Privacy policy

Who is responsible for your data?

Smartup Soft S.L. (trading as BikeCRM), tax ID (CIF) B42781278. Registered office: Carrer de la Font del Be, 4, 3rd floor, door 3, 08970 Sant Joan Despí (Barcelona), Spain. Registered in the Barcelona Commercial Register [volume, folio and sheet]. Email: [email protected].

We own this website (bikecrm.com) and the BikeCRM app (bikecrm.app). We have no data protection officer: for any privacy question, write to the same address.

What data do we collect on this website, and why?

Demo account. To create one you give us your name, your business name, your email, your phone number (optional), a password, the language, VAT rate and currency you work with and, if you like, your logo. We use them to open the account and help you during the trial. The password is stored encrypted, so nobody can read it. Legal basis: the pre-contractual steps you ask for (art. 6.1.b GDPR).

Bot protection. The signup and newsletter forms use Cloudflare Turnstile, and the contact and careers forms use hCaptcha, to tell people from automated scripts. When you request a demo account we also check your IP address (for example, whether it comes from the Tor network) and keep it with the request to detect abuse. Legal basis: our legitimate interest in protecting the service (art. 6.1.f GDPR).

Contact and careers. Your name, phone number, email, message and, if you apply for a job, the CV you attach. We only use them to reply to you or assess your application. They reach us through Getform, the service that handles these forms. Legal basis: your request (art. 6.1.b GDPR).

Product news by email. If you subscribe, we keep your email, the language you choose, where you signed up and when you confirmed. We send nothing until you confirm from the email we send you, and every message has a one-click unsubscribe link. Legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time.

Visit statistics. We count visits with Plausible Analytics, a cookie-free tool: it stores nothing in your browser, creates no identifier that follows you, and only shows us totals (pages viewed, country, device type, referring site). Legal basis: our legitimate interest in knowing which pages are useful (art. 6.1.f GDPR).

Server logs. Like any website, our hosting records technical data about each request, such as the IP address and browser, to keep the site running and protect it from attacks. Legal basis: our legitimate interest in security (art. 6.1.f GDPR).

Trustpilot reviews. The website footer has a button to review BikeCRM on Trustpilot. It loads from Trustpilot’s servers, which receive your IP address. If you write a review, you do so on Trustpilot and under its terms. Legal basis: our legitimate interest in collecting customer reviews (art. 6.1.f GDPR).

And in the BikeCRM app?

There are two kinds of data here, and our role is different for each.

Your account data: we are the controller. Data about the workshop and the people who use it (name, email, phone, team users, tax and billing details, subscription payments) and the account activity log. We use it to provide the service, support you and send you service notices (art. 6.1.b GDPR); to issue and keep invoices, because the law requires it (art. 6.1.c GDPR); and to keep the service secure and prevent fraud (art. 6.1.f GDPR).

Your customers’ data: we are the processor. Your workshop’s customers, their bikes, service sheets, quotes, invoices and the messages you send them belong to your workshop, which is the controller. We process them only to provide the service and on your instructions, as a processor (art. 28 GDPR): we use them for nothing else, share them with no one, and when the service ends we return them to you and delete them. This is set out in the data processing agreement between your workshop and Smartup Soft S.L.; if you do not have it yet, ask us at [email protected].

If you are a customer of a workshop that uses BikeCRM and want to exercise your rights, contact the workshop. We will help them answer you.

Features you switch on. Some parts of the service send data outside BikeCRM only when you use them:

• WhatsApp and SMS notices: your customer’s phone number and the text of the notice go through WhatsApp (Meta) or Twilio to reach them.
• Online store: if you connect Shopify, WooCommerce or PrestaShop, BikeCRM syncs products, orders and, depending on the integration, the store’s customers.
• VeriFactu (Spain): if you switch it on, we send your invoice records to the Spanish Tax Agency, as the law requires (art. 6.1.c GDPR).
• AI suggestions: to suggest a bike type or fill in a product sheet, we send the bike or product name, brand, category and barcode to OpenRouter, which uses a Google Gemini model. We never send your customers’ data.
• Time tracking (Plus plan): your mechanics’ details are set up in FichaChat, another Smartup Soft S.L. product.

Do you use cookies?

Just one, a technical security cookie. We use no analytics, advertising or tracking cookies, which is why you see no cookie banner. Fonts are served from this website, not from Google.

That cookie is __cf_bm: Cloudflare, the network that delivers the website, sets it to tell people from bots and block attacks. It expires after 30 minutes and is not used to track you or for statistics. Because the website’s security depends on it, it does not need your consent. On the contact and careers pages, hCaptcha sets the same kind of cookie on its own domain (hcaptcha.com).

In addition, Cloudflare Turnstile, the bot check on the signup and newsletter forms, stores a technical value inside its own box to confirm you are a person. It is also essential to keep the form secure and cannot be used to track you.

In the BikeCRM app, your browser keeps only what the app needs to keep you signed in and remember your preferences, such as whether the menu is open. We use no advertising or tracking cookies.

How long do we keep it?

• Account and workshop data: for as long as you have the account. When you close it, we give you a copy if you ask and then delete it, except what the law requires us to keep.
• Invoices and billing data: six years, as Spanish commercial and tax law requires.
• Account activity log: two years.
• Demo account requests you never confirm: seven days.
• Contact messages and job applications: as long as needed to reply, and one year at most.
• Newsletter subscription: until you unsubscribe.
• Server technical logs: 90 days at most.

Who can see your data?

We do not sell your data or share it with anyone for advertising. Only the people on our team who need it to serve you can see it, plus these providers, which process it on our behalf under a data processing agreement:

• DigitalOcean (US): hosts this website and the app’s servers and database, in London and Frankfurt (Germany).
• Cloudflare (US): content delivery network (CDN) for the website and the Turnstile bot check.
• Amazon Web Services (US): sends the service emails and stores the files you upload, such as photos and logos.
• ImageKit (India): optimises and serves bike photos and logos.
• Google (US): hosts the web app (Firebase Hosting) and its fonts.
• Sentry (US): technical error reports.
• Stripe (Ireland and US): BikeCRM subscription payments.
• Meta (WhatsApp) and Twilio (US): WhatsApp and SMS notices.
• OpenRouter (US): AI suggestions, using product and bike data only.
• Resend (US, sending from Ireland): newsletter emails.
• Getform: receives the contact and careers forms; hCaptcha (US): their bot check.
• Plausible Analytics (Estonia, servers in the EU): cookie-free visit statistics.
• Trustpilot (Denmark): the review button.
• Hetzner (Germany) and netcup (Austria): our test servers, backups and technical logs.

Some of these providers are outside the European Economic Area. For them, the transfer relies on the European Commission’s standard contractual clauses or, where the company is certified, the EU-US Data Privacy Framework. The United Kingdom has an adequacy decision from the Commission.

We also disclose data to the Spanish Tax Agency and other authorities when the law requires it.

What are your rights?

You can ask us to access, correct or delete your data, restrict its use, take it to another service (portability) or object to our processing it. If you gave us your consent, you can withdraw it at any time. Write to [email protected] from your account’s email address or tell us who you are; we will reply within one month.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the data protection authority of the country where you live.

Can minors use BikeCRM?

BikeCRM is a service for workshops and shops, not for individuals. It is not meant for anyone under 14, and we do not knowingly collect their data.

What if we change this policy?

We will publish the new version here with its date. If the change is significant, we will email everyone who has an account.