Privacy Policy

Your data stays tied to a clear purpose. Private auction drafts remain private, payment data is handled by Stripe, and a route is never published automatically. Optional analytics starts only after your consent.

Effective: 3 September 2026 · Version 2026-09-03

1. Controller and contact

The controller for the Brand My Bike platform is Ilhan Pektas, trading as GI MGMT, Waidmannstraße 1, 60596 Frankfurt am Main, Germany.

Privacy enquiries and rights requests: hello@brandmybike.com.

2. Scope and allocation of responsibility

This policy covers brandmybike.com, its German-language routes, accounts, the Auction-first create flow, Rider and Sponsor workspaces, public Listings, payments coordinated through the platform, Strava integration, FIT/GPX Ride Proofs, support and security administration.

We are controller for operation of the platform and the separate Listing fee. A Rider is an independent controller for personal data the Rider receives and uses for the direct advertising contract, invoicing and fulfilment. Stripe also processes certain information for its own legal, verification, fraud-prevention and financial-services purposes under its privacy notices.

3. Data we collect

• Account and profile: email address, name, public handle, role, age and business attestations, country, city or region, organisation, language, public biography, social handles and links.
• Authentication and security: session identifiers, sign-in events, IP address or protected IP-derived hashes, user agent, rate-limit data, security alerts, passkey/TOTP metadata for protected admin accounts and audit trails. We do not store the secret held by a passkey authenticator.
• Bike and marketplace: bike images, model, dealer and price evidence, serial and procurement data where required, Listing, geometry, Placement, Auction, bid, artwork, approval, installation, fulfilment, dispute and communication records.
• Payments and compliance: amount, currency, tax and receipt status, Stripe customer/account/payment references, refund and dispute status, payout readiness, business, identity, tax-residence and DAC7-related status. Full card numbers and card security codes are entered at Stripe and are not stored by us.
• Activity and proof: private FIT/GPX source files, source hashes, bike attestations, timestamps, distance, duration, elevation, anomaly indicators, private coordinate points, moderated public route points and publication consent.
• Usage and reporting: first-party profile views, product clicks and QR scans, shortened campaign/referrer information, timestamps and protected visitor identifiers; optional analytics data described in section 11.
• Support and moderation: enquiries, content reports, decisions, evidence, incident records and versioned legal acceptances.

We receive data from you, other marketplace participants, Stripe, optional connected services, your device and security or delivery providers. Please do not submit health information or other special categories of personal data unless we expressly request it for a lawful purpose.

4. Anonymous Auction Intents

The complete create flow can be used before registration. We store the submitted bike, ownership, exposure, Placement, pricing, duration and public-profile draft as a private Auction Intent for up to seven days. A high-entropy claim token is held only in a Secure, HttpOnly, SameSite=Lax cookie; the database stores only its cryptographic hash. Uploaded side photos remain in private quarantine storage. Browser users have no direct database access to these records. When you register, the Intent is claimed for your account; otherwise it and unclaimed quarantine media expire and are deleted through the cleanup process.

5. Accounts, sign-in and public profiles

Supabase provides email-code authentication and session management. Google sign-in is used only if you choose it. Registration itself does not make a profile public. Publication requires the relevant Listing, verification and moderation states. Public data can include the chosen name, handle, approximate city/region, biography, bike, approved Listing, Instagram and YouTube handles, optional Strava attribution and up to three named HTTPS links.

A business Sponsor may prepare and pay a bid deposit before creating an account. For this limited handoff we store the brand name, email, optional HTTPS website, optional X handle, uploaded logo, selected Placement, bid amount, legal-version references and Stripe identifiers in a private Sponsor Bid Intent. A Secure, HttpOnly, SameSite=Lax cookie holds the claim token; only its hash is stored in the database. The same email must be verified before the paid intent can be attached to a Sponsor account. An unreviewed brand or logo is not made public.

