). Your data may be processed in:

• Switzerland — our company
• The European Economic Area — hosting
• The United Kingdom — Terra; the UK benefits from adequacy decisions under EU and Swiss data protection law
• The United States — Google LLC (analytics data; Google is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework, with EU Standard Contractual Clauses as fallback; Google Analytics 4 does not log or store IP addresses), Anthropic (chat text) and Mapbox, Inc. (route geometry, simplified activity GPS tracks and map requests)

When you ask us to, we also disclose data to Garmin (Section 10.6) and to the AI assistant you connect (Section 10.4). These providers act under their own privacy policies and may process the data in the United States and in other countries where they operate. We make these disclosures because they are necessary to provide the Services you asked for (Art. 49(1)(b) GDPR; Art. 17(1)(b) FADP), not under Standard Contractual Clauses.

Content delivery servers (Section 9.5) are globally distributed; only your IP address is involved in those requests.

For all other transfers outside Switzerland or the EEA, we rely on adequacy decisions where they are available, and otherwise on EU Standard Contractual Clauses together with the Swiss addendum.

6. Data Retention

We retain your data only as long as necessary:

• Account and training data — while your account exists. "Delete my Account" on the portal account page permanently erases your account, revokes AI-assistant connections, and deletes everything listed in Sections 2 and 10 (activities, your profile, what Lucy remembers, plans and calendar, effort reports, nutrition data and meal photos, routes and home location), except what Sections 2.7 and 10.7 say we keep. "Delete my Data" on the same page erases all of that while keeping your account and your waitlist entry (Section 2.2). Backups holding residual copies expire on their regular cycle.
• Meal photos — until you delete the meal, your data or your account; they are never published or served back as a link
• Emails we send you — a copy of each email: 12 months; the record of each email sent to your account: while your account exists; our record of the checks: 60 days; what stays after deletion, and why: Section 2.7
• Waitlist and sign-up data — while the beta program runs; deleted earlier on request to privacy@zeven.ai, except what Section 2.7 says stays: what we keep under a one-way hash of your email address and in our log of account actions, and your address on Amazon SES's list or our test list until we take it off
• Demo-chat messages — not stored after your session
• Server logs — at most 30 days, for security and operations
• Analytics data — Google Analytics retains data for up to 14 months; Contentsquare retains behavior data for up to 13 months
• Legal and financial records — as required by law (typically up to 7 years)
• Your privacy choice — stored only on your own device

7. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data
• Export your data in a portable format
• Withdraw consent
• Restrict the processing of your data
• Object to processing based on legitimate interests
• Lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local EU/UK data protection authority

We extend these rights to every user, wherever you live.

To exercise your rights: contact us at privacy@zeven.ai. Account holders can also use "Delete my Account" on the portal account page. We may verify requests via the email address on record and aim to respond within 30 days.

8. Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit, access controls, and secure hosting. Portal sign-in uses single-use email links — we never store a password for your portal account. While we use industry-standard security practices, no system is completely secure.

9. Cookies, Analytics and Storage

9.1 Cookies on This Website

zeven.ai uses no advertising trackers and no cross-site tracking cookies. The cookies in use are:

• The strictly necessary sign-in session cookie set by our authentication service on zeven.ai subdomains when you sign in to the beta; the website reads it only to show signed-in navigation.
• A strictly necessary __Host-zeven-garmin-flow cookie, set by the Lucy portal for at most 10 minutes while you connect Garmin, to match Garmin's reply to your browser; it is removed when the connection completes.
• Analytics cookies — Google Analytics and Contentsquare (listed in Section 9.4), set only with your consent in the EEA and the UK, and until you opt out elsewhere. Declining or switching analytics off removes them again.

9.2 Analytics

We use two analytics tools, both governed by the same choice (Section 9.3):

• Google Analytics 4 (Google LLC) measures visits and how the site is used. It sets the cookies listed in Section 9.4 and does not log or store IP addresses; analytics data may be transferred to the United States under the EU-U.S. and Swiss-U.S. Data Privacy Framework, with EU Standard Contractual Clauses as fallback.
• Contentsquare (Hotjar) shows us heatmaps and session replays of how pages are used, so we can improve them. It sets the cookies listed in Section 9.4; what you type is masked and never recorded.

