Privacy Policy

Last updated: 30 August 2026

Who we are

Fixlosophy Ltd ("we", "us") operates this website and the bike shop at Blue House Yard, 5 River Park Rd, London N22 7TB. We are the data controller for the personal data described below.

Fixlosophy Ltd is a private limited company registered in England and Wales, company number 14043865. Registered office: Blue House Yard, Unit 9, 5a River Park Road, London, England, N22 7TB.

Questions, or want your data removed? Email fixlosophy@gmail.com or call 07874 004100.

What we collect

When you book a repair

• Your name, email address and phone number — so we can identify the bike and contact you when it's ready.
• Your bike's make and model, and any notes you write — so the mechanic knows what's coming.
• Photos you choose to upload — optional, up to five per booking. Only upload photos you're happy for us to see; don't include people or number plates.
• The appointment itself — service, date, time, price estimate and status.

When you create an account

• Your name, email address and phone number.
• Your password, stored only as a salted PBKDF2 hash. We never store or see the password itself, and cannot recover it — only reset it.
• Bikes you save, so they're one tap away next time you book.

When you send us a message

• The name, email, optional phone number, and message you type into the contact form.

Automatically

• Your IP address, held briefly in memory to rate-limit sign-in attempts and stop automated abuse. It is not written to our database.
• One cookie, described below.
• Anonymous usage statistics — which pages get looked at, and how far people get through the booking form before stopping. This is measured by our own server and described in full below.

We do not use advertising, tracking pixels, social media trackers, or any third-party analytics service. Nothing on this site sends information about you to another company.

How we measure the site

We count how the site is used so we can tell which services people are looking for and where the booking form is losing people — if everyone gives up at the calendar, we need more appointment slots, not a redesign. That measurement is built into this site and runs on our own server.

It does not identify you, and it cannot be made to. Specifically:

• It stores nothing at all on your device — no cookie, no local storage, no fingerprint of your browser.
• It does not record your IP address, and does not look up your location from it.
• A visit is given a random number that exists only while the page is open and is thrown away when you leave. Come back tomorrow and you are a new, equally anonymous visit — we have no way to connect the two.
• We keep the page address, whether you were on a phone or a computer, which site sent you (the site's name only, never the page you came from), and how far you got through the booking form. Nothing that identifies a person.
• If you make a booking or send us a message, those details are covered by the sections above — they are not part of these statistics, and the two are not joined up.

Because nothing is stored on your device, the rules that require a cookie banner don't apply, which is why you haven't been asked to click one. We rely on our legitimate interest in understanding how our own shop's website is performing — and since these records contain nothing that points to a person, they can't be used to make a decision about you.

Detailed visit records are deleted after 13 months. What remains after that is a daily tally of page views, which contains no visitor information of any kind.

Cookies

We set a single cookie, Fixlosophy.Auth. It keeps you signed in and nothing else. It is strictly necessary for the sign-in feature to work, so it doesn't require your consent — and because we set no other cookies, and our usage statistics store nothing on your device either, there is no cookie banner to click through.

• It contains your account ID, display name and role — no password, and no payment details.
• It is HTTP-only and, in production, sent only over HTTPS, so scripts in your browser cannot read it.
• It lasts until you close your browser, unless you tick "Remember me on this device", which extends it to 30 days.
• Signing out deletes it immediately.

Why we're allowed to use it

• To perform our contract with you — taking and fulfilling a booking, and running your account.
• Our legitimate interests — keeping the site secure and available (rate limiting, abuse prevention), keeping records of work carried out, and understanding how our own website is used through the anonymous statistics described above.
• Legal obligation — retaining transaction records where tax or consumer law requires it.

We do not send marketing email, so we don't rely on consent for it.

Who else sees it

We do not sell your data or share it for advertising. It reaches only:

• Our shop staff, who see what they need to do the job. Staff permissions are set individually, and some staff cannot see customer contact details at all.
• Supabase, which hosts our database and photo storage. Our project is hosted in Ireland (EU West).
• Our email provider, which delivers booking confirmations and password-reset messages.
• Hostinger, which runs the server the website itself is hosted on, in London.

Your data is stored in the UK and Ireland. Ireland is in the European Economic Area, which the UK government has found to provide an adequate level of data protection, so no additional transfer safeguards are required.

To complete before launch: name the email provider above, once the domain's mailbox is set up.

How long we keep it

• Bookings and repair records — 6 years, to cover the period in which a claim about work carried out could be brought.
• Photos you upload — 12 months after the booking is completed, then deleted.
• Account details — until you ask us to delete the account.
• Contact form messages — 12 months.
• Password reset and email verification links — 1 hour and 24 hours respectively, then they expire automatically.

Your rights

Under UK GDPR you can ask us to:

• Show you the data we hold about you.
• Correct anything that's wrong.
• Delete your data, where we don't have to keep it.
• Give you a copy in a portable format.
• Restrict or object to how we use it.

If you have an account, you can do the first and fourth of these yourself from your account page, which also has a delete button. Otherwise email fixlosophy@gmail.com — we'll respond within one month.

Deleting your account removes your profile, saved bikes and login. Bookings are kept but anonymised — disconnected from you and stripped of your contact details — because we need the record of work carried out.

Complaints

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

If we change this policy we'll update the date at the top. Material changes affecting how we use data you've already given us will be emailed to account holders.