Privacy Policy

1. Who We Are

BikePartPicker.net is operated by Halley Hares Ltd, a company registered in England & Wales (company no. 13942048), whose registered office is at 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom. Halley Hares Ltd is the data controller for the personal information described in this policy.

You can reach us about anything in this policy at privacy@bikepartpicker.net.

We process personal information in accordance with the UK GDPR and the Data Protection Act 2018. We do not sell your personal data, and we do not use it for third-party advertising profiles.

2. Information We Collect

Most of BikePartPicker.net works without an account. What we hold depends on how you use the site:

3. How We Use Your Information, And Our Legal Basis

Under the UK GDPR we must have a lawful basis for each use of your personal information:

• To provide the service: creating and authenticating your account, saving your builds and likes, sending service emails such as email verification and password resets. Legal basis: performance of a contract with you.
• To answer your messages: replying to contact form submissions and support emails. Legal basis: legitimate interests (running a support function).
• To keep the site secure and working: bot and spam protection on the contact and signup forms, rate limiting, error and uptime monitoring. Legal basis: legitimate interests (security and service integrity).
• To improve the catalogue and the site: aggregate analytics, and recording searches that returned no results. Legal basis: your consent for analytics cookies; legitimate interests for the anonymous, server-side zero-result log.
• To earn affiliate commission: passing your click through an affiliate network so a purchase can be attributed to us. This is how the site is funded. Legal basis: legitimate interests (funding a free service).
• To meet legal obligations: accounting and tax records, and responding to lawful requests. Legal basis: compliance with a legal obligation.

Where we rely on consent (analytics and other non-essential cookies) you can withdraw it at any time via the cookie banner or your browser settings, without affecting anything we did before you withdrew it.

4. Third Parties We Share Your Information With

We share personal information with the service providers listed below, who process it on our behalf or, where indicated, as controllers in their own right. We do not sell your personal data and we do not share it with anyone not named here, except where we are required to by law, or where a business is transferred (in which case this policy travels with it).

Hosting, database and authentication

Analytics (only with your consent)

Sign-in and anti-abuse

Affiliate networks and retailers

BikePartPicker.net is funded by affiliate commission. When you click through to a retailer we earn from, the link is routed through an affiliate network so the retailer can attribute the visit to us. That network, and the retailer, will typically set their own cookies and receive your IP address, browser information, the page you came from and the time of the click. They act as independent controllers for that data, under their own privacy policies, and we have no control over it once you leave our site. We receive only aggregate, anonymous commission reporting back: we are never told who bought what.

Some retailers we list are not monetised at all; Merlin Cycles is one today. Those links go straight to the retailer with no affiliate redirect in between, so no network sees the click. We also link directly to retailers' own websites. Once you arrive there, that retailer's privacy policy applies to anything you do on their site, including any purchase. If we join an additional affiliate network we will add it to the list above before any link starts routing through it. See our affiliate disclosure for how affiliate links affect what we show you (short version: they do not; we rank by price and availability, never by commission).

Other services the site calls

5. International Transfers

Our database and application servers are located in the United Kingdom and the European Economic Area (the AWS Europe (London) region). Some of the providers listed above are based in, or transfer data to, the United States and other countries outside the UK. Where that happens, the transfer is covered by an appropriate safeguard: the UK extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or Standard Contractual Clauses with the UK Addendum, as applicable to that provider. Content delivered through the CloudFront CDN is served from the edge location nearest to you, which may be outside the UK.

6. Do We Use Cookies And Other Tracking Technologies?

Yes. Strictly necessary cookies (such as the bpp_country region cookie and your sign-in session) are set without consent because the site cannot work without them. Analytics cookies (Google Analytics and PostHog) are set only after you accept them in the cookie banner, and nothing is loaded from those providers until you do. Affiliate networks and retailers may set their own cookies once you click an outbound link. Full detail is in our Cookie Policy.

7. How Long Do We Keep Your Information?

• Account, builds and likes: for as long as your account exists. If you ask us to delete your account, we remove them within 30 days; deletion requests are usually processed within 48 hours.
• Guest build drafts: automatically deleted 7 days after they were last touched. Drafts attached to a registered account are kept with the account.
• Contact form messages and support email: up to 24 months, so we have the history of any ongoing issue.
• API and server logs: 7 days, then automatically deleted. We do not enable CDN access logging.
• Analytics events: retained by Google Analytics and PostHog under their own retention settings, which are capped at 14 months for user-level data.
• Zero-result search terms: kept indefinitely in aggregate, as they contain no personal information.
• Records we must keep by law: accounting and tax records for 6 years.

8. How Do We Keep Your Information Safe?

The site is served over HTTPS only, with a strict Content Security Policy that blocks any third-party origin not listed in this policy. Passwords are managed by Amazon Cognito and never stored by us. Data at rest is encrypted by AWS, administrative access is restricted and IP-limited, and we keep the number of third parties deliberately small. No system is perfectly secure, but we aim to protect your information with appropriate organisational and technical measures.

9. What Are Your Privacy Rights?

Under the UK GDPR you have the right to access a copy of your personal information, to have it corrected or erased, to restrict or object to how we process it (including objecting to processing based on our legitimate interests), to data portability, and to withdraw consent at any time where we rely on it.

To exercise any of these, email privacy@bikepartpicker.net. We will respond within one month. Our data deletion instructions cover the self-service options.

If you are unhappy with how we have handled your information you can complain to the UK Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put things right first.

10. Children

BikePartPicker.net is not directed at children and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us their information, contact us and we will delete it.

11. Updates To This Policy

We may update this privacy policy from time to time, for example if we add or remove a third-party service. The updated version is effective as soon as it is published, and the "Last updated" date at the top of this page always reflects the current version.

12. How Can You Contact Us About This Policy?

Email privacy@bikepartpicker.net, or write to us at Halley Hares Ltd, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.