Privacy Policy

All Ride School SAS (“All Ride School”, “we”, "our") is a simplified joint-stock company registered with the Trade and Companies Register of La Rochelle under number 929 617 314, whose registered office is located at 21 chemin du Prieuré, 17024 La Rochelle Cedex 1, France.

All Ride School publishes and operates a platform dedicated to learning and progressing in board and gliding sports (Kitesurfing, Wingfoiling, Surfing, Skateboarding, Snowboarding, Skiing and other related disciplines) as well as to connecting riders and instructors, accessible through:
• the allrideschool.com website and its subdomains;
• the All Ride School mobile application (iOS and Android). the allrideschool.com website and its subdomains; the All Ride School mobile application (iOS and Android).

These services are collectively referred to in this policy as “Services”.

This privacy policy ("Policy") describes how All Ride School collects, uses, shares and protects your personal data when you use our Services. It applies to all users of the Services, whether riders or instructors, wherever they are located in the world.

For users residing in the United States, additional provisions are set out in Section 10 of this Policy.

All Ride School is the data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (“GDPR”) for all processing activities described below.

We take the protection of your data seriously. Our approach is based on four principles:
Minimisation : we only collect data necessary for the operation of the service.
• Transparency: we clearly explain to you what we collect, why, and with whom we share it.
• Control: you have extensive rights over your data and simple mechanisms to exercise them.
• Security: we implement appropriate technical and organisational measures to protect your data.

All Ride School does not sell your personal data to third parties and does not use it for targeted advertising purposes.

For any question relating to this Policy or to the exercise of your rights:
• By email: privacy[a]allrideschool.com
• By post: All Ride School — Privacy Department, 21 chemin du Prieuré, 17024 La Rochelle Cedex 1, France.

To report problematic content or behaviour on the platform:
• report@allrideschool.com.

All Ride School has appointed a Data Protection Officer (DPO) with the Commission Nationale de l'Informatique et des Libertés (CNIL), under designation number DPO-173916, with an effective date of 23 May 2026. The DPO can be reached at privacy[a]allrideschool.com. Their tasks, resources and detailed contact information are specified in Section 12.3 of this Policy.

We collect three broad categories of information about you: information you provide to us directly, information generated by your use of the Services, and information you exchange with your AI Coach.

To create an account on All Ride School, we ask for the following information:

• First name
• Last name
• Email address
• Date of birth
• Sport(s) practised
• Role (rider or instructor)
• Place of residence (city, country)

• Professional certifications and diplomas (as an image file or PDF), required for the validation of your instructor profile. These documents undergo human verification by our team before your profile is effectively published.

You may choose to complete your profile with the following
items: Profile picture
• Gender (male, female, non-gendered)
• Equipment used (brands, models, board, sail, kite sizes, etc., depending on your sport)

• Number of students trained
Number of years of experience
• Languages spoken
• Average session
rate Biography
• Teaching spots and locations
• Ride photos

Access to your account is via your email address and a 6-digit code sent by email upon each login. No password is stored on All Ride School’s side. No login via a third-party account (Google, Apple, Facebook, etc.) is offered at this stage.

When using the Services, you may provide and post the following content:
• Session data: location, city, country, weather conditions, duration, tricks worked on, tricks landed, tricks missed, feelings, feedback, notes, score, session photos. This data is entered by you via a conversational interface (the AI Coach, see Section 1.3) or via a dedicated form. No data is automatically extracted from sensors, connected objects or third-party applications.
• Reviews of instructors (riders only): 5-star rating and optional comment. These reviews are displayed on the profile of the instructor concerned, identified by your first name and the first letter of your last name.
• Photos: profile picture, ride photos added to your profile or your sessions.
• Messages: content of the private conversations you exchange with other users via the integrated messaging service (see Section 1.2 for the technical processing arrangements).

When you contact us by email, via a form or by any other channel, we collect the information you provide in connection with your request (subject, description, any attachments) as well as your contact details, in order to be able to respond to you.

When you use our mobile application, we automatically collect certain technical information necessary for its proper functioning, security and improvement:
• Type and model of your device
• Operating system and version (iOS, Android)
Version of the installed application Anonymised
• technical identifiers linked to your device
• IP address
• Date, time and duration of your connections
• Pages, screens and features consulted
• Technical errors and crash reports

This information is collected through the tools described in Section 3, in particular Sentry for error tracking and PostHog for statistical analysis of application usage.

All Ride School does not collect any GPS geolocation data. No geolocation permission is requested by the application.

The location information present in your profile and in your sessions (city, country, spot) is exclusively declarative and provided by you.

The messages exchanged via the private messaging service integrated into the application are stored on our servers in encrypted form (in transit and at rest). They are not end-to-end encrypted, which means that All Ride School technically has the ability to access them in strictly limited cases:
in the event of a report by a user, for the purposes of analysing the report;
in the event of a legal obligation to disclose (judicial requisition, request from a competent authority).

Outside these cases, no member of the All Ride School team accesses the content of your messaging.

On our website allrideschool.com, we use the analytics tool Umami, designed with privacy in mind. This tool does not place any third-party cookies, does not track users across websites and does not use any advertising identifier. This is why our website does not require a cookie banner.

