Privacy policy
This English version is a translation provided for information; in the event of any discrepancy, the French version prevails.
This policy explains how Bike Shop Network collects and uses personal data, in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the amended French Data Protection Act of January 6, 1978. Data is never sold or rented, and is never used for targeted advertising.
Who is responsible?
Benoît Morin, sole trader (Bike Shop Network), 200 rue de la Croix Nivert, 75015 Paris, France, SIRET 833 409 154 00022, is the controller for the processing described here: accounts of subscribing shops and their teams, visitors of bikeshop-network.com, the bike shop directory and prospecting, and the shared do-not-send list kept for all shops. Contact: privacy@bikeshop-network.com.
For the data of each shop’s customers (customer records, bookings, repairs, loyalty, messages, conversations with the website assistant, consents), the shop is the controller; we process it on its behalf and on its instructions (see the data processing agreement and the “Shop customers” section below). This data is never used for our own prospecting.
What data, why, on what basis, for how long?
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Shop and team account: name, email, phone, role, shop details | Provide the service, secure access | Contract | Contract term, then 30 days to export the data; deletion on request at privacy@ |
| Record of acceptance of the terms and the data processing agreement: account, account email, shop, document, version, date (no IP address) | Prove the contract | Legitimate interest (evidence) | Contract term, then 5 years after the shop is deleted |
| Billing: plan, amounts, dates (never card details: Paddle handles them) | Invoicing, accounting | Contract, legal obligation | Amounts and dates: 10 years; raw content of Paddle notifications: 13 months |
| Support conversations | Answer, improve the service | Contract, legitimate interest | Contract term; deletion on request |
| “Book a call”: name, shop, city, phone, email, form answers | Arrange the call, follow up in our sales tracking file (CRM) | Pre-contractual steps, legitimate interest | 3 years after the last contact |
| Form security: requests received (against duplicates), anti-abuse counters (hashed IP address, never in clear), browser security reports | Block bots and abuse | Legitimate interest | Requests: 30 days; counters: 8 days; reports: hosting provider logs, no IP address stored by us |
| Bike shop directory: name, address, phone, website and social accounts, published emails (sometimes personal), rating and number of reviews | Know the shops, prepare prospecting | Legitimate interest | As long as the shop exists; listing removed on request |
| Prospecting and CRM: a manager’s name, role, email and mobile, notes, next step, “Do not contact” flag | Introduce Bike Shop Network to shops (email, text, call), honor objections | Legitimate interest | 3 years after the last contact (automatic deletion); “Do not contact”: kept so the objection is honored |
| Prospecting demos: personal link, date and number of opens, type of device, daily fingerprint (IP address and browser, mixed with a secret value) | Know whether the shop saw the demo made for it | Legitimate interest | Demo: 30 days at most, or until removed; fingerprint: 7 days; CRM note: 3 years after the last contact |
| Log of emails sent: date, app, shop, status, error code (no address or content) | Track quotas and sending errors | Legitimate interest | 13 months |
| Shared do-not-send list: email address or number, reason (STOP, hard bounce, spam report), provider, date | Stop sending anything, on behalf of any shop on the platform (they send through the same providers), to an address or number that refused or doesn’t exist | Legitimate interest, honoring objections | STOPs and spam reports: as long as the refusal stands; lifted refusals (START) and bounces: deleted after 5 years |
| Audience measurement | Visit statistics | Legitimate interest, cookieless | 30 days (raw events), then aggregated figures |
Audience measurement works without cookies: a visitor’s identifier is a fingerprint of their IP address and browser, mixed with a value that changes every day. We count a day’s visitors without being able to follow them the next day, or from one site to another.
The chat on our home page answers with replies prepared in advance, inside your browser: it isn’t AI, and today nothing you type there is sent to us. A conversation recorded for our team to follow up would be deleted after 90 days.
Directory and prospecting
- Source: the directory brings together public information about bike shops: Google Maps listings (collected through Google’s API, then with the Apify extraction tool), shop websites, public company registers, forms on our website and what shop managers tell us. The public directory search only shows a shop’s name, city and postcode.
- Why: to introduce Bike Shop Network to shops, by email, text message or phone, about topics related to their trade; to prepare demos; to honor objections. We prefer the shop’s generic addresses (contact@, info@); a personal address or mobile number is only used for a conversation already under way or when the person gave it to us.
- Legal basis: our legitimate interest in making a business service known to businesses.
- Demos: we sometimes prepare a demo of the website a shop could have. It can only be reached through its personal link, on demo.bikeshop-network.com, isn’t indexed by search engines and carries a “Demo prepared for … by Bike Shop Network” banner with a “Remove this demo” link. It counts how often it is opened (date, type of device) so we know whether it was seen, as the banner says: with no cookie and without storing the IP address, only a daily fingerprint deleted after 7 days so the same visit isn’t counted twice. If the demo shows the shop’s Google reviews, they are read from Google each time it opens and never stored; the visitor’s IP address then goes to Google to display the reviewers’ photos.
- Retention: 3 years after the last contact, then automatic deletion; a demo lasts 30 days at most.
- Objection: at any time, without giving a reason. Click “Remove this demo”, reply “STOP” to a text or an email, or write to privacy@bikeshop-network.com. The shop is then added to our “Do not contact” list, its demos are deleted, and we keep only what we need to stop contacting it. You can also ask where your details came from, have them corrected or erased, and complain to the CNIL.
Shop customers (on behalf of the shops)
The shop is responsible for this data; we only process it to provide the service to the shop.
- Records, bookings, repairs, loyalty: until the shop deletes them; a customer with no purchase, workshop visit, booking, message, points or gift card for 3 years is anonymized, copies included (period set by the shop, at least 1 year).