6. Auctions, Listings and marketplace reporting

We process Listing and bid data to save projects, validate ownership, run auctions, determine current leaders, prevent duplicate or abusive bids, review content, coordinate Sponsor and Rider performance and show accurate project status. Public pages contain only approved records and safe media URLs, not private addresses, exact private coordinates or storage paths.

First-party product, profile and QR events are used to provide campaign reporting and detect abuse. Reports are aggregate or project-specific; they are not a promise of a particular audience or sales outcome.

7. Stripe payments and Stripe Connect

Stripe processes the one-off Listing publication fee on Brand My Bike's platform account. We retain the related Listing, Checkout Session, PaymentIntent, amount, currency, tax treatment, receipt, refund, dispute and webhook references for performance, reconciliation and records.

Sponsor deposits and balances are Direct Charges on the Rider's connected Stripe merchant account. Brand My Bike receives a 10% application fee. Stripe handles payment credentials, connected-account identity and bank verification, fraud screening, refunds and payouts. Transaction data is shared between Stripe, the relevant Rider, financial institutions and Brand My Bike as needed to process and document the transaction. See the Stripe Privacy Policy.

8. Ride Proofs and the public world map

FIT/GPX source files, full coordinate sequences and exact start/end points remain private. Parsing takes place within our server environment; use of the Garmin FIT SDK does not send an uploaded file to Garmin. We store calculated distance, duration and elevation plus anomaly signals for verification and campaign reporting.

A route is never published by upload alone. If the Rider requests a public preview, at least the first and last kilometre are removed, coordinate precision is reduced and a separate confirmation is required. The public map shows only moderated, expressly released information—no raw file, home address or live location. Withdrawing publication consent stops future public display, while evidence may remain private where needed for a running contract or legal claim.

9. Optional Strava connection

A Rider may connect Strava through OAuth. We request read-only profile and non-private activity access, never write access or access to “Only You” activities. We store the Strava athlete ID, profile name/image, granted scopes, encrypted access and refresh tokens and cycling summaries such as activity title, date, timezone, distance, duration, elevation, speed, visibility, commute/trainer flags and device name.

Route streams are fetched only when the Rider deliberately turns one activity into a Ride Proof. Nothing is published automatically. Disconnecting asks Strava to revoke access where available and deletes the local connection, encrypted credentials and imported activity summaries. A separately created Ride Proof may remain as private contract evidence or an approved public proof until deleted or withdrawn under the rules above. See Strava's Privacy Policy.

10. Email and early access

Resend delivers sign-in, verification, auction, payment, moderation and security messages. We process recipient, template, delivery identifier, delivery state, bounce and complaint data to deliver requested messages and protect sender reputation. Confirmed marketing is sent only where a valid consent or another lawful basis exists and can be withdrawn.

The early-access list contains the normalised email, language, rider/ Sponsor/general intent, a sanitised source reference, confirmation and delivery status. It does not itself create an account or subscription. See Resend's Privacy Policy.

11. Cookies, local storage and analytics

Necessary Supabase session cookies, the Auction-Intent claim cookie and temporary OAuth/security cookies are used to authenticate users, preserve the requested flow and prevent attacks. Local storage records your consent choice and display-currency preference; a namespaced local draft can act as an offline fallback until server save or claim succeeds. These functions are necessary for the service requested or do not access a device for optional tracking.

Vercel Analytics and DataFast load only after “Allow analytics”. They may process page and interaction events, referrer, device/browser data, cookies or similar identifiers, IP address and IP-derived country/city for audience and acquisition analysis. Analytics is not loaded on admin pages. You can reject it initially or change the choice at any time via “Privacy settings” in the footer; withdrawal stops future optional collection. See Vercel's Privacy Notice and DataFast's Privacy Policy.

