Privacy Policy

Who We Are

Bike Service Book™ ("we," "our," or "us") is operated by ThrillTech Mechanical Risk Intelligence (Pty) Ltd, a company registered in South Africa. We are the Responsible Party for the personal information described in this policy, as that term is used in the Protection of Personal Information Act 4 of 2013 ("POPIA").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our bike maintenance tracking service. By using Bike Service Book, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Password (encrypted and stored securely — we never see it in readable form)
• Your name
• Your cellphone number (optional) — see below
• Profile photo, if you choose to upload one
• Account preferences and notification settings

Your Cellphone Number

Providing a cellphone number is optional. Your account works normally without one, and you can add, change or remove it at any time from your profile settings.

Where you do provide it, we use it only to:

• let a bike shop you are linked to contact you about your bike or a service in progress
• include it in a booking request you send to a shop, so they can confirm the appointment
• reach you about your own account where email is not suitable — for example a failed payment or a security issue

Your number is visible to bike shops you are actively linked to, and is subject to the same restrictions as the rest of your information — a shop may not export it, add it to a contact list, or send you marketing on it. We do not sell your number, share it with advertisers, or send you marketing SMS or WhatsApp messages unless you have separately agreed to receive them, as required by section 69 of POPIA.

Where a shop activates your account for you in-store, the number they capture is the one you gave them at the counter. If it is wrong, you can correct it yourself in your profile settings.

Bike, Component and Accessory Data

To provide our service, we collect and store:

• Bike information (brand, model, year, type, purchase date, condition)
• Frame serial numbers and photographs of serial numbers, where you record them for proof of ownership
• Component details (type, brand, model, installation date) and service intervals
• Service history and maintenance records, including work logged by a bike shop
• Accessories such as GPS devices, power meters and watches, including serial numbers, purchase prices and invoice photographs where you record them
• Usage hours, distance and service status
• Photos of your bikes and components, if you choose to upload them
• Rider weight, only where you choose to record it for suspension setup
• Your preferred bike shop, where you select one or link to a store

Rider Profiles and Household Accounts

Where you use household or child rider features, we store the rider's name and the link between that rider profile and the guardian or household account that manages it. See Children and Family Accounts below.

Strava Integration (Optional)

If you choose to connect your Strava account:

• We receive your Strava athlete ID, athlete name, username and profile photo
• We store an access token so we can sync on your behalf. It is held securely and stops working the moment you disconnect
• We access and store, for each ride, the activity name, activity type, start date, moving and elapsed time, and distance
• We automatically apply ride hours and distance to your components
• We do not access or store your GPS routes, heart rate, power, cadence or any other detailed activity metrics

Payment Information

Subscription and fee payments are processed by Paystack. We never see, receive or store your card number, CVV or banking details — those go directly to Paystack. We store the billing name and email address you provide, and the customer and subscription references Paystack returns to us, so that we can manage your subscription and issue invoices.

Usage Information

We automatically collect:

• Log data (IP address, browser type, pages visited)
• Device information
• Usage patterns and feature interactions

How We Use Your Information

We use your information to:

• Provide the Service: Track your bike maintenance, calculate service intervals, and send reminders
• Sync with Strava: Automatically update ride hours based on your Strava activities
• Send Notifications: Alert you when components are due for service (if you enable notifications)
• Process Payments: Manage your subscription, issue invoices, and collect any service record fees that apply to your account
• Connect You With Bike Shops: Forward service booking requests to the shop you select, and let a shop you are linked to record work on your bike
• Improve the Service: Analyze usage patterns to enhance features and user experience
• Customer Support: Respond to your questions and troubleshoot issues
• Security: Detect and prevent fraud, abuse, and security incidents

Bike Shops, Retailers and Mechanics

Bike Service Book works with a network of registered bike shops and workshops. This section explains exactly what they can and cannot see.

When a shop can see your information

A shop can only see your record if you are actively linked to that shop — either because you linked to them yourself, or because they activated your account in-store with your consent. No shop can browse, search for or see the records of anyone who is not linked to them.

What a linked shop can see

• Your name, email address and contact number
• Your bikes, their components, and their current service status
• Your service history, including entries logged by other shops
• Any booking requests you send them

A shop cannot see your password, your card or banking details, your subscription payment history, or the records of any other rider.

What a shop may do with it

Registered shops are bound by our Retailer Terms of Service, which permit them to use your information only to quote for, perform and record work on your bike, and to respond to your booking requests. They are expressly prohibited from exporting your details into their own systems, selling or sharing them, adding you to a marketing list, or contacting you for marketing purposes without your separate consent. They must keep your information confidential and report any security incident to us within 24 hours.

Mechanics

A shop may add its mechanics as portal users so they can log job cards. Each mechanic has their own named login, and the shop is responsible for their conduct and for removing access when they leave.

Unlinking

You can unlink from any shop at any time from your Settings page. Their access to your record ends immediately, and they may not keep using information they obtained through the platform. Service entries a shop has already logged remain part of your bike's history — that is the point of a service book — but the shop's ongoing access ends.