- The shop team’s time records: 3 years.
- Consent to offers (email, text): given separately for each channel, boxes unchecked by default. Each consent or withdrawal is written to a register that can’t be changed or deleted: channel, consent or withdrawal, date, origin, method (aloud in the shop, signed form, the shop’s screen, in writing, confirmation link), text shown, language, the staff member who recorded it, and the address or number concerned. The register is kept for 5 years after consent is withdrawn or the customer record is deleted, to prove consent and make sure refusals are honored.
- Signing up on a shop’s website (double opt-in): an email or a text is sent, in the shop’s name, to the address or number entered; the sign-up only counts once the link in it is clicked. The link’s token is only kept as a fingerprint (hash) and is valid for 7 days; the request, confirmed or not, is deleted after 30 days. Without confirmation, no offers are sent.
- Shared do-not-send list: a STOP, a hard bounce or a spam report received from Resend, Brevo or Twilio applies to every shop on the platform (see the table above): no shop writes to that address or number again, and consent to offers is withdrawn at every shop that wrote to it in the last 13 months. A START lifts a STOP.
- Frequency and timing of offers: for shops in the European Union, the United Kingdom and Switzerland, 2 offers a month at most, per customer and per channel. Marketing texts are only sent at permitted times, based on the number’s country and the shop’s local time (France: Monday to Saturday, 8 a.m.–8 p.m., never on Sundays or public holidays; United States: Monday to Saturday, 9 a.m.–8 p.m.; Canada: weekdays 9 a.m.–9:30 p.m., weekends 10 a.m.–6 p.m.; elsewhere: Monday to Saturday, 8 a.m.–8 p.m.), with the shop’s name first and the STOP wording. Every marketing email has a one-click unsubscribe link.
- United States and Canada: in the United States, a marketing text needs written consent (oral consent isn’t enough) and is sent from the shop’s carrier-registered number (10DLC); the sign-up message says “Msg frequency varies. Msg & data rates may apply. Reply STOP to cancel, HELP for help.” In Canada, it is sent from the shop’s verified number and includes a link to the shop’s website, where its contact details are.
- Messages sent (emails, texts): content and address deleted after 13 months. This log is also used to cap sending per number and per shop, against fraud; going over a cap alerts our team.
- Website AI assistant: visitors’ messages are sent to Anthropic to write the reply. Anthropic deletes them within 30 days (up to 2 years for exchanges flagged by its safety checks) and doesn’t use them to train its models. Bike Shop Network keeps conversations for 13 months, with no IP address.
- Texts suggested by AI agents in the back office: sent to Anthropic on the same terms; the text the shop keeps stays in its account.
Who receives the data?
Only our processors, limited to what their job requires, all bound by a data processing agreement:
| Recipient | Role | Country | Agreement |
|---|---|---|---|
| Supabase | Database, sign-in | European Union (Europe region); company in Singapore | supabase.com/legal/dpa |
| Vercel | Hosting of the websites and apps | United States, global network | vercel.com/legal/dpa |
| Cloudflare | DNS, network, bot protection for forms (Turnstile) | United States, global network | cloudflare.com/cloudflare-customer-dpa |
| Paddle | Payments and invoicing (merchant of record, controller of its own processing) | United Kingdom | paddle.com/legal/data-processing-addendum |
| Resend | Sending emails | United States | resend.com/legal/dpa |
| Brevo or Twilio | Sending text messages, depending on the provider in use | France (Brevo); United States (Twilio) | Brevo, Twilio |
| Anthropic | Website AI assistant, AI agents, suggested texts | United States | Commercial terms |
| Google Maps ranking (Places API), reviews read live in demos, directory source | United States | cloud.google.com/terms/data-processing-addendum | |
| Apify | Collecting the directory’s public listings | Czech Republic | Apify’s terms |
| Porkbun | Domain names bought for shops (domain holder) | United States | Porkbun’s terms |
| logo.dev | Shop logos, found from their domain name | United States | logo.dev’s terms |
Fonts are served from our own servers, with no third-party service. A French shop’s legal details are checked against the public company register (the French government’s company search API). Data may also be disclosed to authorities that request it under the law.
Transfers outside the European Union
Some recipients are based outside the European Union. Transfers to the United States are covered by the EU–U.S. Data Privacy Framework when the provider is certified, otherwise by the European Commission’s standard contractual clauses; the United Kingdom benefits from an adequacy decision.
Security
Encrypted connections (HTTPS), isolation between shops (each shop only sees its own data), access based on each person’s role, passwords and PIN codes never stored in plain text, backups, read-only support access, restricted to authorized members of our team. In the event of a data breach, we notify the CNIL and the people concerned when the law requires it. No automated decision with legal effects is made about you.
Your rights
You can ask to access, correct, erase or port your data, restrict its processing, object to it (without giving a reason for prospecting) or withdraw your consent: write to privacy@bikeshop-network.com. We may ask you to prove your identity; we answer within one month. You can also lodge a complaint with the CNIL (cnil.fr), the French data protection authority, or with the authority in your country.
A shop’s customer? Contact the shop first, as it is responsible for your data; we help it answer you.
California residents (CCPA)
We do not sell or share personal information as defined by the California Consumer Privacy Act (CCPA, as amended by the CPRA), and we do not use it for targeted advertising. You can ask to know what personal information we hold about you, and to have it corrected or deleted, by writing to privacy@bikeshop-network.com. Exercising these rights does not change the service you receive. On shop websites, the Global Privacy Control signal is honored: it counts as a refusal of advertising trackers.
Cookies
See the cookies and trackers page.
Changes
This policy may change; any significant change is announced to subscribing shops by email. Version of October 26, 2026.