12. Purposes and legal bases

• Article 6(1)(b) GDPR for requested pre-contract steps and performance of accounts, Listings, auctions, payments, Placements, support and connected activity functions.
• Article 6(1)(c) GDPR for accounting, tax, platform-reporting, sanctions, payment, regulatory, content-notice and record obligations.
• Article 6(1)(f) GDPR for secure operation, fraud and abuse prevention, moderation, legal claims, service diagnostics and limited first-party campaign reporting. Our interests are reliable transactions, network security and a trustworthy B2B marketplace.
• Article 6(1)(a) GDPR and section 25(1) TDDDG for optional analytics, marketing and expressly public route/profile choices where consent is required. Consent can be withdrawn at any time for the future.

13. Recipients and service providers

Access is limited by role and purpose. Relevant recipients are the Rider or Sponsor involved in a transaction, authorised Brand My Bike administrators, advisers and authorities where legally required, and the following providers:

• Vercel — hosting, content delivery, security and consented analytics;
• Supabase — database, authentication and private file storage;
• Stripe — Checkout, Connect, tax display, verification and payments;
• Resend — transactional email delivery;
• DataFast — consented website analytics;
• Strava and Google — only when the user chooses the integration or sign-in.

Provider privacy information: Supabase, Google. Current subprocessors may change where an equivalent secure service is introduced; this policy will be updated for material changes.

14. International transfers

Although core project data is placed in configured service regions, providers or their subprocessors may process data in the United States, Singapore or other countries outside the EEA. Where no adequacy decision applies, transfers are based on the European Commission's Standard Contractual Clauses and supplementary technical and organisational measures, as applicable. Some providers also participate in an approved adequacy framework. Provider links above describe their current transfer arrangements.

15. Retention and deletion

• Unclaimed Auction Intents and quarantine media: up to seven days.
• Unclaimed Sponsor Bid Intents and their private logo uploads: up to seven days unless payment, refund, fraud-prevention or statutory record-keeping duties require longer restricted retention.
• Unconfirmed or unsubscribed early-access entries: up to 30 days.
• Account and project data: for the account and active contractual relationship, then deleted or restricted unless another period applies.
• Transaction, invoice, tax and accounting records: for the statutory period, which can be up to ten years under German law.
• Contract, moderation, dispute, fraud and security evidence: until the relevant matter and applicable limitation periods are resolved.
• Consent and legal-acceptance records: as proof for the applicable limitation period; withdrawal is recorded rather than overwritten.
• Strava connection data: until disconnection; Ride Proofs follow their campaign, evidence and consent periods.

Backups and provider logs disappear on their protected rotation cycles. A deletion request first enters a controlled workflow because open bids, payments, refunds, 365-day Placements, disputes or statutory retention may require restriction instead of immediate erasure. Data is erased or anonymised when those holds end.

16. Your rights

Subject to the legal conditions, you have rights of access (Article 15 GDPR), rectification (16), erasure (17), restriction (18), notification (19), portability (20) and objection (21), and the right not to be subject to qualifying solely automated decisions (22). You may withdraw consent at any time for future processing. We may need to verify your identity before fulfilling a request. The Account area also provides a structured data export and a deletion-request workflow.

You may complain to a supervisory authority, in particular the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Postfach 3163, 65021 Wiesbaden, Germany, email poststelle@datenschutz.hessen.de, or through the HBDI complaint service.

17. Required information and automated decisions

Required fields are identified in the relevant flow. Without account, business, Listing or payment information we may be unable to create an account, submit a Listing, process a bid or fulfil a Placement. Optional biography, social links, Strava, public routes, marketing and analytics are not required for an account.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects under Article 22 GDPR. Automated validation, risk signals, bid ordering and lifecycle rules assist the service; account restrictions, content disputes and final review decisions are available for human assessment.

18. Security and policy changes

We use access controls, row-level database policies, private storage, encryption in transit, encrypted OAuth credentials, signed webhooks, rate limits, audit logs and additional administrator authentication. No system is completely risk-free. Please report suspected compromise promptly to hello@brandmybike.com.

We update this policy when products, providers or law materially change. The current version and effective date appear above. Material changes are presented before a new acceptance or consent is required; transaction records retain the version that applied when they were created.