Privacy policy

Last updated: September 30, 2026. In this policy, BIKE.co, we, us and our mean BIKE.co, part of erp.io. BIKE.co is shop-management software for bike shops, delivered as the Service module of the erp.io suite. We are responsible, as the controller, for the personal information collected through this marketing website.

This policy covers the BIKE.co marketing website: the pages that describe the software, the free resources and checklists, the repair pricing calculator, the contact form, and any emails we send you in reply to a message. It also covers the information we hold about people who contact us about the software, such as prospective customers asking for an Enterprise quote.

It does not cover the software itself. The software runs at app.erp.io. When you start a free trial, create a workspace or sign in, you leave this site, and your account and everything you put into the software are handled under the terms and privacy information presented to you by app.erp.io at sign-up. Where this policy mentions the software, it does so only to explain where the line sits.

If you use the software as a shop, the information you enter about your own customers, their bikes and their repairs is your data. For that information your shop is the controller and erp.io processes it on your behalf, as described in the section on calls and text messages below and in the agreement you accept at sign-up.

Information you provide. When you send a message through the contact form, we receive what you enter: typically your name, email address, your shop's name, your role, and the content of your message, which may include details about your locations, team size and the software you use today. If you correspond with us by email afterwards, we receive the contents of that correspondence. If you use the repair pricing calculator, the numbers you enter are used in your browser to show a result; the calculator does not ask for your name or contact details.

Trial sign-up. The Start free trial buttons on this site link to app.erp.io/sign-up/bike. The sign-up form, the account it creates and the details you enter there, such as your name, email address, password and workspace name, are collected and handled by app.erp.io, not by this site. We do not collect payment details on this site; plans are chosen and billed inside app.erp.io.

Information collected automatically. When your browser requests a page, our servers and hosting providers receive technical information: your IP address, browser type and version, operating system, device type, language setting, the page requested, the referring page, and the date and time of the request. We may derive an approximate location, such as country or region, from your IP address. We do not collect precise location.

Cookies and similar technologies. The site uses cookies and similar browser storage as described in the cookies section below. We do not use them to build advertising profiles of you.

Information from others. If someone at your shop or another business refers you to us, or if you are copied on a message someone sends through the contact form, we may receive your name and contact details from them.

If you are in the European Economic Area, the United Kingdom or Switzerland, data protection law requires us to have a legal basis for each use of your personal information. We rely on the following.

Contract and pre-contract steps: when you ask us about the software, a quote or a plan, we process your information to respond to that request before you enter into an agreement. Legitimate interests: we process technical and usage information to run, secure and improve the site, and contact details to answer business enquiries and keep a reasonable record of them. We have weighed these interests against your rights and consider them balanced, because the information is limited and used in ways you would reasonably expect.

Consent: where the law requires consent, for example for non-essential cookies or certain marketing emails, we rely on it, and you can withdraw it at any time without affecting processing that took place before. Legal obligation: we process information where we need to comply with the law, such as tax, accounting or a lawful request from an authority.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not rent or trade contact lists. We share personal information only in the following situations.

Service providers and processors. We use companies that help us run this site and respond to you, such as website hosting and content delivery, email delivery, form handling and spam protection, and, where used, privacy-respecting analytics. They process personal information on our behalf, under contract, only to provide their services to us, and they are not permitted to use it for their own purposes.

The erp.io group. BIKE.co is part of erp.io. A message you send us may be handled by the erp.io team responsible for the product you are asking about, and shared information stays within erp.io and is used for the purposes in this policy.

Legal and safety reasons. We may disclose information where we believe in good faith that the law, a court order or a lawful request by a public authority requires it, or where it is necessary to protect the rights, property or safety of our users, the public or us, including to prevent fraud and abuse.

Business transfers. If erp.io or BIKE.co is involved in a merger, acquisition, financing, reorganization or sale of all or part of its business or assets, personal information may be transferred as part of that transaction. The recipient will be bound to handle it consistently with this policy, and we will tell you if a transfer changes how your information is used.

Cookies are small files a website stores in your browser; similar technologies include local storage and pixels. We group what the site uses into categories. Strictly necessary: storage the site needs to deliver pages, stay secure, protect the contact form from spam and remember your privacy choices. These cannot be switched off through our site because the site does not work properly without them.

Analytics: where we use analytics, it is to count visits and see which pages and resources are read, in aggregate. We configure it to avoid building profiles of individuals. Where the law requires your consent for analytics, we ask for it first. Advertising: we do not use advertising or cross-site tracking cookies on this site.

How to control them. You can block or delete cookies through your browser settings, and most browsers let you refuse third-party cookies or clear storage when you close the browser. The pages on this site still load and read normally if you block non-essential cookies. We also honor Global Privacy Control signals, as described in the section on opting out of data sharing.

When you follow a link to app.erp.io to start a trial or sign in, that application sets the cookies it needs, for example to keep you signed in. Those cookies are part of the software and are covered by the information presented there.

We keep personal information only for as long as we need it for the purpose we collected it for, and then delete or anonymize it. Contact form messages and related correspondence are kept for as long as needed to answer you and maintain a reasonable record of the conversation, which may include the period during which you are evaluating or using the software.

