Privacy Policy
Page last updated: 31 July 2026. Data last reviewed: 29 July 2026.
Velo Index (theveloindex.com) is a specification comparison site. It requires no account, sells no products directly, and is designed to work with as little personal data as possible. This policy describes each way data is processed when you use the site, the legal basis for each, and your rights.
Who Is Responsible
Velo Index is independently operated from Ireland. The operator of theveloindex.com acts as the data controller for the processing described in this policy. Contact for any privacy matter: inquiries@theveloindex.com.
What Is Processed, and Why
Hosting and platform logs
The site is hosted on Vercel, which acts as a processor. Like every web server, Vercel receives your IP address, user agent and the paths you request in order to serve the site at all, and keeps standard request logs for a limited rolling window. Velo Index does not build profiles from these logs; they are used for serving requests, security and abuse prevention.
Web analytics
Velo Index uses Vercel Web Analytics, which is cookieless by design. It records device type, browser, referrer, approximate location, page views and named interaction events, such as affiliate link clicks, finder submissions, region switches and spec dialog opens. No advertising identifiers are used and no per-visitor profile is available to Velo Index; reporting is aggregate.
The MCP server
Velo Index operates a public, read-only MCP endpoint at /api/mcp that lets AI assistants query the specification dataset. It requires no authentication, creates no account, and receives no personal data from the calling agent beyond what the request itself carries: a query, a region and filter parameters.
Requests to the MCP server typically originate from the calling AI provider's infrastructure rather than directly from your device. The originating IP address is evaluated transiently in memory to enforce rate limits on this free endpoint and is not written to Velo Index's own tool logs. Those logs record only the tool name, the region queried, the names of the filters used and result counts, never IP addresses or free-text query values.
Query parameters may incidentally contain text you typed into the calling assistant. Velo Index does not request or require personal data in queries, uses query content only to serve the request, and stores nothing on your device. Velo Index has no visibility into, and no control over, what the calling AI provider logs or retains about your conversation; consult that provider's own privacy policy for that side of the exchange.
Local storage on your device
If you bookmark bikes to a shortlist, the shortlist is saved under the veloindex:shortlist key in your browser's local storage. It is stored only on your own device, is never transmitted to Velo Index, and can be cleared by you at any time through your browser settings. It is written only when you use the bookmark feature, a service you explicitly request.
Affiliate network redirects
Some outbound links are affiliate links. An affiliate link is a tracked redirect: clicking one passes you to the affiliate network and then the merchant, and the network may set cookies or identifiers on its own domains to attribute a later purchase. That tracking is governed by the network's and merchant's own privacy policies, not this one. Velo Index works with the following networks: AWIN, GoAffPro, TUNE, UpPromote and Social Snowball. Velo Index receives only aggregate click and conversion reporting from these networks, never individual purchase data or buyer identities.
Email contact
If you email inquiries@theveloindex.com, your address and message are kept for as long as needed to handle the enquiry and to keep a record of correspondence.
Legal Basis at a Glance
| Activity | Data | Purpose | Basis | Retention |
|---|---|---|---|---|
| Hosting and platform logs | IP address, user agent, request path | Serving requests, security, abuse prevention | Legitimate interests (Art. 6(1)(f)) | Limited rolling window set by the hosting platform |
| Web analytics | Device type, browser, referrer, approximate location, page views, named events | Understanding aggregate site usage | Legitimate interests (Art. 6(1)(f)) | Aggregate statistics only; no per-visitor profile retained |
| MCP server rate limiting | IP address (evaluated transiently, not written to logs by Velo Index) | Preventing abuse of a free public endpoint | Legitimate interests (Art. 6(1)(f)) | In-memory only; discarded when the rate window passes |
| MCP server tool logs | Tool name, region, filter names, result counts | Operating and improving the service | Legitimate interests (Art. 6(1)(f)) | Limited rolling window set by the hosting platform |
| Shortlist local storage | Bike identifiers stored on your own device | Keeping your shortlist between visits | Strictly necessary for a feature you request; never transmitted to us | Until you clear it |
| Email contact | Your email address and message content | Replying to your enquiry | Legitimate interests (Art. 6(1)(f)) | As long as needed to handle the enquiry and keep a record of correspondence |
No Automated Decision-Making
Velo Index performs no automated decision-making or profiling within the meaning of Article 22 GDPR. Tools such as the E-Bike Finder run entirely on the inputs you provide in the moment and retain no profile of you.
Your Rights
Under the GDPR you have the right to:
- access the personal data held about you;
- have inaccurate data rectified;
- have your data erased;
- restrict processing;
- receive your data in a portable format;
- object to processing based on legitimate interests;
- lodge a complaint with a supervisory authority. For Velo Index, operated from Ireland, that authority is the Data Protection Commission.
To exercise any of these rights, email inquiries@theveloindex.com. In practice, Velo Index holds very little personal data: for most visitors, nothing identifiable is retained at all.
Where Processing Happens
The site is served from Vercel's global edge network, so requests are handled at the location nearest to you and platform processing may take place inside and outside the European Economic Area, including in the United States. Such transfers take place under Vercel's data processing agreement, which incorporates the European Commission's standard contractual clauses.
Changes to This Policy
When this policy changes, the updated version is published on this page with a new date. Material changes to what is processed or why will be described in the policy itself, not applied silently. See also the Terms of Use and the methodology page.