Privacy Policy — Aeropose

Last updated: 2025 · Effective date: 2025 · Applies to: EU/EEA residents (GDPR) and all users globally

Summary (plain language): We collect only the data needed to provide the Aeropose service. We do not sell your data to third parties. Video footage is retained only as long as needed to process and, where necessary, troubleshoot your analysis (up to 30 days), then automatically deleted. You have the right to access, correct, or delete your data at any time. We use cookies only for essential session management — we do not use advertising or tracking cookies without your consent.

1. Who We Are (Data Controller)

Aeropose is operated by the Aeropose development team. For data protection enquiries, contact: [email protected]

For the purposes of the UK GDPR and EU GDPR, Aeropose acts as the data controller for personal data collected through the Service.

2. What Data We Collect

Category	Data collected	Why	Legal basis (GDPR)
Account data	Name, email address, hashed password	Create and manage your account; authenticate you	Contract performance (Art. 6(1)(b))
Profile data	Age, height, weight, inside leg, shoe size, date of birth, flexibility rating, build, gender	Personalise fit analysis and recommendations	Contract performance (Art. 6(1)(b))
Bicycle data	Bike brand, model, discipline, crank length, year	Tailor analysis to your specific bicycle	Contract performance (Art. 6(1)(b))
Video footage	Video file of rider on bicycle, uploaded for analysis	Run pose estimation analysis; retained for up to 30 days to allow troubleshooting of analysis issues, then automatically deleted	Contract performance (Art. 6(1)(b))
Analysis results	Joint angle measurements, recommendations, aero score, annotated frame images, BB detection data	Provide results, generate reports, show history	Contract performance (Art. 6(1)(b))
Payment data	Payment intent ID, transaction reference (no card numbers — processed by Stripe)	Process payment for detailed reports	Contract performance (Art. 6(1)(b)); Legal obligation for records
Technical data	IP address, browser type, access logs (server logs only, not sold or profiled)	Security, abuse prevention, debugging	Legitimate interests (Art. 6(1)(f))

We do not collect: precise location data, racial or ethnic origin, health diagnoses, financial account details, or any data not listed above.

3. How We Use Your Data

To create and maintain your account
To analyse video footage and generate fit recommendations
To generate and deliver PDF reports (including emailing purchased detailed reports)
To process payments via Stripe
To maintain your analysis history
To respond to support requests
To send password reset emails when requested
To comply with legal obligations

We do not use your data for advertising, profiling, automated decision-making with significant legal effects, or any purpose not listed above.

4. Video Footage Handling

Video files uploaded for analysis are:

Stored securely on our servers/storage while your analysis is processed
Retained for up to 30 days so that analysis issues can be diagnosed and fixed, then automatically deleted — we do not retain video footage indefinitely
Processed solely by our analysis engine — not reviewed by humans unless troubleshooting a specific upload (e.g. an analysis error) or you explicitly contact us with a support issue
Never shared with third parties except as required by the hosting/storage infrastructure (see §6)

5. Cookies and Tracking

We use cookies and similar technologies only as follows:

Cookie	Purpose	Duration	Category
`bikefit-auth`	Stores your authentication token (JWT) in localStorage to keep you signed in	72 hours (or until sign-out)	Essential
`_ga`, `_ga_*`	Google Analytics (GA4) -- counts visits and usage patterns so we can understand and improve the Service. Only set if you accept analytics cookies in the cookie banner.	Up to 2 years	Analytics (optional, consent-based)

We do not use advertising cookies or third-party tracking cookies. Analytics cookies are only set after you accept them in the cookie banner shown on your first visit; declining means Google Analytics never loads. You can change your choice at any time by clearing your browser's local storage for this site and reloading, which shows the banner again.

The essential authentication token is required for the Service to function. You may clear it at any time by signing out or clearing your browser's local storage.

6. Who We Share Data With

Recipient	Data shared	Purpose	Location
Stripe, Inc.	Payment intent ID, purchase amount	Payment processing	USA (SCCs apply)
Google LLC (Google Analytics, GA4)	Pages visited, device/browser type, approximate location (country/city level); no video, analysis, or account data	Understanding site usage to improve the Service. Only active if you accept analytics cookies	USA (SCCs apply)
Hosting/storage provider (Railway / Render / AWS / Google Cloud / self-hosted)	All data stored in the application, including video footage where cloud storage is used	Infrastructure to run the Service and, where applicable, retain video footage for troubleshooting	EU, UK or USA (provider-dependent)
Email provider (SMTP server configured)	Email address, name (for report delivery and password reset)	Transactional email delivery	Depends on SMTP config

We do not sell, rent, or trade your personal data to any third party for their own purposes.

7. Data Retention

Video footage: retained for up to 30 days after analysis to allow troubleshooting of analysis issues, then automatically deleted
Analysis results and reports: retained while your account is active and for 30 days after account deletion
Account data: retained while your account is active; deleted within 30 days of account deletion request
Payment records: retained for 7 years to comply with financial record-keeping obligations
Server access logs: retained for 90 days for security purposes, then deleted

8. Your Rights (GDPR / UK GDPR)

You have the following rights regarding your personal data. To exercise any of these rights, email [email protected] or use the account management tools within the application.

Right of access Art. 15 — request a copy of all personal data we hold about you
Right to rectification Art. 16 — correct inaccurate data (use the Profile page)
Right to erasure Art. 17 — delete your account and all associated data (use Profile → Delete Account)
Right to data portability Art. 20 — receive your data in a machine-readable format
Right to object Art. 21 — object to processing based on legitimate interests
Right to restrict processing Art. 18 — request that we limit how we use your data
Right to withdraw consent — where processing is based on consent, you may withdraw at any time

We will respond to all rights requests within 30 days. You also have the right to lodge a complaint with a supervisory authority — in the UK, this is the Information Commissioner's Office (ICO): ico.org.uk.

9. Data Security

Passwords are hashed using bcrypt — never stored in plain text
Authentication uses short-lived JWT tokens (72-hour expiry)
Data in transit is encrypted using HTTPS/TLS
Video uploads use authenticated endpoints — unauthenticated users cannot upload
We follow security best practices including rate limiting on authentication endpoints

10. International Transfers

If your data is transferred outside the UK/EEA (for example, to Stripe's US servers), we ensure adequate safeguards are in place through Standard Contractual Clauses (SCCs) or other appropriate mechanisms as required by UK/EU GDPR.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "last updated" date. For material changes, we will notify registered users by email.