Privacy policy · launch draft
Not yet a final legal notice. The controller’s registered entity, address, jurisdiction, processor agreements and retention schedule must be completed and approved before live registration is enabled.
1. Controller and contact
The future controller is the legal operator named in the Imprint. Until those mandatory details are supplied, production accounts and payments remain technically locked. Privacy enquiries: hello@brandmybike.com.
2. Data we plan to process
Account and contact data; rider, organisation role and membership; age, account type and business attestations; identity, company, tax residence, DAC7 and payout-verification data; exact bike, dealer price, campaign, auction, deposit, balance, refund, procurement, invoice, serial number, print and placement records; sponsor products; Stripe references but never full card details; private FIT/GPX files and derived Ride Proofs; click/QR events; support, moderation, anomaly, dispute and audit records; and versioned legal consents.
3. Purposes and legal bases
Data is used to create and secure accounts, operate auctions and sponsorship agreements, prevent fraud, settle payments, moderate content, answer support requests and meet accounting, tax, platform and law-enforcement duties. Depending on the final operator and user relationship, the bases will be performance of contract, steps requested before contract, legal obligation, legitimate interests in platform security and abuse prevention, and consent for optional analytics, marketing, activity connections and public map display.
4. Public profiles, map and Ride Proof routes
Registration does not publish a profile. The 3D world map only includes verified riders who opt in and shows rounded city-level locations, moderated auctions and expressly released protected routes—never a home address, raw file or live position. FIT/GPX sources stay private. Before publication, at least the first and last kilometre are removed, coordinates are reduced and the rider receives a separate preview/confirmation step. Withdrawal stops future public display subject to contract and record-retention duties.
5. Payments and verification
Stripe processes the 20% bid deposit, winner balance, sponsor service fee, refunds, connected-account checks and permitted transfers under its notices. Brand My Bike stores identifiers, eligibility flags, amount components and event status needed for reconciliation, invoices, retries, disputes and audit. The model uses separate charges/transfers and is not an escrow service.
6. Providers and international transfers
The intended core providers are Vercel for hosting, Supabase for database/authentication/private storage, Stripe for payments and verification, an approved transactional-email provider and an approved print partner. Garmin’s server-side FIT SDK and a hardened XML parser process files within Brand My Bike; Garmin does not receive uploaded files through that library. Strava is not used for public or sponsor reporting and remains disabled unless written commercial permission is obtained. The operator must execute current agreements, document subprocessors/transfers and select suitable EU regions before activation.
7. Storage periods
Production retention is a launch decision, not a hidden default. The proposed schedule is: rejected uploads 30 days; operational security logs 90 days unless an incident requires longer; inactive unverified accounts 24 months; consent evidence for the relevant limitation period; and transaction, tax and accounting records for the legally required period in the operator’s jurisdiction. Deletion requests are honored where no overriding retention duty applies.
8. Analytics and browser storage
Necessary session and security storage works without optional consent. Vercel Analytics loads only after an explicit “Allow analytics” choice and can be disabled again through Privacy settings in the footer. Demo drafts may still use namespaced localStorage while the site is in preview mode.
9. Your rights
Subject to applicable law, users may request access, correction, deletion, restriction, portability or objection, withdraw consent without affecting earlier processing, and complain to the competent supervisory authority. The final policy will identify that authority after the operator’s establishment is confirmed.
10. Automated decisions
No solely automated decision with legal or similarly significant effects is planned. Marketplace filters and recommendations must disclose their main ranking parameters; suspension, verification and payment disputes require human review.