Privacy Policy

Last updated: 28 October 2026  |  Effective: 28 October 2026

This Privacy Policy explains how Stunning Bike Co-Tours ("we", "us", "our") processes personal data when you use the Stunning Bike Co-Tours mobile application (the "App") and related services. Separate booking, rental, waiver and service documents may provide additional information for a specific service.

1. Data We Collect

Depending on the services and features you use, we may process the following categories of personal data:

• Account and contact data: name, email address, telephone number, account ID, login method, password verifier and sign-in history.
• Booking, rental and agreement data: booking references and dates, tour or rental details, assigned bicycle or fleet ID, waiver answers and signature, participant names, and identity-document type, number and issuing country, date of birth or address when provided for a booking or rental agreement.
• Purchase and payment data: in-app purchase or transaction identifiers, payment status, refunds and receipts. Payment providers handle card details; we do not receive or store the full card number or security code.
• App activity: tours linked to your account, points of interest viewed or visited, access or redemption codes, points balance, preferences, favourites, feedback and app-generated diagnostic or usage events.
• Phone location: precise location when you grant permission and use features such as Near Me, maps, navigation, tours, Quick Ride or support.
• Ride Together (group location): if you create or join a ride group and choose to share, your phone location is sent every few seconds to the other members of that group only, until the end time you accept or until you stop. It is never shown to the shop and is not used for any other purpose. Group members can see your first name, your position and your sharing status.
• Bicycle photos and damage records: staff may photograph a rental bicycle at check-out and return to document its condition. Photos show the bicycle, not you, and are linked to the booking and bicycle number. Staff may record damage found, with a cost. If the shop enables optional AI suggestions, the two photos of a bicycle side may be sent to the AI provider selected by the shop for a suggestion that staff always confirm; no decision is made automatically.
• Sponsored offers (Near Me): when a nearby sponsored offer is shown, we count views, taps and arrivals in aggregate for the partner, using a hashed device identifier and no name or account data.
• Smart Audio: if you turn it on, the app uses your phone's speed and position on your device only, to pause narration; this setting is stored on your phone.
• Bicycle tracker data: GPS location, tracker identifier and timestamps from a NotiOne GPS tracker installed on a bicycle; and the current or last available location of an Apple AirTag attached to a bicycle, viewed by authorised staff through Apple Find My.
• Email open tracking (optional): only if you tick the optional box in the App or switch it on in your account, the service emails we send you (for example waiver and rental agreement emails) include a small invisible image (a tracking pixel) that tells us whether and when you opened the email. Without your consent we do not use it: we only record that an email was sent and whether delivery failed.
• Consent records: when you confirm this notice or make the optional email-tracking choice, we record the notice version, the date and time and the IP address the choice was made from. We keep this as proof that the notice was shown and of your choice. The IP address is stored encrypted and is visible only to authorised staff.
• Tour progress: the stops you have visited and when you started or last continued a tour are saved on your account, so you can resume a tour and find your progress again on a new phone.
• Device and technical data: device type, operating system, app version, push-notification token and security logs.
• Support information: messages, photographs and location information that you choose to share when contacting support.
• AI voice assistant calls: when you phone us, an automated AI voice assistant may answer. In that case we may process your telephone number, the audio of the call, a transcript and a summary, and the booking details you give during the call.
• Biometric authentication: Face ID or Touch ID is handled by your device's operating system. We do not receive your biometric template; the App receives only the authentication result.

We receive information directly from you, from booking or reseller platforms when you make a reservation, and from your device and operating system when you use the App. Some information is necessary to create an account, fulfil a booking or rental, provide a requested service, meet legal obligations or protect the service. If you do not provide it, the related account, booking, agreement, payment, support service or feature may not be available.

GPS trackers and AirTags on rental bicycles

Some bicycles may be equipped with a NotiOne GPS tracker and an Apple AirTag. These devices locate the bicycle, not your phone, and operate independently of the location permission granted to the App. When a bicycle is assigned to a booking, tracker data may be associated with that booking and the renter. While the bicycle is in the renter's custody, this may reveal the approximate location of the bicycle and renter. We use these devices to protect bicycle safety and company property, prevent and manage theft, locate or recover a missing bicycle, and provide assistance in an emergency. We do not use tracker data to build a customer movement profile. Apple and Android devices may display their standard alerts when an unknown tracker is travelling with a person.

AirTag location is viewed by authorised staff through Apple Find My. It is not collected by the SBCT App or stored in its backend. Apple processes Find My account and service data under its own privacy terms. Apple states that Find My network location data for offline devices and reporting devices is end-to-end encrypted and not visible to Apple. See Apple's Find My privacy notice.

Phone-location permission, photographs, optional profile details and push notifications are optional. You can deny or withdraw the relevant App or device permissions, although location-based App features or notifications may then be unavailable. Your phone-location permission does not control the separate NotiOne tracker or AirTag fitted to a rental bicycle.