All Ride School makes available a conversational assistant powered by artificial intelligence, referred to in the application as the AI Coach. You are clearly informed that you are interacting with an AI and not a human being, in accordance with the transparency requirements of the European regulation on artificial intelligence (AI Act).

Your AI Coach guides you in logging your ride sessions via a chat interface. It asks you structured questions to generate a complete report of your session, which will then be recorded in your activity history.

In order to personalise the conversation, certain information about you may be transmitted to the AI model:
• Your first name and last name
• Your practice level and your progression history
• Your achievements and level certifications
• The content of the messages you write in the chat with your AI Coach

No banking data, no private messaging data exchanged with other users, and no sensitive information (within the meaning of Article 9 GDPR) is transmitted to your AI Coach.

The requests sent to your AI Coach pass through OpenRouter, a routing service located in the United States that allows us to dynamically select the AI model best suited to each use case from a variety of providers available on the market. The AI model actually used may therefore vary depending on the features and evolve over time, in line with our technical choices. The model providers concerned may be located in the European Union or outside, mainly in the United States.

The exchanges with your AI Coach are:
• OpenRouter, which serves as the technical intermediary for routing your requests to the AI models, does not have access to the content of your exchanges and does not retain them under the current configuration of our access key;
• the AI model providers actually used downstream of OpenRouter (notably Google Gemini, and where applicable other providers we may mobilise) may, depending on their own general terms, retain your exchanges or use them for their own purposes, including for the improvement of their models; we encourage you to consult their respective privacy policies for the details;
• are retained by All Ride School for a maximum of 4 months on the technical infrastructure side, for the limited purposes of debugging, moderation, fraud prevention, and verification of AI usage costs. Access to these exchanges is strictly reserved to the authorised technical team and to the Data Protection Officer (DPO), with systematic logging of each access. Beyond this period, the exchanges are deleted according to a monthly purge cycle.

In parallel, the session report generated from these exchanges is integrated into your activity history within the application and remains accessible there as long as your account is active.

In light of the foregoing, and in order to protect your privacy, we encourage you not to share with your AI Coach any sensitive personal information about you or about third parties, in particular: your physical or mental health data, your detailed financial information, your political, religious or philosophical opinions, your private or intimate life elements, or any other element that you would not wish to see processed by an artificial intelligence provider that may retain it or use it for its own purposes, nor consulted by our technical team under the conditions set out above.

Your AI Coach is designed to assist you in the practice of glide sports, the logging of your sessions and the tracking of your progression. It is neither a medical assistant, nor a financial advisor, nor a confidant. Transfers of data to countries located outside the European Union in this context are governed by standard contractual clauses adopted by the European Commission, in accordance with Article 46 GDPR (see Section 7).

We use your personal data only for the purposes described below. For each purpose, we identify the legal basis justifying the processing, in accordance with Article 6 GDPR.

We process your data to enable you to use the Services and benefit from them under normal conditions:
• create, manage and secure your account;
• enable you to access the mobile application and the website;
• record and keep your ride sessions in your activity history;
• manage the practice levels, achievements and level certifications associated with your profile;
• display your profile to other users in accordance with the visibility rules described in Section 3;
• for instructors: verify the validity of the certifications and diplomas you provide, and publish your profile after validation;
• for subscribed instructors: manage your subscription, its renewal, its termination and give you access to the associated paid features.

Legal basis: performance of the contract entered into between you and All Ride School (Terms of Use for all users; Terms of Sale for subscribed instructors), in accordance with Article 6(1)(b) GDPR.

We process your data to enable encounters and communication between riders and instructors on the platform:
• display the directory of instructors (in the application and on the web);
allow you to search for users by sport, level, city or country;
allow you to communicate via the integrated private messaging service;
allow you to post or view reviews of instructors.

Legal basis: performance of the contract (Article 6(1)(b) GDPR) for the essential connection functionalities, and legitimate interest of All Ride School in animating a coherent and useful platform for its users (Article 6(1)(f) GDPR) for the discovery and search functionalities.

We use your data to tailor the All Ride School experience to your profile and your preferences:
• adapt the questions and exchanges with your AI Coach based on your level and progression history;
• where applicable, and when the corresponding features are available, personalise the content, suggest spots, content or other users relevant to your profile.

Legal basis: legitimate interest of All Ride School in providing a useful and personalised experience (Article 6(1)(f) GDPR). You may, at any time, object to this personalisation by contacting us at privacy[a]allrideschool.com.

We process your data to preserve the security, integrity and quality of the All Ride School community:
• detect, prevent and address fraud, abuse, malicious behaviour or misuse of the Services;
process reports submitted by users and analyse the reported content (including, where applicable, the content of private conversations as described in Section 1.2);
• issue warnings, suspensions or account deletions in case of breach of our Terms of Use or our Community Charter;
• detect accounts created by minors under the age of 16 and proceed with
their deletion; ensure the technical security of the application and our infrastructure (protection against attacks, error monitoring, intrusion prevention).

