Commuta is operated by Commuta Ltd, the data controller responsible for your information. For any privacy question or request, contact rob@commuta.cc. We process your data on two legal bases: your consent (to connect your Strava account) and our legitimate interest in running the platform and calculating your C-Coins.

Your name, email address, date of birth, body weight, and activity data pulled from Strava — distance, duration, sport type, speed, elevation gain, GPS route, and heart rate and power where available.

Solely to calculate your Commuta active-travel metrics and C-Coins, display your personal and crew dashboards, and operate the service. We never sell your data and never use it for marketing. To run the service we rely on a few trusted providers, each receiving only what it needs: our hosting and database provider, where your data is held; our email provider, which receives your email address to send you emails such as login links; our maps provider, which powers the maps you use to register routes (when a map loads, your browser connects to it and it receives your device's IP address); and our weather provider, which supplies the resilience-bonus weather and receives only a location and time, with no name or identifier attached. We don't share your data with anyone else.

Securely on encrypted servers hosted in the European Union (Frankfurt, Germany). Where data moves between the UK and the EU, that transfer relies on the UK and EU data-adequacy arrangements.

We keep your data for as long as your account is active. If you ask us to delete it, or you disconnect Commuta from Strava, we delete your personal data within 30 days and confirm once it's done. If you delete an activity in Strava, that change is reflected in Commuta promptly — within 48 hours.

You can request a copy of the data we hold, ask us to delete or correct it, or withdraw your consent at any time — email rob@commuta.cc. You can also revoke Commuta's access directly in Strava (Settings → My Apps). We action requests promptly and confirm in writing once a deletion is complete. You also have the right to complain to your data protection regulator — in the UK, the Information Commissioner's Office (ICO).

Commuta accesses your Strava data via Strava's official API, under the permissions you grant during authorisation. Strava is an independent data controller of the data it holds — see Strava's Privacy Policy, which governs Strava's own processing and takes precedence for Strava-held data. Strava may also monitor and collect usage data about API activity and use it for its own business purposes. You can revoke Commuta's access at any time in Strava → Settings → My Apps. Activities within a Strava privacy zone will not include GPS data and cannot receive the weather resilience bonus.

Named Commuta administrators have read access to your activity data solely for data-integrity verification and C-Coins accuracy. This access is limited to named administrators only and is not used for any other purpose.

Commuta uses a small number of essential cookies to keep you logged in and remember your preferences, such as your crew-leaderboard visibility. We don't use advertising or third-party tracking cookies.