We honor Do Not Track and Global Privacy Control — when either signal is on, neither tool runs. No third party collects personal information about your activity across other websites through zeven.ai.

9.3 Your Choice by Region

In the EEA and the UK, analytics runs only after you accept it in the cookie banner. In Switzerland and other regions, it is on by default and you can switch it off at any time. You can manage this any time via Cookie Settings in the site footer (shown as Privacy Choices to visitors in the United States), which opens the same controls; they are also available at Privacy Choices.

9.4 Cookies and Local Storage

Analytics cookies (only while analytics is on for you):

• _ga — Google Analytics; distinguishes unique visitors; expires after 2 years
• ga* — Google Analytics; persists session state across page loads; expires after 2 years
• _cs_id — Contentsquare; distinguishes unique visitors; expires after 13 months
• _cs_s — Contentsquare; counts page views in the current browsing session; expires after 30 minutes
• _cs_c — Contentsquare; remembers your Contentsquare consent state; expires after 13 months

Opting out of analytics removes these again. If you switch analytics off while it was running, Contentsquare additionally stores your opt-out itself (_cs_optout) so its servers are not contacted anymore.

Browser storage we use for functional purposes only:

• zeven.consent — your privacy choice, stored on your device only
• zeven.consent.region — a cache of your detected region, kept for the browser session only
• zeven.chat.q — carries the question you typed on the home page to the chat page, kept for the browser session only

The functional entries are not used for tracking.

9.5 Content Delivery

Static assets and the homepage's 3D scene load from cdn.jsdelivr.net and Unicorn Studio's servers. Like any content server, they technically see your IP address; they set no cookies or identifiers for us.

10. Garmin Connect Data

This section describes how Lucy collects, uses, processes, stores and shares data from Garmin Connect ("Garmin data") when you connect your Garmin account. It adds to the rest of this Privacy Policy; for Garmin data, where the two differ, this section applies.

In short: we store Garmin data on Amazon Web Services (AWS) in Frankfurt, Germany, and in our TigerData database, and process it with our own software, using fixed formulas. Garmin data is shared with, or processed by, only these third parties: our service providers AWS, TigerData and Mapbox (Section 10.5); Terra, only for an earlier Garmin connection made through Terra (Section 10.1); the AI assistant you choose to connect, whose AI model reads it to answer you (AI Transparency Statement); Garmin, for the workouts and routes you choose to send (Section 10.6); your own email provider, which receives the emails we send you (Section 10.3) for you, under its own terms; and authorities where the law requires it. We do not sell Garmin data, use it for advertising, or use it to train AI models.

10.1 How the Connection Works

Lucy connects to Garmin Connect directly, through the Garmin Connect Developer Program; Garmin data from this connection does not pass through Terra or any other integration partner.

You start the connection yourself in the Lucy portal, during setup or under My Account → Integrations. You are then taken to Garmin's own page, where you sign in to Garmin and choose which permissions to grant. We never see or store your Garmin password. Lucy asks for these Garmin permissions and uses only the ones you grant:

• Activities — to read your recorded activities
• Health — to read your sleep, daily wellness, heart-rate variability and body-composition data
• Historical data — to ask Garmin for data you recorded in a limited period before you connected (at most 90 days); Lucy does not make these requests yet
• Workouts — to send workouts to Garmin Connect, schedule them on your calendar there, and check or remove the calendar entries Lucy created (to do this, Lucy briefly reads the dates of the entries on your Garmin calendar and keeps only its own)
• Courses — to send routes to Garmin Connect as courses

If you decline on Garmin's page, nothing is collected. You can change these permissions in Garmin Connect at any time, and Lucy follows the change.

If you connected Garmin through Terra before we connected to Garmin directly, that earlier connection keeps delivering through Terra until you disconnect it; the Garmin window in the Lucy portal lists it as your earlier integration, with its own Disconnect. Anything it still delivers is kept in our archive but is not added to your Lucy data. Garmin data you synced earlier through Terra stays in your Lucy data as part of your history.

