Privacy notice

1. Who we are

The data controller is OnTrack Cycling, a mobile bike repair service in Newcastle upon Tyne and surrounding areas.

• Email: hello@ontrack-cycling.co.uk
• Phone / WhatsApp: 07565823998
• Website: https://www.ontrack-cycling.co.uk

If you have a question about your data, email us. We will respond as soon as we reasonably can, and within one month where the law requires it.

2. What we collect

Depending on how you use the site, we may hold:

• Booking details: name, email, phone, location or postcode, bike type, make and model, job description, preferred date and time, and services you chose.
• Account details: the same contact fields, saved bikes and typical specs, and a password hash (we never store your password in plain text).
• Payments: if you pay online, Stripe handles your card. We receive confirmation that you paid, an amount, and a Stripe session id — not your full card number.
• Technical data: IP address used for spam and abuse protection, a short-lived slot-hold id in your browser, and cookieless page-view counts from our host (Vercel).
• Messages: emails we send or receive about your job, and WhatsApp if you contact us that way.

The public bike spec library does not include customer notes, colour, or other personal remarks.

3. Why we use it (lawful bases)

• Contract: to take a booking, visit you, do the repair, take payment, and send a confirmation.
• Legitimate interests: to stop spam and bots, keep the diary from double-booking, keep the site secure, and see anonymous-style visit counts so we know the site works.
• Legal obligation: payment and tax records that the law says we (or Stripe) must keep.

We do not run marketing email lists from this site, and we do not sell your details.

4. Who we share it with

We only share what is needed to run the service. Current processors and tools:

• Vercel — hosts the website and cookieless web analytics.
• Upstash (Redis) — stores bookings, accounts, and diary slots.
• Stripe — card payments.
• Formspree — forwards booking requests to our inbox.
• Resend — sends your booking confirmation email.
• Cloudflare Turnstile — bot check on forms.
• Google Calendar — if a job is synced to our work calendar so we can turn up on time.
• WhatsApp / Meta — only if you message us, or tap the WhatsApp button yourself.

We do not use advertising cookies or sell lists to third parties.

5. How long we keep it

• Live holds on a time slot: 15 minutes, then they expire.
• Magic sign-in links: 15 minutes.
• Account: until you delete it, or we delete it at your request.
• Booking diary: kept so we can do the job and deal with aftercare. We keep a rolling workshop log rather than an infinite archive. On a deletion request we remove your name, email, phone, address and notes from those records.
• Payments: Stripe (and any invoices we keep) may hold records for up to six years where tax and accounting rules require it, even after we delete your account.

6. Cookies

We only use cookies that are needed to run the site:

• ontrack_cust — signs you into your account (httpOnly, about 30 days).
• Stripe may set cookies on Stripe’s own pages when you pay online.
• Cloudflare Turnstile is a security check on forms.

We do not use marketing or advertising cookies. Vercel Web Analytics counts visits without setting a tracking cookie. You can use the site without an account; booking still needs your contact details so we can find you.

7. Your rights

Under UK GDPR you can ask us to:

• see a copy of the personal data we hold about you
• correct it if it is wrong
• delete it (erasure), subject to records we must keep by law
• limit or object to certain uses
• receive account details you gave us in a portable form

Signed-in customers can already see and edit their details and bookings on the account page, and can delete their account there. Anyone can email hello@ontrack-cycling.co.uk instead.

You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would rather fix it first if you tell us.

8. Security

The site uses HTTPS, security headers, bot checks on forms, and signed, httpOnly login cookies. Passwords are stored as a one-way hash (scrypt), not as the password itself. No method is perfect. Do not send card numbers by email or WhatsApp — use the Stripe checkout or pay when we arrive.

9. Where data is processed

Some of our providers (including Vercel, Stripe, Upstash, Formspree, Resend and Cloudflare) may process data in the UK, the EEA, the United States or other countries. Where that happens they are responsible for using appropriate safeguards such as the UK/EU standard contractual clauses or an adequacy decision.

10. Children

The site is for arranging bike repairs. It is not aimed at children under 13. Please do not create an account for a child.

11. Changes to this notice

If we change how we use data in a meaningful way, we will update this page and the date at the top.