Legal basis: legitimate interest of All Ride School and its users in having a safe and respectful platform (Article 6(1)(f) GDPR); legal obligation where moderation is required by an applicable text, notably the European Digital Services Act, or DSA (Article 6(1)(c) GDPR).

Priority handling of reports involving a minor: reports involving a user declared to be a minor (16 or 17 years old) are handled with absolute priority by our human team, in accordance with Article 6.7 of the Terms of Use. Where the reported content constitutes a serious risk to the safety or integrity of a minor, the data necessary to qualify the conduct and refer it to the competent authorities may be transmitted to those authorities, under the conditions of Section 3.3 of this Policy and in accordance with applicable legal obligations (notably Article 40 of the French Code of Criminal Procedure, 18 U.S.C. § 2258A in the United States).

We use technical and statistical data to measure, analyse and improve the operation of the application and the website:
• understand how users interact with the Services;
• detect bugs and technical anomalies (via Sentry);
• measure audience, usage and performance (via PostHog for the application and Umami for the website);
• develop new features and test improvements.

Where possible, these analyses are conducted on aggregated or pseudonymised data, which does not allow you to be directly identified.

Legal basis: legitimate interest of All Ride School in knowing and improving its Services (Article 6(1)(f) GDPR).

We use your email address for two types of communications:
• Service communications: login codes, registration confirmations, notifications relating to your account, your subscription, a report concerning you, an update to these conditions, or any information essential to the proper functioning of the Services. These communications are not optional: they form an integral part of the service we provide to you.
• Marketing communications: newsletters, announcements of new features, editorial content, promotional offers. These communications are sent to you only if you have expressly consented to them, and you may unsubscribe at any time via the link in each email or by writing to us at privacy[a]allrideschool.com.

Legal basis: performance of the contract for service communications (Article 6(1)(b) GDPR); consent for marketing communications (Article 6(1)(a) GDPR).

We process your data to the extent necessary to comply with the legal and regulatory obligations that apply to us:
• retention of certain accounting or contractual data (invoices, payment receipts, registers);
response to requests from competent judicial or administrative authorities (requisitions, injunctions);
• compliance with the GDPR, the DSA, App Store obligations, and any other regulation applicable to our activities.

Legal basis: legal obligation (Article 6(1)(c) GDPR).

All Ride School does not take any decision producing legal effects concerning you or significantly affecting you that is based solely on automated processing, within the meaning of Article 22 GDPR. The validation of instructor profiles, moderation decisions and any other decision likely to affect your access to the Services systematically involve human intervention.

All Ride School does not sell your personal data. We share it only in the cases and with the recipients described below.

Part of your information is, by nature, intended to be visible to other users of the Services. The default visibility rules are as follows.

Your profile is semi-visible: it can only be consulted by other users connected to the All Ride School application. It is not accessible on the open web and is not indexed by search engines.

The following are visible to other connected users on your profile page:
• your first name and last name, your profile picture;
• your city, your country, your sport(s) practised, your practice level;
• the achievements and level certifications associated with your profile;
• the number of sessions recorded on your profile.

When you post a review of an instructor, that review is displayed on the profile of the instructor concerned, identified by your first name and the first letter of your last name. The reduced format of the name allows for enhanced protection of your identity, insofar as these reviews may be publicly visible on the web through the directory of instructors.

The detailed content of your sessions (precise location, conditions, tricks, photos, feelings, feedback, notes) is private by default and is only visible to you.

Your profile is public:
• visible in the application to all other connected users;
• visible on the web via the directory of instructors published on allrideschool.com, accessible to everyone, including people who are not registered, and may be indexed by search engines.

The following are publicly visible:
• your first name and last name, your profile picture;
• your city, your country, your sport(s) practised, your spots and teaching locations;
• the certifications and diplomas you have declared and that we have validated (excluding the original files of your diplomas, which are never published);
• the optional information you have chosen to provide (biography, languages spoken, years of experience, number of students trained, average session rate, ride photos);
• the reviews left by your students, which you cannot modify or delete.

You can, at any time, hide or modify your own information in your account settings. Termination of

subscription on: the effective date of the termination of your Instructor subscription, on any ground whatsoever, your public instructor profile (web directory at allrideschool.com, professional sheet, search results within the application) immediately ceases to be displayed by All Ride School throughout its ecosystem. All Ride School also transmits to third-party search engines (notably Google, Bing) a non-indexing ("noindex") instruction for the profile page. The effective de-indexing by these engines and the purging of the caches held by third parties (search engines, web archives such as the Wayback Machine, aggregators) is, however, the responsibility of those third parties and may take a variable period of time that All Ride School does not control. Your account automatically switches to a Rider account and is, from then on, governed by the Rider visibility rules described above. The professional profile and reviews received as an instructor are kept in deactivated state for 3 months (see Section 6.3 and Article 2.5.1 of the Terms of Sale).

The messages exchanged via the private messaging service are only visible to the two participants in the conversation, subject to the limited access cases described in Section 1.2.