10.2 Garmin Data We Collect

Depending on the permissions you grant, we receive:

• Your Garmin connection — your Garmin user ID, the permissions you granted, and the access tokens that let Lucy read your data (stored encrypted). Garmin does not give us your Garmin password, name or email address.
• Activities — sport, start time and time zone, duration and moving time, distance, elevation gain and loss, heart rate, power, cadence, speed, calories, laps, the activity's title and description, the device name, and the GPS track with its samples. We also download the original activity file (FIT, TCX or GPX), which can add temperature, torque, left/right pedal balance and the body weight set in your device's user profile.
• Sleep — sleep and wake times, sleep stages (deep, light, REM, awake), your Garmin sleep score, and overnight blood oxygen (SpO2) and respiration rate.
• Daily wellness — steps, distance, floors climbed, active time, stress level and time spent at each stress level, your all-day heart rate (a reading every 15 seconds, which we use to calculate your daily average), resting and maximum heart rate, and calories, together with the other values in Garmin's daily summary, such as Body Battery and intensity minutes.
• Heart-rate variability (HRV) — your overnight HRV summary. We store it with your other Garmin data, but Lucy does not yet show it, use it in your metrics or give it to your AI assistant; we will update this section before that changes.
• Body composition — weight and body-fat percentage, together with the other values your scale reports, such as muscle mass, bone mass, body water and BMI.

We do not receive Garmin's menstrual-cycle, pregnancy, blood-pressure or skin-temperature data, or its all-day stress, blood-oxygen and respiration timelines.

Your own Garmin export. Separately from the connection, you can upload the data export that Garmin lets you download from your Garmin account. From it we read activities, daily wellness, sleep and weigh-ins, and your name, sex, height and date of birth, which we use only to fill empty fields of your athlete profile. We never read the contact information file the export contains. The uploaded file itself is deleted after 30 days.

10.3 How We Use Garmin Data

We use Garmin data only to provide Lucy to you:

• to show your activities, sleep and wellness in the Lucy portal and in Lucy's answers
• to calculate your training metrics — training load, fitness and fatigue trends, zones, power curve and threshold estimates — together with data from your other sources; when the same activity arrives from more than one source, we keep one copy
• to answer your questions and to plan your training, recovery, nutrition and routes
• to send the workouts and routes you approve to Garmin (Section 10.6)
• to send you emails about your own activities: a one-time email when your training history is ready (for example, your number of activities and total distance); an email after your first ride that reaches Lucy by live sync, when it comes from Garmin, with that ride's date, its distance, climb and moving time where they can be trusted, your device and a map of the route; the same email after every ride, if you turn it on in that email or in your account; an email the day after your goal race, with the moving time, distance and climb of your ride from race day where they can be trusted, and their source (for example "Garmin · Edge 840"), when a ride of at least an hour from that day has reached Lucy; and, in a one-time email after your first month, your number of rides, hours and kilometers since you joined Lucy (from the later of your invitation and your sign-up) and their source (for example "Garmin · Edge 840"), when your live sync delivered that whole month

These calculations are done by our own software, using fixed formulas over your own data. We do not sell Garmin data, use it for advertising or share it with other users. We do not use it to build models of other people, and we do not use it to train any AI or machine-learning model. ZEVEN staff access it only as needed to operate, secure and support the Services.

Legal basis. We process Garmin data to provide the Services you asked for (performance of our contract with you; Art. 6(1)(b) GDPR). We use it in the emails about your rides, your race and your first month in our legitimate interest in helping you use Lucy (Art. 6(1)(f) GDPR); you can turn these emails off at any time (Section 3). Heart rate, heart-rate variability, sleep, blood-oxygen, respiration, stress and body-composition data are health data, which we process only with your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7) FADP; Section 2.6). You can withdraw that consent at any time (Sections 10.4 and 10.7); withdrawal does not affect processing that took place before.

