The short version
We use the information needed to provide your account, saved builds, bikes, and optional fit profile; respond to messages and support requests; protect the service; and understand aggregate use and performance. We do not sell personal data, run advertising, track you across unrelated sites, or use AI to process fit data. The service providers we use are named below.
1. Who is responsible for your data
The data controller is David McThomas, operator of Ingrano in the United Kingdom. Contact legal@ingrano.co.uk for any privacy request or question.
2. Information we collect
Account and profile
Your email address, account identifier, account dates, and any profile name or avatar you choose to add. Supabase Auth handles authentication credentials; Ingrano does not receive or store your plain-text password.
Builds, bikes, and sharing
Saved frame and component choices, bike details, build names, questionnaire answers, and share settings. A build is private unless you deliberately publish it; a published build can be viewed by anyone with its share link.
Fit profile
Measurements and riding-position information you enter for frame-size guidance. This is sensitive personal information, is scoped to your account, and is not used for advertising or AI processing. The current service does not accept fit-report uploads.
Messages
If you contact us, we receive your name, email address, and message so we can respond and follow up.
Technical and security data
Hosting and security systems process limited request and device information such as IP address, authentication events, route, method, response status, duration, deployment version, and a random request identifier. Application logs are designed not to contain build contents, fit measurements, messages, credentials, or cookies.
Application error reports
Sentry receives privacy-minimised browser and server error reports so we can diagnose failures. These reports may include the application release, environment, a sanitised route, error type and stack location, and a random request identifier. We disable session replay, user identity, request and response bodies, cookies, headers, query strings, console logs, breadcrumbs, and stack variables.
Aggregate analytics and performance
Vercel Web Analytics and Speed Insights process cookieless, aggregated page and performance information, which can include a redacted route, referrer, general location, browser, device, operating system, network information, and web-vital timings. Ingrano removes query strings, fragments, and dynamic build, bike, frame, component, and compatibility identifiers from the analytics event URL. Vercel separately processes incoming request URLs as our hosting provider. We do not intentionally place account IDs, email addresses, build contents, or fit measurements in analytics events.
3. Why we use it and our lawful basis
- Contract — to create and secure your account and provide the save, share, garage, fit, export, and deletion features you request.
- Legitimate interests — to answer messages, prevent abuse, keep the service reliable, diagnose failures, and improve aggregate product performance, balanced against your privacy rights.
- Legal obligation — where we must keep or disclose information to comply with law or respond to a valid rights request.
- Consent — only where we ask for a genuinely optional use that requires it. You may withdraw that consent at any time. We do not currently send marketing email.
Ingrano does not make solely automated decisions that have legal or similarly significant effects on you. Compatibility and fit outputs are decision-support information, not profiling for advertising or eligibility.
4. Service providers and recipients
We disclose only the information needed for these providers to supply the service. They may use their own subprocessors under their service terms.
- Supabase — account authentication, database, and private file storage.
- Vercel — website hosting, delivery, runtime logs, aggregate web analytics, and performance measurement.
- Resend — contact, support, and transactional email delivery, including message content and delivery metadata.
- Upstash — short- lived IP-based rate-limit keys used to prevent abuse.
- Sentry — privacy-minimised application error monitoring.
- Public authorities or advisers, but only where disclosure is required by law or reasonably necessary to establish or defend legal claims.
We do not sell personal data, disclose it to advertising networks, or use it for cross-site behavioural advertising.
5. International transfers
Some providers or their subprocessors may process information outside the United Kingdom. Where UK transfer restrictions apply, we require an applicable transfer mechanism, such as UK adequacy regulations or approved contractual clauses including the UK International Data Transfer Addendum. Contact us if you would like information about the safeguard applicable to a particular provider.
6. Cookies and browser storage
- Necessary authentication cookies keep you signed in and protect account sessions.
- Local browser storage remembers your pricing region, whether notices or the product tour were seen, and an anonymous in-progress build. It stays in that browser unless you clear it or choose to save the build.
- Analytics and performance do not set third-party advertising cookies. Vercel derives a short-lived visitor hash for aggregate measurement and discards the visitor session after 24 hours.
7. Retention
- Account, profile, build, bike, and fit data remain while your account is active and are removed from the live service when a successful account deletion completes.
- Contact messages are kept for no more than 12 months after the last contact, unless a legal claim or obligation requires longer.
- Rate-limit keys expire with their abuse-prevention window, currently no more than one hour. Searchable operational logs are limited to 30 days.
- Searchable Sentry application error events are limited to 30 days. Aggregate issue metadata may remain for the provider's documented account lifecycle, without request contents or user identity supplied by Ingrano.
- Aggregate analytics and performance reports are retained for the configured provider reporting window, which will not exceed 12 months for Ingrano. Provider backup or security records may age out on a different documented deletion cycle.
We may preserve the minimum information required for legal claims, fraud prevention, or compliance for longer. Such information is restricted to that purpose.
8. Security
We use HTTPS, access controls, private-by-default account records, database row-level security, bounded logs, and provider security controls. No internet service can promise absolute security. If you believe your account or data is at risk, contact legal@ingrano.co.uk.
9. Your data-protection rights
Depending on your circumstances, UK data-protection law gives you rights to:
- access a copy of your personal data;
- correct inaccurate or incomplete data;
- ask us to erase data;
- restrict or object to particular processing;
- receive portable data you provided where applicable; and
- withdraw consent where processing relies on consent.
You can download or delete core account data from your account page. For any other request, email legal@ingrano.co.uk. We normally respond within one month, subject to lawful extensions. You may also complain to the UK Information Commissioner's Office.
10. Children and policy changes
Accounts are for people aged 16 or over. If we learn that an under-16 has created an account, contact us so we can investigate and remove it. We will update the date above when this notice changes and will email registered users before a material change takes effect where appropriate.