Privacy policy

1. Who is responsible for your data

[Company name AS] ([org. no. 000 000 000]), [Street address, postcode, city, Norway], is the data controller for the personal data described here.

Questions about privacy go to [privacy@cyclingpappa.no].

2. What we collect

We only collect what we need to run the service. Depending on what you use, this can include:

• Account details: your name, email address, phone number, password (stored encrypted) and language.
• Your bikes: type, brand, model, frame number, photos, and the service history and health log you or your mechanic add.
• Bookings and services: what you booked, with whom, when, where (and, for a service at your place, your country, city and postcode with that postcode's approximate position, but no street address), the price, and notes about the work done.
• Messages: chats with workshops and home mechanics, and posts and questions in the community.
• Payments: the amount, status and a reference from our payment provider. We do not store full card numbers.
• Location: an approximate location, only if you allow it, for example to fill in your city and postcode when you book. We look it up through our own server with OpenStreetMap's Nominatim service and don't store the position itself.
• Strava, if you connect it: activity distances and dates, used to estimate wear and suggest services. You can disconnect at any time.
• The AI assistant: the questions you ask and the answers, so it can help you and so we can improve it.
• Feedback: what you send us with the feedback button, with the page you were on, your browser and window size, so we can fix problems.
• Technical data: IP address, device and browser type, and logs, used to keep the service secure and working.

For workshops and home mechanics we also collect business details such as company name, organisation number, services offered, prices, opening hours and payout details. Home mechanics also give their area: country, city and postcode, and we store an approximate position (about 100 m) found from it, from a street address (used once, not stored) or from their device. Customers see the city and how far away it is, never the position or an address.

3. Why we use it, and our legal basis

• To provide the service you signed up for: your account, bookings, messages, payments and bike records (GDPR art. 6(1)(b), contract).
• To keep the service safe, prevent fraud and fix problems (art. 6(1)(f), our legitimate interest in a secure service).
• To improve the service and send you service reminders you can turn off (art. 6(1)(f), legitimate interest).
• Location, Strava and marketing emails: only with your consent, which you can withdraw at any time (art. 6(1)(a)).
• To keep accounting records as required by the Norwegian Bookkeeping Act (bokføringsloven) (art. 6(1)(c), legal obligation).

4. Who we share it with

We never sell your personal data. We share it only when needed:

• With the workshop or home mechanic you book or message, so they can do the job. They get your name, contact details, bike details and photos (of the bike you book with, for as long as you keep them) and the booking, including your area when the service is at your place.
• With service providers who work for us, such as hosting, file storage (Cloudflare R2, for bike photos), email, payments and the AI assistant. They may only use the data to provide their service to us, under a data processing agreement.
• With the OpenStreetMap Foundation's Nominatim service, to look up your city or position from a postcode, a street address (home mechanics, optional) or a rounded position. It only gets these from our server, never your name, account or IP address.
• With authorities when the law requires it.

5. Where your data is stored

We store data in the EU/EEA where we can. If a provider processes data outside the EEA, we make sure the transfer is lawful, for example through the EU Commission's standard contractual clauses or an adequacy decision.

6. How long we keep it

• Account data: for as long as you have an account. When you delete your account, we delete or anonymise your data within 30 days.
• Bike records: until you delete them or your account. If you sell a bike, you can choose to pass its history to the new owner. Bike photos are deleted at once when you delete them, the bike or your account. We remove the photo's hidden details (such as where and when it was taken) when you upload it.
• Bookings and payment records: 5 years, as the Bookkeeping Act requires.
• Messages: until you delete your account, unless they are needed to handle a complaint or dispute.
• Feedback: until we have handled it, and never longer than your account.
• Logs: up to 90 days.

7. Cookies and storage on your device

We do not use advertising or analytics cookies. The site only stores what it needs to work or what you choose:

• NEXT_LOCALE (cookie, 1 year): remembers your language.
• logto_… (cookie, up to 14 days, encrypted): keeps you signed in. Set only when you sign in, and removed when you sign out.
• mui-mode (local storage): remembers whether you chose light or dark mode.
• install-prompt-dismissed (local storage, 14 days): remembers that you closed the "Install the app" suggestion.
• Offline page (app cache): a copy of the offline page, so the app shows a message instead of an error when you have no connection.

These are needed to deliver the service you asked for, so under the Norwegian Electronic Communications Act (ekomloven) they do not require consent. If we add anything else, we will ask first and update this list.

8. Your rights

You have the right to:

• see the personal data we hold about you and get a copy,
• have incorrect data corrected,
• have your data deleted,
• restrict or object to how we use it,
• get your data in a machine-readable format to move it elsewhere,
• withdraw consent at any time, without affecting what we did before.

Contact [privacy@cyclingpappa.no] to use these rights. We answer within 30 days. If you think we handle your data unlawfully, you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

9. Children

You must be at least 13 to create an account. If you are under 18, a parent or guardian must approve bookings and payments.

10. Security

We protect your data with encryption in transit, encrypted passwords, access control and regular updates. No system is perfectly secure, so if we discover a breach that puts you at risk, we will tell you and Datatilsynet as the law requires.

11. Changes to this policy

If we change this policy, we update the date at the top. If the change is significant, we will tell you by email or in the app before it takes effect.