10.4 AI Transparency Statement

Lucy is an AI coach that works inside an AI assistant you choose, such as Claude (Anthropic), ChatGPT (OpenAI), Gemini (Google), Perplexity or Grok (xAI). You can also authorize another assistant that supports the Model Context Protocol (MCP): you approve each one yourself on our consent screen, it receives only your own data, and everything in this statement applies to it in the same way. This is how artificial intelligence processes your Garmin data:

• What is processed, and how. When you talk to Lucy, the assistant uses Lucy's tools to retrieve the data it needs from your own Lucy account, and Lucy returns it into that conversation only; it never returns another person's data. This can include Garmin data: activity summaries, detailed samples (up to one per second) including GPS positions, sleep, heart rate, daily wellness, weight and body-fat values, the status of your Garmin connection, and metrics calculated from them. The assistant's AI model (a large language model operated by that assistant's provider) reads this data to analyze it and respond to you.
• Purpose. Only to answer your questions and coach you in your own conversations: analyzing your training and recovery, and preparing plans and recommendations for you.
• Who processes it. The provider of the assistant you connected, under its own terms and privacy policy; we do not control how it handles your conversations. Depending on your settings with that provider, it may use your conversations, including the Garmin data Lucy returned in them, to train or improve its AI models; where the provider offers a setting to switch this off, you can use it there. ZEVEN itself does not run AI models on Garmin data, does not send Garmin data to any other AI service, and does not use Garmin data to train AI models.
• Your consent. No AI processing of your Garmin data takes place until you connect Lucy to an assistant yourself and select Authorize on our consent screen, which asks your permission for that assistant to read your activities and training data and links to this Privacy Policy. In Lucy, this includes the Garmin activity, sleep, wellness, heart-rate and body data described above, which the assistant's AI model then processes. Each assistant needs its own approval.
• Withdrawing consent. You can remove the Lucy connector in your assistant at any time, and that assistant then stops using Lucy; removing it there does not notify us. To end every assistant's access to your Lucy account on our side, write to privacy@zeven.ai, or use "Delete my Data" or "Delete my Account" (Section 10.7), which also end it. Once access is ended, an assistant cannot obtain new data from Lucy, and any access it had already been given expires within one hour. Disconnecting Garmin stops new Garmin data, but a connected assistant can still read the Garmin data already in your Lucy account. What an assistant received in earlier conversations stays with its provider under its policy; you can delete those conversations there.
• Changes. We update this statement whenever the way we use AI with Garmin data changes, and whenever applicable laws, regulations or Garmin's policies require it. We announce material changes as described in Section 12 and, where a change requires it, ask for your consent again before continuing.

10.5 Storage, Security and Service Providers

We store Garmin data with two providers: Amazon Web Services (AWS) in Frankfurt, Germany (eu-central-1), and TigerData, our managed PostgreSQL database, which runs on AWS infrastructure. Our archive on AWS keeps the data exactly as Garmin delivered it, including original activity files; the database holds the processed data. Working copies made from it, such as cached activity samples for faster answers, are kept in the same AWS environment and are deleted with your data.

The archive is private, encrypted at rest and accepts only encrypted (TLS) connections. Garmin access tokens are encrypted with AES-256 before they are stored, and the keys are held separately in AWS Secrets Manager. We accept Garmin's data deliveries only from Garmin's published network addresses.

Garmin data is processed by these service providers, under contract and on our instructions:

• Amazon Web Services (AWS) — hosting, processing, storage and email delivery (Amazon SES)
• TigerData — managed database
• Mapbox, Inc. (United States) — maps. To draw a map of an activity, our server sends Mapbox a simplified copy of its GPS track (about 90 points), and when you open an interactive map, your device loads the map of that area from Mapbox. Mapbox does not receive your name, account or Garmin identity. When an email about a ride contains a map, our server draws it with Mapbox's map software and loads the map tiles for that area from Mapbox; the ride's track itself never leaves our servers. The email only links to that image on our own server; the link stops working a year after the email at the latest, or earlier when you delete the ride, your data or your account.
• Terra Enabling Developers Ltd. (United Kingdom) — only for an earlier Garmin connection you made through Terra, until you disconnect it (Section 10.1)

Beyond these providers, Garmin data is shared only with the AI assistant you connect (Section 10.4), with Garmin when you send workouts or routes (Section 10.6), with your own email provider, which receives the emails we send you (Section 10.3) for you, under its own terms, and with authorities where the law requires it.