Children and Family Accounts

Bike Service Book accounts may only be opened by adults aged 18 or over. We do not permit children to register for their own accounts.

A parent or legal guardian may create child rider profiles under their own account so that a child's bike has a proper service history. Where they do:

• The guardian consents to the processing of that child's information as the competent person contemplated in section 35 of POPIA
• We collect only what is needed for the rider profile — the child's first name and surname, and the link to the guardian's account. A child rider profile has no contact details of its own
• The guardian manages the profile from their dashboard and can view, correct or delete it at any time
• We do not use children's information for marketing, profiling or advertising, and we never make it public
• Where an older child connects their own Strava account, we prompt for guardian confirmation first

If you believe a child's information has been added to Bike Service Book without the consent of their parent or guardian, contact us and we will remove it.

How We Share Your Information

We do not sell your personal information. We only share your data in the following circumstances:

• Bike Shops You Are Linked To: As described above, and only for shops you are linked to
• Service Providers: We use Supabase for database and authentication services, and Vercel for hosting. These providers have access to your data only to perform services on our behalf
• Paystack: Payment processing for subscriptions and fees. Your card details go directly to Paystack and never pass through our systems
• Resend: Delivery of transactional email such as service reminders, invoices and account notices
• Strava: When you connect your Strava account, we communicate with Strava's API to sync your ride data. See Strava's privacy policy at strava.com/legal/privacy
• Legal Requirements: We may disclose your information if required by law or in response to valid legal requests
• Business Transfers: If we are involved in a merger, acquisition, or sale of assets, your information may be transferred

Sharing Your Own Service History

Some features let you share your bike's record with someone else. These are always your choice, and nothing is shared until you act:

• PDF service reports: When you download and send a report to a buyer or insurer, it contains your bike details, serial number, ownership details and full service history. Once you send it, we have no control over what the recipient does with it
• Selling a bike: If you transfer a bike to a new owner, the service history travels with the bike. Your personal contact details do not transfer
• Booking a service: Submitting a booking request sends your name, contact details and the relevant bike details to the shop you chose

Marketing and Communications

We send two kinds of email. Service messages — service reminders, invoices, password resets and account notices — are part of the service and cannot be switched off while your account is open, although you can turn off service reminder notifications in your settings.

Marketing messages about new features, offers or cycling content are sent only where you have agreed to receive them, in line with section 69 of POPIA. Every marketing email includes an unsubscribe link, and unsubscribing has no effect on your account or your service reminders.

Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit (HTTPS/TLS)
• Encrypted storage of passwords
• Secure authentication via Supabase
• Row-level database rules so that each account — and each linked shop — can reach only the records it is entitled to
• Regular security updates and monitoring

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

How Long We Keep Your Information

We keep your information for as long as your account is open. If you close your account, we retain your data for 30 days before permanent deletion, so that an accidental closure can be reversed — or we delete it immediately if you ask us to.

We keep records of payments and invoices for as long as South African tax and company law requires, even after an account is closed. Where a bike has been transferred to a new owner, the service history stays attached to the bike rather than to you.

Your Rights and Choices

Under POPIA you have the right to know what personal information we hold about you, to have it corrected or deleted, to object to how we use it, and to complain if you are unhappy with how it has been handled.

Access and Update

You can access and update your account information, bikes, and components at any time through your dashboard.

Linked Shops

You can see which shops you are linked to, and unlink from any of them, on your Settings page.

Strava Disconnection

You can disconnect your Strava account at any time from the Settings page. This will stop future syncing but will not delete previously synced ride hours.

Notifications

You can enable or disable service reminder notifications in your settings, and unsubscribe from marketing email using the link in any marketing message.

Data Deletion

You can delete individual bikes, components, or service records at any time. To delete your entire account and all associated data, contact us at support@bikeservicebook.com.

Data Export

Premium subscribers can download a full PDF service report at any time. You can also request a copy of the data we hold about you by contacting us at support@bikeservicebook.com.

Complaints

If you are not satisfied with how we have handled your personal information, please contact our Information Officer first so that we can put it right. You also have the right to lodge a complaint directly with the Information Regulator of South Africa at POPIAComplaints@inforegulator.org.za, or via inforegulator.org.za.

Cookies and Tracking

We use essential cookies to:

• Keep you logged in
• Remember your preferences
• Ensure security

We do not use third-party advertising or tracking cookies.

International Data Transfers

Our hosting and database providers, Vercel and Supabase, operate infrastructure outside South Africa, so your information may be processed on servers in other countries. Where this happens we rely on section 72 of POPIA and require those providers to give your information a level of protection substantially similar to that required under South African law.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Significant changes will be communicated via email.

Contact Us

If you have any questions about this Privacy Policy or our data practices, or you want to exercise any of your rights, please contact us at:

Third-Party Services

Our service uses the following third-party services:

• Supabase: Database and authentication (Privacy Policy)
• Vercel: Hosting and deployment (Privacy Policy)
• Paystack: Payment processing (Privacy Policy)
• Resend: Transactional email delivery (Privacy Policy)
• Strava: Activity syncing (optional) (Privacy Policy)