We rely on third-party service providers ("processors" within the meaning of Article 28 GDPR) to ensure the operation, security and improvement of the Services. Each of these processors has access only to the data strictly necessary for the performance of its services and is bound to us by a processing agreement imposing confidentiality and security obligations in accordance with the GDPR. Subprocessor Role Location Hetzner GmbH Hosting of infrastructure and database Germany (EU) Cloudflare Content delivery network, security, anti-DDoS protection Worldwide, global infrastructure Cloudflare R2 Storage of images, files and documents (including instructor diplomas) European Union (primary storage); worldwide CDN distribution for performance Brevo Sending of marketing communications and newsletters France (EU) Resend Sending of transactional communications (login codes, service notifications) United States Umami Audience measurement of the website (no third-party cookies, no advertising identifier) EU PostHog Statistical analysis of mobile application usage European Union (EU) Sentry Detection and tracking of technical errors of the application United States Expo (Expo Push) Distribution of the application via the stores and sending of push notifications United States OpenRouter Routing of requests to the AI models used by your AI Coach United States AI model providers Processing of requests addressed to your AI Coach EU or United States depending on the model used RevenueCat Technical orchestration of Instructor access (paid offers and the free Founding Coaches offer) United States Apple (App Store / Apple Pay) Distribution of the iOS application, processing of in-app payments, billing of subscriptions Ireland (EU) / United States Google (Google Play / Google Pay) Distribution of the Android application, processing of in-app payments, billing of subscriptions Ireland (EU) / United States Google Workspace Internal collaborative tools of the All Ride School team (support emails, internal exchanges mentioning users in the context of support or moderation) EU / United States

This list is subject to change. Any material modification (addition of a category of processor or substantial change of location) will be reflected in an update to this Policy.

When you download the All Ride School application, certain information about you is collected directly by Apple or Google in the context of their own relationship with you (App Store or Google Play account, payment method, etc.). These processing activities are governed by their own privacy policies and we have no access to them.

We may be required to transmit certain of your data to judicial, police or administrative authorities, in France or abroad, where this is necessary to comply with a legal requisition, a court decision or any other legal obligation that applies to us.

In the event of a merger, acquisition, total or partial transfer of assets, significant fundraising, restructuring or insolvency proceedings concerning All Ride School, your data could be transmitted to the third party concerned, provided that it undertakes to process it in accordance with this Policy. You would be informed thereof in advance by any appropriate means.

To remove any ambiguity, All Ride School explicitly undertakes never to:
• sell your personal data to a third party, for any purpose whatsoever;
• use your data for targeted advertising or advertising retargeting;
• share your data with data brokers or advertising networks;
• use your data to train artificial intelligence models.

The All Ride School application runs on iOS and Android systems. For certain features to work, the application may request permissions to access certain resources of your device. We explain below which permissions we request, for what use, and which permissions we never request.

These permissions can be granted or revoked by you at any time from your device’s settings.

Use:send you notifications relating to your account,

your interactionson the platform (e.g. new private message, response to a report, reminders of activity), and, if you have consented to marketing communications, occasional announcements

of newfeatures or content. Optional: the application works without push notifications. You can refuse this permission upon installation or revoke it later.

Use: allow you to take a photo to add to your profile, your sessions or, for instructors, to your professional fact sheet. Optional: requested only at the moment

: you initiate this action. If you refuse,

: you can still upload an image from your photo library (see below).

Use: allow you to select one or more photos already present on your device to add to your profile, your sessions or,

for instructors, to your professional fact sheet. Optional:

requestedonly at the moment you initiate this action. Audio recording (microphone)

: Use:

: allow you to use voice dictation when communicating

: with your AI Coach

via the chatinterface, if your device supports this feature.

The audio is processed by your device’s built-in speech-to-text feature (Apple Speech Recognition, Google Speech) and is not sent as audio to All Ride School. We only receive the resulting text. Optional: requested only at the moment you initiate this action. The chat works perfectly well without voice dictation. App Tracking Transparency (iOS only) Use: on iOS, Apple requires that any application requesting tracking across applications obtain the user’s prior express consent. All Ride School does not request the App Tracking Transparency permission, because we do not engage in any cross-app or cross-site tracking. Apple’s pop-up does not appear at the launch of our application.

Use: limited to the minimum necessary to maintain push notifications and synchronisation of new content when you open the application. Permission managed by your device’s operating system.

Use: All Ride School stores certain technical data locally on your device for the proper operation of the application: authentication session, user preferences, technical caches, error logs awaiting transmission to Sentry. These data are stored in the secure space reserved for the application by the operating system, and are deleted when the application is uninstalled.

Use: required for the use of the application, which is online-only. The application does not function offline (except in read-only mode for already cached content). Permission managed by your device’s operating system.

For your transparency, here is an explicit list of the permissions the All Ride School application does not request:
• Geolocation (GPS): we do not collect any GPS location data, as stated in Section 1.2.
• Contacts: we do not read your address book and do not offer to find your contacts on the platform.
• Health data (HealthKit, Google Fit): we do not connect to any health or fitness applications.
• Bluetooth: no connection to connected devices or external sensors.
• Calendar: we do not access your device’s calendar.
• SMS and telephony: we do not access your text messages or your device’s phone functions.
• Advertising identifier (IDFA on iOS, AAID on Android): we do not collect these identifiers. As a result, the application does not trigger Apple’s App Tracking Transparency prompt: we do not track your activity for advertising purposes across other applications or websites.