Server and security logs are kept for a limited period to operate and protect the site and to investigate incidents, and then deleted or aggregated. Records of privacy requests, including opt-outs, are kept for as long as needed to show the request was honored and to keep honoring it.

We may keep information longer where the law requires it, or where it is needed to establish, exercise or defend legal claims. Information that has been anonymized so it no longer identifies you may be kept and used without limit.

We protect personal information with technical and organizational measures appropriate to the risk, including encrypted connections to the site, access limited to the people who need it, and service providers held to contractual security obligations. We also collect as little as we need, because information we do not hold cannot be exposed.

No website or transmission over the internet is completely secure, and we cannot guarantee the security of information you send us. Please do not send sensitive information, such as payment card numbers, passwords or health information, through the contact form. If we become aware of a breach that affects your personal information, we will notify you and the authorities where the law requires.

Depending on where you live, you have rights over your personal information. If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access the personal information we hold about you, to have inaccurate information corrected, to have information erased, to restrict or object to our processing, including processing based on legitimate interests, to data portability, and to withdraw consent at any time where we rely on consent.

You can object to direct marketing at any time, and we will stop. You also have the right to lodge a complaint with your local data protection authority, or in the United Kingdom with the Information Commissioner's Office. We would appreciate the chance to address your concern first, so please contact us.

We respond to requests within one month, which the law allows us to extend by up to two further months for complex or numerous requests; if we extend, we will tell you why.

If you are a resident of California or of another US state with a comprehensive privacy law, such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others, you have rights over your personal information, subject to exceptions in those laws. This section also serves as our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Right to know and access: to request the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes, and the categories of third parties we disclose it to. Right to delete: to request deletion of personal information we collected from you. Right to correct: to request that we correct inaccurate personal information.

Right to opt out of sale or sharing: to direct us not to sell your personal information or share it for cross-context behavioral advertising. We do not sell or share personal information in that sense, and we have not done so in the past 12 months, but you may still submit an opt-out and we will record it. Right to limit use of sensitive personal information: we do not collect sensitive personal information through this site or use it to infer characteristics about you, so there is nothing to limit. Where state law gives you the right to opt out of targeted advertising or profiling with legal or similarly significant effects, we do not engage in either.

Right to non-discrimination: we will not deny you service, charge you a different price, or provide a different quality of service because you exercised a privacy right. Some states also give you the right to appeal our decision on your request; if we decline a request, we will explain how to appeal, and if the appeal is denied you may contact your state attorney general.

You can ask us not to sell or share your personal information, and not to disclose it to anyone other than the service providers who run this site for us. Send the request through the contact page and say that you are opting out of data sharing. Include the email address you used with us so we can apply it to your records. We do not require you to create an account or verify your identity to opt out, and we will confirm once the request is applied.

Since we do not sell personal information or share it for cross-context behavioral advertising, there is no sale to stop. This section exists so the request is simple to make and easy to find. It replaces the older data-sharing opt-out page that used to live at a separate address on this domain.

Global Privacy Control. If your browser or a browser extension sends a Global Privacy Control signal, we treat it as a valid request to opt out of the sale and sharing of personal information associated with that browser. Because a GPC signal is tied to a browser, it may not apply to information we hold about you from other sources, such as a contact form message, unless you also tell us who you are through the contact page.

You can also unsubscribe from any marketing email we send using the link in that email, or by asking through the contact page. We will still send messages that are needed to answer a request you made.

We and our service providers may process personal information in the United States and in other countries where they operate, which may have data protection laws different from those in your country.

When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country that has not been found to provide adequate protection, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or rely on another lawful transfer mechanism. You can ask for more information about these safeguards through the contact page.

BIKE.co can be used by bike shops to communicate with their own customers, for example a text saying a bike is ready, or calls answered by Phony, erp.io's AI receptionist. When a shop uses the software to send texts or handle calls, the shop is the controller of its customers' information, including phone numbers, message contents and call recordings or transcripts, and erp.io acts as its processor, handling that information on the shop's instructions and under the agreement the shop accepted at sign-up.

If you are a customer of a bike shop and received a text or call through the software, questions about how your information is used, and requests to access or delete it, should go to that shop. If you contact us instead, we will pass your request to the shop where we can identify it. You can stop text messages from a shop by replying STOP, or by asking the shop directly.

Shops are responsible for having the consent the law requires before sending texts or making calls to their customers, including under the Telephone Consumer Protection Act in the United States. We do not use the phone numbers or message contents of shops' customers for our own marketing, and we do not sell them or share mobile opt-in data with third parties for their marketing.

This site is for owners and staff of bike shops evaluating business software. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, tell us through the contact page and we will delete it.

The site links to other websites, including app.erp.io and, on comparison pages, the websites of other software companies. We do not control other websites, and this policy does not apply to them. Read the privacy policy of any site before you give it personal information.

We may update this policy as the site, the law or our practices change. When we do, we will change the date at the top of the page. If a change materially affects how we use personal information we already hold, we will say so prominently on this page and, where the law requires, ask for your consent or notify you directly.

Questions about this policy, and privacy requests of any kind, can be sent through the contact page on this site. Say that your message is about privacy so it reaches the right people quickly. BIKE.co is part of erp.io, and your message will be handled by the team responsible for this site.