10.6 Data We Send to Garmin

If you grant the Workouts and Courses permissions, Lucy can send data to your Garmin Connect account, from where Garmin delivers it to your devices:

• Workouts — name, description, sport and steps, with durations and targets (power in watts calculated from your FTP, heart rate or cadence), and a calendar entry on the day you plan the workout
• Courses — a route's name, track points (position and elevation), distance, climbing and descent, and type of cycling

Purpose and method. Lucy sends this data so that Garmin Connect can add the workout, with its calendar entry, or the course to your Garmin account and deliver it to your compatible Garmin devices. Our servers send it directly to Garmin over an encrypted connection, using the Workouts and Courses permissions you granted.

Your consent. Lucy sends nothing to Garmin unless you ask. For a workout, Lucy first shows you a preview and sends it only after you confirm; for a route, you name the route, choose Garmin and confirm. That confirmation is your express consent to transfer the data listed above to Garmin.

When you send, you transfer this data to Garmin, which processes it under the Privacy Policy for Garmin Connect and Compatible Garmin Devices. Do not send data to your Garmin Connect account if you are restricted from doing so.

Lucy can remove calendar entries it created; the workout itself stays in your Garmin Connect workout list. Workouts, their calendar entries and courses stay in your Garmin Connect account when you disconnect Garmin or delete your Lucy data; you can delete them in Garmin Connect.

10.7 Disconnecting, Retention and Deletion

• Disconnecting. In the Lucy portal, go to My Account → Integrations, open Garmin, choose Disconnect and confirm. We stop adding new Garmin data to your Lucy data right away, ask Garmin to end Lucy's access, and delete your Garmin access tokens once Garmin confirms. Anything Garmin sends before then is kept only in our archive of original data. You can also remove Lucy in Garmin Connect; Garmin then stops sending us your data.
• After you disconnect, the Garmin data already in your Lucy account stays, so your history, metrics and plans keep working, together with the record of the connection (your Garmin user ID and the permissions you had granted). You can reconnect once the disconnection has completed.
• Retention. We keep Garmin data for as long as your account exists, until you delete it. It does not expire automatically.
• Deletion. "Delete my Data" and "Delete my Account" in the Lucy portal delete all of your Garmin data, together with all your other data in Lucy (Section 6): the processed data, the metrics calculated from it, and every stored version in the archive of original data. They also end Lucy's access at Garmin. Deletion runs in the background and completes once Garmin has confirmed that Lucy's access has ended. Database backups roll off on their regular cycle, and server logs after 30 days (Section 2.7). There is no separate control to delete only your Garmin data; to ask for that, write to privacy@zeven.ai.
• After deletion, we keep, with no time limit, a one-way hash of your Garmin user ID and a record of which archive files were erased; neither contains your Garmin data. We keep them so that data Garmin delivers late is discarded rather than stored again. For the same reason, that Garmin account cannot currently be connected to Lucy again; contact privacy@zeven.ai if you want to reconnect it.
• Your rights under Section 7 (access, correction, deletion, restriction, objection, export and withdrawal of consent) apply to Garmin data as well; contact privacy@zeven.ai.

11. Children's Privacy

Our Services are not intended for individuals under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us immediately.

12. Updates to This Policy

We may update this Policy as our Services evolve. Material changes will be communicated by email or in-app notification at least 30 days before taking effect.

The latest version is always available at: zeven.ai/legal/privacy

13. Contact Us

For questions or requests regarding this Privacy Policy:

ZEVEN AG

Grafenauweg 8, 6300 Zug, Switzerland

Email: privacy@zeven.ai

Version: 2.6 — the emails about your use of Lucy: what we keep of them, for how long, who can see it, and what stays after you delete your data or your account; the map in the email after a ride; the ride, race and month-one numbers; and the waitlist entry "Delete my Data" keeps (Sections 2.2, 2.6, 2.7, 3, 4, 6 and 10)

Last Updated: October 14, 2026

This version supersedes Version 2.5 (October 4, 2026), Version 2.4 (September 23, 2026), Version 2.3 (September 9, 2026), Version 2.2 (September 3, 2026), Version 2.1 (August 24, 2026), Version 2.0 (August 24, 2026) and Version 1.1 (March 3, 2026).