This list is subject to change as new features are added to the application. You will always be informed of any significant change in this area through an update to this Policy and, where applicable, by an explicit permission request when first using the new feature concerned.

The GDPR confers upon you a set of rights over your personal data. This section describes them and explains how to exercise them concretely.

You have the right to obtain confirmation that personal data concerning you is or is not being processed by All Ride School, and to obtain a copy of the data processed, as well as information on the purposes, categories, recipients, retention period, and your rights.

You have the right to obtain the rectification of personal data concerning you that is inaccurate, incomplete or outdated. For

most of this information, you can do this directly from your account settings.

You have the right to obtain the erasure of your personal data in the cases provided for in the GDPR. You can delete your account directly from the application (settings > delete my account) or by writing to us at privacy[a]allrideschool.com. The arrangements and deadlines for deletion are detailed in Section 6.

Special case — termination of an Instructor subscription: if your account is in the 3-month retention period following the effective date of the termination of an Instructor subscription (professional profile and reviews kept in deactivated state, see Section 6.3), the deletion of the account leads to the immediate and definitive deletion of these data and prevents any subsequent restoration in case of resubscription. You can also request only the deletion of the professional profile and reviews retained in deactivated state, without deleting the underlying Rider account. Write to privacy[a]allrideschool.com specifying your request.

You have the right to obtain the restriction of the processing of your data in certain situations, for example if you contest the accuracy of the data and we need a reasonable period to verify it.

You have the right to receive the personal data you have provided to us, in a structured, commonly used and machine-readable format, and to transmit it to another data controller. This right applies to data processed on the basis of your consent or the performance of a contract.

You may object, at any time, for reasons relating to your particular situation, to the processing of your data based on the legitimate interest of All Ride School (Sections 2.2, 2.3, 2.4 and 2.5).

You can object to receiving

marketing communications at any time via the unsubscribe link in each email, or by writing to us at privacy[a]allrideschool.com.

As indicated in Section 2.8, All Ride School does not make any decision producing legal effects concerning you or significantly affecting you that is based solely on automated processing.

You have the right to lodge a complaint with a supervisory authority, in particular the Commission Nationale de l’Informatique et des Libertés (CNIL) in France. The procedures for doing so are described in Section 5.4.

For most of your rights, you have two options:
• Directly from the application certain rights (rectification ofyour profile data, deletion of your account, unsubscribing from marketing communications) can be exercised directly from your account settings,
with immediate effect. By email: you may, at any time, send us a request to privacy@allrideschool.com.

For security reasons, and to prevent a third party from exercising your rights in your place, we may need to verify your identity before responding to your request. We will only ask for information strictly necessary for this verification.

We undertake to respond to your request within one month from its receipt. This period may be extended by two months if the complexity or number of requests justifies it. In that case, you will be informed of this extension and the reasons for the postponement within one month from the receipt of the request.

The exercise of your rights is free of charge. Exceptionally, in the event of a manifestly unfounded or excessive request, in particular due to its repetitive nature, we may either charge a reasonable fee covering administrative costs, or refuse to act on the request, justifying this refusal.

If you consider that the processing of your data by All Ride School does not comply with applicable law, you have the right to lodge a complaint with the supervisory authority of the State in which you reside, work or where you consider that the infringement has occurred.

In France, the competent authority is the Commission Nationale de l’Informatique et des Libertés (CNIL):
•
• Address: 3 Place de Fontenoy — TSA 80715 — 75334 PARIS CEDEX 07 Website: www.cnil.fr

If you reside in another Member State of the European Union, you may also lodge a complaint with the supervisory authority of your country of residence. The list of European authorities is available on the website of the European Data Protection Board (edpb.europa.eu). We nevertheless invite you,

before any referral to the CNIL, to contact us directly at privacy[a]allrideschool.com so that we may try to resolve your issue amicably.

In accordance with Article 85 of the French Data Protection Act, you have the right, if you reside in France, to define directives relating to the retention, deletion and communication of your personal data after your death. These directives may be general (recorded with a digital trust third party certified by the CNIL) or specific (formulated to a particular service, such as All Ride School). To make such directives known to us, write to us at privacy@allrideschool.com.

We retain your personal data for the period strictly necessary for the accomplishment of the purposes described in Section 2, in compliance with the legal obligations applicable to us.

Beyond this period, your data is either deleted, anonymised irreversibly (i.e. transformed in such a way that they can no longer be linked to you), or archived in a restricted access environment for specific purposes (notably the defence of rights in court or compliance with accounting obligations).

You can, at any time, request the deletion of your account directly from the All Ride School application (settings > delete my account) or by writing to us at privacy[a]allrideschool.com.

Processing time: we proceed with the effective deletion of your account within a maximum of 30 days from your request. During this period, your account is deactivated and your data is no longer accessible to other users.

What is deleted: your profile, your session data, the messages you have sent (on your interlocutors’side, the content of the messages remains visible until they delete their own account or make a specific request), your uploaded photos, your activity history, the files associated with your account (including, for instructors, the files of your diplomas once the post-subscription retention period has expired).