2. How We Use Your Data

• Create and manage customer accounts, authenticate users and provide requested App features.
• Manage bookings, tours, rentals, check-in, waiver agreements, access codes, customer support, payments and refunds.
• Provide nearby-place information, maps, directions, GPS-triggered content and ride or tour features.
• Use bicycle-mounted NotiOne trackers and AirTags for bicycle safety, theft prevention and management, recovery of missing bicycles, protection of company property and emergency assistance.
• Send service, security, booking, support and tour notifications.
• With your optional consent, see whether you opened a service email, so that staff can tell whether you received a request such as signing a rental agreement.
• Protect accounts and systems, prevent abuse and fraud, troubleshoot issues and improve service reliability.
• Meet accounting, tax, consumer, insurance and other legal obligations and respond to lawful requests.
• Send optional marketing or review communications only where a valid legal basis and any required consent or objection mechanisms apply.

3. Legal Basis for Processing (GDPR)

• Contract or pre-contract steps (Article 6(1)(b)): account creation, requested App services, bookings, rentals, tours, check-in and waiver, support, and related payment processing.
• Legitimate interests (Article 6(1)(f)): proof of the notice and consent records (including the IP address), account and system security, fraud prevention, service reliability, and use of bicycle trackers to protect people and property, prevent theft, recover bicycles and provide emergency assistance. We balance these interests against your rights and freedoms.
• Consent (Article 6(1)(a)): where consent is the applicable legal basis, including optional processing where required. Phone-location access and push notifications are also subject to the permissions and controls provided by your device. You may withdraw consent at any time without affecting prior lawful processing.
• Consent for email open tracking (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code): the tracking pixel in service emails is used only after you opt in. The box is optional and not required to use the App or receive emails. You can withdraw consent at any time in your account (Preferences → Email Open Tracking); from then on no new opens are recorded.
• Consent for analytics (Article 6(1)(a)): Firebase Analytics runs only after you opt in, and you can withdraw consent at any time in Settings.
• Legal obligation (Article 6(1)(c)): tax, accounting and other legally required records and responses to lawful requests.

The App privacy acknowledgement records that this notice was shown to you. It is not blanket consent to marketing or optional processing.

4. Sub-Processors and Other Recipients

Access to personal data is limited to authorised personnel who need it for their work. Depending on the feature used, we may share relevant data with:

• Emergent: App hosting, backend and database infrastructure, and managed email delivery. The managed email relay may use Resend as its delivery provider. See Emergent's DPA.
• Apple Inc.: app distribution, Sign in with Apple, APNs push delivery, App Store in-app purchases and Find My services used by authorised staff to locate company AirTags attached to bicycles. Apple's own privacy terms apply to its Find My account and service processing.
• Google LLC: Google sign-in, map and location services when used, and Firebase Cloud Messaging (FCM) push delivery on supported Android devices.
• Mapbox Inc.: offline tour maps. When you tap Download on a tour, the App downloads the map tiles for that tour area directly from Mapbox servers so the map works without a connection. Mapbox receives technical data such as your IP address, device and app information and the map area requested. Online maps continue to use Apple Maps (iOS) or Google Maps (Android). We have disabled Mapbox usage telemetry in the App. See the Mapbox Privacy Policy.
• Google Firebase Analytics: optional, anonymous app usage statistics (screens viewed, feature use, device type, app version), used only if you opt in. We do not use advertising identifiers and do not use this data for advertising. You can turn it on or off at any time in Settings.
• FareHarbor and booking resellers: reservation management and transmission of booking details needed to provide the service.
• Cloudflare Inc.: delivery and storage of App media and files, including Cloudflare R2.
• Stripe: payment processing in flows that use Stripe. Stripe handles card details; the App or backend may receive payment references, status and limited transaction details, but not the full card number or security code.
• Notinote sp. z o.o. (NotiOne/NOTIONE): GPS tracker platform for bicycles; processes tracker identifiers and geolocation to provide the tracking service. Its role may vary depending on the processing activity. See the NotiOne Privacy Policy.
• Retell AI: provider of the AI voice assistant that may answer or handle our telephone calls (speech recognition, call handling, recordings and transcripts, where enabled). The assistant always tells you at the start of the call that it is an AI, and you can ask to speak to a person. Retell AI acts as our processor under a data processing agreement and may process data outside the EEA (see section 5).
• 3CX: customer contact and support channels where used.

A provider may act as our processor or as an independent controller depending on the service and the applicable agreement. The provider's own privacy terms may also apply. We do not sell personal data. We may disclose information to public authorities where required by law, or to professional advisers or insurers when necessary to handle a claim or protect a legal right.

