Data and purposes
We use your email, account language, saved bikes and price-alert subscriptions to provide the features you request. Sign-in and deletion codes are stored as hashes, not plain codes. Alert delivery records contain the recipient and message. These service operations rely on providing the requested service; optional analytics relies on your consent. Security processing requires a documented legal basis and is limited to protecting the service.
Optional analytics
Only after permission, first-party analytics records a random identifier for the current tab, product views, searches, selected results, shop clicks, language, device class and external referrer hostname. We do not attach account IDs to new analytics events and do not store IP addresses or full user agents in this analytics table. Searches can contain personal information; do not enter sensitive information. Google Analytics, when enabled, is also optional and may process online identifiers and visit information.
Anonymous shop-link counts
Without analytics permission, a shop-link click can increment a daily count for a public offer, product and shop. These counters have no visitor identifier, account link, IP address, browser details, search text or individual click timestamp. They cannot describe a visitor journey.
Retention
First-party analytics events are removed after 90 days. Expired sign-in and deletion codes are removed within 24 hours after expiry. Sent alert delivery records are removed after 30 days. Account information and active subscriptions remain until you delete them. Your privacy choice expires after 180 days; minimal consent evidence is removed 180 days after that expiry. Cleanup runs hourly, so these database deadlines may be exceeded by up to one cleanup interval. Anonymous daily counters are separate from personal account data.
Service providers and international transfers
Hosting and email delivery involve service providers, including Hetzner and Resend when used. Google receives visit information only if its analytics is enabled and permitted. Operator contracts, actual processing countries and the applicable GDPR and KVKK transfer safeguards must be documented before publication; consent to analytics is not itself a general authorisation for international transfers.
Your choices and rights
You can reject optional analytics and change or withdraw permission through Privacy settings. Requested account features remain available. Account settings provide a data download and email-confirmed deletion. Contact the operator for access, correction, erasure, restriction, applicable portability rights and objections, including requests without an account. GDPR requests normally receive a response within one month; KVKK requests within 30 days. Exceptions and permitted extensions must be explained. You may complain to the competent authority, including KVKK, Autoriteit Persoonsgegevens or the competent German supervisory authority.
Deletion and backups
Deleting an account removes its saved bikes, subscriptions, delivery history, login/deletion codes and linked historical analytics. Old sign-in tokens lose access. Shared public bike-model data and anonymous daily counters remain. Backup copies expire under the operator policy below. Erasure must be reapplied before a restored backup is made available. A message already accepted by an email provider cannot be recalled.