What may be retained after deletion: certain data may be kept for the limited periods indicated in the table above, for strictly defined purposes (accounting obligations, security, defence in court). The reviews you have posted about instructors are retained in anonymised form (“Anonymous Rider") to preserve the collective usefulness of reviews for other users.

Deletion at our initiative: we may be led to delete an account on our own initiative, notably in the following cases: serious or repeated breach of our Terms of Use, detection of a minor under 16, fraud, or prolonged inactivity of the account. These cases are described more precisely in our Terms of Use.

Termination of an Instructor subscriptionon the effective date of the termination of your Instructor subscription, your account does not disappear — it automatically switches to a Rider account. Your public instructor profile immediately ceases to be displayed in the application and in the web directory allrideschool.com, under the conditions specified in Section 3.1 (including as regards the limits of de-referencing by third-party search engines). Your professional profile and reviews received as an instructor are kept in deactivated state for 3 months and can be restored if you resubscribe within that period, in accordance with the arrangements specified in Article 2.5.1 of the Terms of Sale. After that period, this data is permanently deleted. You can, at any time, request immediate deletion (see Section 5).

For security, business continuity and protection against accidental loss reasons, we keep encrypted backups of our infrastructure for a maximum period of 30 days. These backups are only accessible for restoration purposes in the event of a technical incident. The data present in these backups is deleted by automatic rotation at the end of this period.

If you have requested the deletion of your account, your data may therefore subsist in these backups for a maximum period of 30 days after the effective deletion of your account on the production side, before complete disappearance.

All Ride School is a French company and favours, as far as possible, European providers for the processing of your data. However, some of our technical subprocessors are located outside the European Union, mainly in the United States. These transfers are transparently identified in the table in Section 3.2 and concern in particular:
• the sending of transactional communications (Resend);
• the detection of technical errors (Sentry);
• the distribution of the application and the sending of push notifications (Expo);
•
•
• the worldwide CDN distribution of images and files (Cloudflare R2: primary storage in the European Union, CDN caches distributed worldwide for performance);
the routing and processing of requests addressed to your AI Coach (OpenRouter and certain AI model providers); the orchestration of paid subscriptions (RevenueCat); the billing and distribution via the app stores (Apple, Google).

In accordance with Articles 44 to 49 GDPR, any transfer of personal data to a country located outside the European Economic Area may only take place if an adequate level of protection is guaranteed.

To legally frame our transfers outside the EU, we rely on one or other of the following mechanisms, depending on the subprocessor concerned:
Adequacy decision of the European Commission (Article 45 GDPR) where one exists for the country concerned. To date, the EU–US Adequacy Decision (Data Privacy Framework), adopted on 10 July 2023, allows the transfer of data to US organisations certified under this framework.
• Standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR), included in our processing agreements with the providers concerned. These clauses impose protection obligations equivalent to those of the GDPR.
Additional technical and organisational measures where the circumstances of the transfer require, in accordance with the recommendations of the European Data Protection Board (“EDPB”) arising from the Schrems II judgment of the Court of Justice of the European Union (July 2020).

We regularly assess the compliance of our subprocessors with these requirements. In the event of a regulatory or jurisprudential development calling into question a transfer mechanism, we undertake to put in place without delay an alternative mechanism or, where applicable, to change provider.

On simple request addressed to privacy[a]allrideschool.com, we can provide you with a copy or summary of the contractual guarantees applicable to the transfers of your data outside the EU.

We implement technical measures to protect your data against loss, alteration, unauthorised access and accidental or unlawful disclosure. These measures include in particular:
• Transport encryption: all communications between your device and our servers are protected by the TLS 1.2 or higher protocol.
• Encryption at restthe data stored on our infrastructure (Hetzner database, Cloudflare R2 files) is encrypted on disk according to industry standards.
• Authentication: access to your account is via a single-use code sent by email at each login. No password is stored on All Ride School’s side.
Compartmentalisation of access : access to data is strictly limited to the team members who need it for their tasks, on the principle of least privilege. Each access is logged.
• Infrastructure protection: our infrastructure is protected by Cloudflare against distributed denial of service (DDoS) attacks, automated intrusion attempts and known vulnerabilities.
• Continuous monitoring: any technical anomaly is automatically detected by Sentry, which alerts our team in real time.
• Backups: our infrastructure is the subject of regular encrypted backups (Section 6.4).
• Updates: our systems and dependencies are regularly updated to integrate the latest available security patches.

Beyond the technical measures, we put in place organisational arrangements aimed at ensuring a high level of data protection:
• confidentiality undertaking signed by any person accessing user data;
• regular review of the conformity of our subprocessors with the GDPR;
• traceability of accesses to sensitive data (private messages, reports, identification documents);
• documented internal procedure for handling data subjects’requests (Section 5);
• documented internal procedure for managing data breaches (Section 8.3).

In accordance with Articles 33 and 34 GDPR, in the event of a personal data breach likely to result in a risk to the rights and freedoms of the persons concerned, All Ride School undertakes to:
• notify the CNIL within 72 hours from the moment of awareness of the breach; inform without delay the data subjects, where
• the breach is likely to result in a high risk to their rights and freedoms, by any appropriate means (in-app notification, email, or public communication if the scale so requires).

