The controller for the processing of your personal data is Geraads IT (BikeFit/LAB), KvK 42131533, BTW NL004072842B19. Contact for all privacy matters: [email protected].
Your video never reaches us. The pose analysis runs entirely inside your own browser. We do not receive, store or even transmit the footage. Only the resulting numerical measurements (joint angles, cadence, etc.) and two annotated still frames are sent to our server — and only when you actively generate a paid report.
What: email address, hashed password, account timestamps. Why: to provide your account (performance of contract, art. 6(1)(b) GDPR). Retention: until you delete your account or ask us to; residual copies in encrypted backups are purged within 30 days.
What: your inseam-scaled joint measurements, fit score, the generated report text and PDF, and the two annotated key frames embedded in it. Why: to deliver the report you purchased and your report history (contract). Retention: until account deletion, or earlier on request per report.
What: bundle, amount, payment status and a Mollie payment reference. Card/bank details are handled solely by Mollie B.V. and never reach us. Why: processing your purchase (contract) and bookkeeping (legal obligation). Retention: payment/administration records are kept 7 years, as required by Dutch tax law (art. 52 AWR).
What: transactional emails (confirmation, password reset, your report) and standard server logs (IP, timestamp, request). Why: operating and securing the Service (contract; legitimate interest, art. 6(1)(f)). Retention: logs max. 30 days; email delivery metadata per our email provider's standard window.
We use carefully selected processors under GDPR data-processing agreements: Supabase (database, authentication, file storage), Stripe (payments), Resend (email delivery). Where a processor stores data outside the EEA, transfers rely on EU Standard Contractual Clauses. We never sell personal data and never use it for third-party advertising.
We only use strictly necessary cookies: the secure session cookies that keep you logged in, plus a small cookie remembering your language and that you dismissed the cookie notice. No tracking, analytics or advertising cookies are set. Because these cookies are strictly necessary/functional, no prior consent is legally required; we show a short informational notice for transparency. If we ever add analytics, we will update this policy and ask consent where required.
You can at any time request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interest. Changing your email or password works directly from your dashboard; for anything else email [email protected] — we respond within 30 days. You can also lodge a complaint with the Dutch DPA, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Data is encrypted in transit (TLS) and at rest, passwords are stored hashed, report files live in a private bucket accessible only via authenticated server requests, and database row-level security ensures users can only ever read their own data.
The Service is not directed at children under 16. We do not knowingly process their data; contact us if you believe we have.
We may update this policy; material changes will be announced on the site or by email, with the date above always reflecting the current version.