5. Data Transfers

Some providers may process data outside the European Economic Area (EEA), including in the United States. Where a transfer is not covered by an adequacy decision, we rely on an applicable GDPR transfer mechanism, such as Standard Contractual Clauses, and supplementary measures where required. You may contact us for information about the safeguards applicable to a specific provider or transfer.

6. Data Retention

We keep personal data only for as long as necessary for the relevant purpose and applicable legal requirements. Current operational retention periods are:

• Account data: until account deletion, then up to 30 days for removal from active systems, subject to backups and legal holds.
• Tour activity: up to 3 years.
• Support communications: up to 2 years.
• App GPS tracks, where stored by a feature: up to 1 year.
• Ride Together locations: deleted automatically when the group ends or sharing stops, and in any case shortly after the end time.
• Bicycle photos: deleted automatically after the number of days set by the shop (default 30), unless an open damage dispute requires keeping them; damage records follow booking and claim periods.
• Sponsored offer statistics: aggregated and anonymous.
• Login history: up to 90 days.
• Consent records (notice version, date and IP address): for as long as the account exists; deleted or anonymised together with the account.
• Email open records (if you opt in): kept with the communication log of the related booking, for the booking and claim periods below.
• Analytics data (if you opt in): up to 14 months.
• Accounting and purchase records: up to 10 years where required by law.

Bicycle tracker location may be processed while a tracker is active for fleet security, including when a bicycle is not rented. The association between a tracker and a renter is relevant while the bicycle is assigned to that rental and may be retained with booking or incident records for applicable claim and statutory periods. NotiOne retains its service data under its published criteria and the settings of the account used by SBCT; see its Privacy Policy. AirTag location is viewed through Find My and is not stored in the SBCT App or backend; its availability and handling within Find My are governed by Apple's service and account settings.

Booking, rental, waiver, identity-document and signature records are retained for applicable contractual, insurance, limitation and statutory periods. Access is restricted, and records are deleted or anonymised when those periods end. Security and audit logs are retained for the period needed to investigate incidents and meet security obligations. A legal claim or mandatory retention duty may require longer retention of relevant records.

7. Your Rights Under GDPR

• Access: request access to and a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion, subject to legal retention duties and other applicable exceptions.
• Restriction: request that certain processing be limited.
• Portability: receive eligible data in a structured, commonly used, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing relies on consent, withdraw it at any time without affecting prior lawful processing.

Contact privacy@stunningbikecotours.com to exercise your rights. We may need to verify your identity. We normally respond within one month. For complex or numerous requests, the response period may be extended by up to two further months; we will explain any extension.

You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it, or with your local supervisory authority.

8. Children's Privacy

In Ride Together, a minor may take part only under the responsibility of an adult who is a member of the group and who is the group's organiser; the adult is responsible for deciding whether the minor shares location.

The App is not intended for children to create or manage accounts independently. Where a service permits a minor to participate, a parent or legal guardian must manage the booking and provide any required information or signature. We may process the minor's data for that booking and service. If you believe a child's personal data has been provided improperly, contact us at privacy@stunningbikecotours.com; we will review the request and delete data where it is no longer required for the service or by law.

9. Security

We use appropriate technical and organisational measures to protect personal data, including access controls, encrypted communications and protected credential storage. No transmission or storage system can be guaranteed completely secure.

Emails and tracking. Our emails contain no tracking pixel unless you have given the optional consent described above. If you withdraw it, emails sent afterwards contain no pixel and any opens of earlier emails are no longer recorded. We do not use tracking pixels for advertising or profiling, and we do not share open data with third parties other than our email delivery providers.

10. Automated Decision-Making

We do not make decisions producing legal or similarly significant effects about you solely by automated processing.

Use of artificial intelligence. We use AI tools in a limited way: an AI voice assistant for telephone calls (see section 4), and AI tools to help us manage internal processes, our website and the development of the App. These tools support our staff and do not decide on bookings, refunds, access to services or any other matter that significantly affects you without human review. If you speak with the AI voice assistant, you are told that it is an AI and you can ask to be transferred to a person. Where AI tools process personal data, we use business-grade services with appropriate data protection terms and do not allow providers to use your data to train their models where our agreement allows us to opt out. You can contact privacy@stunningbikecotours.com to ask for human review or to exercise your rights regarding these calls, including deletion of a call recording or transcript.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When a material change requires renewed notice, we will notify you through the App or another appropriate channel and show the updated version. Continued use of the App is not, by itself, consent to processing that requires consent.

12. Contact

Stunning Bike Co-Tours di Malinverni Andrea
Via Alessandro Manzoni, 12 — 22100 Como (CO), Italy
Email: info@stunningbikecotours.com
Privacy: privacy@stunningbikecotours.com
Phone: +39 031 5140010
Website: www.stunningbikecotours.com