The security of your data also depends on your vigilance. We recommend that you:
not share your
• login codes with third parties;
log out of the application on shared or public devices; report to us without delay any unauthorised access to your account or any suspicious behaviour, by writing to us at privacy[a]allrideschool.com;
• keep your mobile device and your operating system up to date, and use the locking mechanisms offered by your device (code, biometrics).

The All Ride School application and website are strictly reserved for persons aged 16 or over, without geographical exception.

This threshold of 16 years is deliberately more protective than that provided for by certain national regulations:
• it complies with the maximum threshold of Article 8 GDPR;
• it covers the 16-year threshold applicable in Germany and the Netherlands;
• it covers the 15-year threshold applicable in France under the Loi pour une République numérique;
• it largely covers the 13-year threshold provided for by the Children’s Online Privacy Protection Act (COPPA) in the United States;
• it covers the other thresholds below 16 years in force in the other Member States of the European Union and in the rest of the world.

Accordingly, and in line with our data minimisation approach, All Ride School does not collect, process or knowingly solicit personal data from users under 16 years of age.

When creating your account, you are asked to provide your date of birth. The system automatically calculates your age and blocks account creation if you have not reached 16 years of age.

In addition, you accept the Terms of Use, which expressly require you to confirm that you are at least 16 years old. Any false declaration relating to your age constitutes a breach of the Terms of Use and may result in the suspension or permanent deletion of your account (see Section 9.3).

This verification, based on the user’s declaration, does not constitute a formal identity verification, but it represents a reasonable due diligence measure within the meaning of the recommendations of the CNIL and the European Data Protection Board (Declaration 1/2025 on age verification). It is supplemented, where appropriate, by manual checks by our moderation team if doubts arise about a user’s actual age (for example, content suggesting a younger age, report from a parent or third party).

If we discover, by any means (report, internal check, content posted, contact from a parent or legal representative), that a user is in fact under 16 years of age despite the declaration made at registration, we proceed without delay
to: immediate suspension of the account concerned;
definitive deletion of the account and all associated data, in the best possible time and no later than 30 days from the discovery.

No subsequent re-registration is possible until the user has reached the required age.

In accordance with the Children’s Online Privacy Protection Act (COPPA), All Ride School does not address itself to children under 13 and does not knowingly collect any personal data concerning them. Our minimum age threshold of 16 years, applicable worldwide, covers this requirement.

If you are a parent or legal representative and you become aware that a child under 13 has provided us with personal data despite our age verification system, you can report it to us at privacy[a]allrideschool.com so that we may proceed with the definitive deletion of these data.

If you are the parent, guardian or legal representative of a minor whom you suspect of using our Services despite the applicable age threshold, you can report it to us at privacy[a]allrideschool.com. We will handle your report with due diligence and will proceed with the deletion of the account concerned upon verification.

We also invite you to raise awareness among the minors in your care of the risks associated with the use of online platforms, and to use the parental control features offered by the Apple iOS and Google Android systems (Screen Time, Family Link).

This section provides additional information to residents of the United States who have specific privacy rights, in application notably of the following laws:
• California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA);
• Virginia Consumer Data Protection Act (VCDPA);
• Colorado Privacy Act (CPA);
• Connecticut Data Privacy Act (CTDPA);
• Utah Consumer Privacy Act (UCPA);
and equivalent laws of other US States that may have come into force at the time of consultation of this Policy.

These provisions supplement, without substituting for them, the other provisions of this Policy.

During the last twelve months, we have collected the categories of personal data described in Section 1 of this Policy. The following table summarises these categories using the terminology of the CCPA/CPRA: Category Data concerned Source Identifiers First name, last name, email address, device identifiers, IP address You, your device Commercial information Details of your instructor subscription, history of use of the Services You, Apple/Google, RevenueCat Approximate geographic data City, country (declarative only) You Professional or employment-related information (instructors only) Certifications, diplomas, years of experience You Usage and activity data Session data, exchanges with the AI Coach, reviews of instructors, messages exchanged You Technical data Device model, operating system, application version, connection logs, technical errors Your device Visual data Profile pictures, session photos, ride photos You

We do not sell or share your personal data within the meaning of the CCPA/CPRA. We do not engage in cross-context behavioural advertising.

The retention period for each category corresponds to the periods set out in Section 6.2 of this Policy.

Depending on the state in which you reside, you may have all or part of the following rights:
• Right to Know: obtain confirmation that we are processing data about you, as well as a copy of the data collected over the past twelve months.
• Right to Delete: request the deletion of the data concerning you, subject to the exceptions provided for by law.
• Right to Correct: request the correction of inaccurate data concerning you.
• Right to Data Portability: receive the data you have provided to us in a portable format.
• Right to Opt Out of Sale or Sharing: although we do not sell or share your personal data, you can confirm this preference by writing to us at privacy[a]allrideschool.com or by using the “Do Not Sell or Share My Personal Information” link available in the application and on the website.
• Right to Limit Use of Sensitive Personal Information: we do not process your sensitive data for purposes other than providing the service.
• Right to Opt Out of Profiling for significant decisions: as indicated in Section 2.8, we do not make any automated decisions producing legal or significant effects concerning you.
• Right to Non-Discrimination: we will not penalize you for exercising any of your rights.
• Right to Appeal: if you are not satisfied with our response to your request, you can ask us to review our decision by writing to privacy[a]allrideschool.com with the subject “Privacy Rights Appeal”.

You can exercise these rights by writing to us at privacy[a]allrideschool.com.

For your protection, we may need to verify your identity before responding. We will only ask for information strictly necessary for this verification. If you exercise your rights through an authorised agent, we will require the

agent to provide proof of your authorisation, in accordance with applicable law.

We will respond to your request within the time periods provided for by law, generally 45 days, extendable by 45 additional days if necessary.

Pursuant to Section 1798.83 of the California Civil Code (Shine the Light Law), California residents may request, once per calendar year, the list of categories of personal data we have shared with third parties for direct marketing purposes during the previous year. As we do not engage in such sharing, this list is empty.

Notice of financial incentive: we do not offer any financial incentive in exchange for the collection, sale or deletion of your personal data.

In accordance with the CCPA and equivalent laws of other States, All Ride School does not sell or share the personal data of minors. Furthermore, our age threshold of 16 years applicable worldwide makes the protections specific to children under 13 (COPPA) and 16 (CCPA) automatically applicable. See also Section 9.4.

This Privacy Policy may evolve over time, in line with
•
•
• changes to our Services, regulatory
developments and the lessons of practice.

We undertake never to reduce the level of protection of your data without informing you in advance and giving you the opportunity to express yourself, in accordance with the procedures described below. We distinguish between two types of amendments:
• Material amendments: any modification that has a significant impact on the way we process your personal data (e.g. addition of a new processing purpose, change of legal basis, change of a category of subprocessor leading to a transfer outside the EU);
• Minor amendments: any other modification (clarifications, corrections of typographical errors, updates of references, etc.).

When we modify this Policy:
• the updated version is published on our website and within the application, with mention of the new update date at the top of the document;
• in case of a material amendment, — — we additionally inform you by email at least 30 days before its entry into force, and by an in-app notification.

The following are considered material, by way of non-exhaustive examples: the addition of a new processing purpose, the change of legal basis of an existing processing, the addition of a category of subprocessor leading to a transfer outside the EU, the introduction of a new form of profiling, the reduction of the period during which we keep certain categories of data.

If you do not agree with a material amendment to this Policy, you may:
• exercise your right to object to certain processing, in accordance with Section 5.1;
• delete your account, in accordance with Section 6.3.

Continued use of the Services after the entry into force of an amended version constitutes acceptance of that new version.

The date of the current version appears at the top of this Policy. On simple request addressed to privacy[a]allrideschool.com, we can provide you with the previous versions of the Policy as well as a summary of the material modifications that have occurred.

You can contact us by the following means:
By email: privacy[a]allrideschool.com
By post: All Ride School SAS, — 21 chemin du Prieuré, 17024 La Rochelle Cedex 1, France.

You can at any time report any content, message, profile, or behavior that you find problematic, in accordance with the methods described in our Community Charter:
• Within the application: through the “Report” function available on profiles, messages, and published content;
• By email: report[a]allrideschool.com.

Reports involving a minor or content of a particularly serious nature are handled as an absolute priority, in accordance with Section 2.4. Where necessary, we may also be required to transmit them to the competent authorities (Articles 33 and 34 of the GDPR, Article 40 of the French Code of Criminal Procedure, NCMEC in the United States), in accordance with our legal obligations.

All Ride School has appointed a Data Protection Officer (DPO) with the Commission Nationale de l'Informatique et des Libertés (CNIL), in accordance with Articles 37 to 39 GDPR, under designation number DPO-173916, with an effective date of 23 May 2026. The designated DPO is Mr Benoît de la Bourdonnaye, who can be reached at privacy[a]allrideschool.com as well as via the contact form available at https://allrideschool.com/privacy. Any data subject may contact him directly for any question relating to the processing of their personal data or to the exercise of their rights. The DPO's public contact details are also made available by the CNIL in accordance with Article 37(7) GDPR.

The competent supervisory authority for All Ride School in matters of personal data protection is the Commission Nationale de l’Informatique et des Libertés (CNIL):
•
• Address: 3 Place de Fontenoy — TSA 80715 — 75334 PARIS CEDEX 07 Telephone:
• 01 53 73 22 22 Website: www.cnil.fr

If you reside in another Member State of the European Union, you may also contact the supervisory authority of your country of residence.

The data controller, within the meaning of Article 4(7) GDPR, is:

All Ride School SAS
Simplified joint-stock company (SAS) with capital of 11,103
euros Registered with the Trade and Companies Register of La Rochelle under number 929 617 314
Intra-Community VAT number: FR07929617314
Registered office: 21 chemin du Prieuré, 17024 La Rochelle Cedex 1, France
Represented by its President, Mr Jean-Benoit Werth.