← العودة إلى الموقع CrankPal

Privacy policy

Version 3 · Last updated: 30 September 2026

1. Data controller

CrankPal S.r.l., with registered office at Via Benedetto Marcello, 6 – 20124 Milano, Tax Code/VAT No. 14801630964, PEC [email protected]. Email: [email protected].

2. Data we process

Depending on how you use CrankPal, we process: identification and contact data (name, email, telephone number, address); data relating to your bicycles and their maintenance; the photographs of the bicycle, of its components and of the frame number that you or the workshop upload to the bicycle record; booking data and data on your interactions with workshops; website and app usage data (IP addresses, technical logs, device identifiers); subject to authorisation through your device permissions (iOS/Android), your location, in order to show you nearby workshops and record your rides and, only if you turn on automatic ride recording, also in the background (“Always” permission): the phone wakes the app when you move and GPS runs only during the ride; if you turn on automatic ride detection, the device's physical-activity history (“Motion & Fitness” permission), read and classified on the phone: only the start, end and estimated kilometres of cycling rides reach the server, never the history; if you pair a Bluetooth speed sensor to the wheel, the wheel revolutions sent by the sensor, converted into kilometres on the phone (these are not health data); if you connect third-party services (e.g. Strava, Garmin), the data of your rides, including GPS tracks, necessary for predictive maintenance and, for Strava, also the bicycles listed in your profile (name, make, model and distance ridden), in order to link them to your bicycles on CrankPal; if you authorise HealthKit (Apple Health, on iOS) or Health Connect (on Android), the cycling workouts saved there (date, duration, distance and, where available, elevation gain) with their average and maximum heart rate; if you pair a Bluetooth sensor (heart-rate strap, power meter), the average and maximum heart rate and the average power of the rides recorded with the app — heart rate and power are health data and we process them only with your explicit consent, which you can withdraw at any time from the app settings. If you give us your consent, we also process your body weight, for two purposes: to better estimate the brake wear of the bicycles you ride (the heavier the rider, the harder the brake pads and discs work) and to train, in pseudonymised form, the model CrankPal uses to estimate component wear, so that predictions improve for everyone. We read it from your Strava profile, from Apple Health (iOS) or from Health Connect (Android), if you authorise access to it, or you enter it yourself in the app. Body weight may be health data: this is why we ask for an explicit consent that covers both purposes, is separate from the one for heart rate and power and can be withdrawn at any time from the app; withdrawing it deletes your weight. If you are a workshop operator, we process the data described in § 5.

Ride routes, sensors and the bicycle model catalogue. If you record a ride with the app (phone GPS or automatic recording), in addition to distance, duration and elevation gain we also store the route on the server, in simplified form, in order to show you the map of the ride on all your devices: it is location data and is visible only to you, not to the workshop nor to the other people who use the bicycle. If you pair a compatible Bluetooth sensor with the app (speed or cadence sensor, heart-rate strap, power meter), the phone reports to the server the make, model, the serial number and hardware revision assigned by the manufacturer (when the sensor makes them available), firmware version, the name the sensor advertises, the battery level and the bicycle you assigned it to; these data are also visible to the workshop to which you have given access to that bicycle, to help you with the maintenance of the sensor (for example a battery to replace) and with support or warranty requests. We do not transmit the sensor's Bluetooth address. If you use the CrankPal wheel sensor, its serial number and the device's technical data (battery voltage, temperature, restarts) reach the server together with the rides and are used to diagnose faults; the serial number, battery voltage and temperature are also visible to the workshop to which you have given access to the bicycle. If a person you share the bicycle with connects to your sensor, their phone may carry to the server, encrypted, the log data your phone has not yet downloaded: the content can be read only by our systems, and the person who carried it is recorded for the period indicated in § 7. When you search for the make and model of a bicycle in the catalogue, the text you type is forwarded by our server to an external provider of a bicycle model catalogue, without any data identifying you (§ 4).

Raw sensor data and DataLab. If you turn on «Record raw data» in the app, or if you subscribe to CrankPal Pro, during a ride recorded with your phone the app collects in high definition the data of the CrankPal wheel sensor (accelerations, rotations, magnetic field, pressure, temperature and humidity), the GPS position of the phone with its accuracy data, the time zone set on the phone (to show your rides in local time) and, if you allow them, the data of the phone's sensors and of the paired Bluetooth sensors (power, cadence and, only with the explicit consent «Include heart rate», heart rate). The file of each ride is uploaded, compressed, to a store kept separate from the other data, under a random identifier that contains neither your name nor your email address. With CrankPal Pro you can view and download this data on the DataLab website (datalab.crankpal.com), which reads it only for you after checking your access with our server; to show you your rides, DataLab computes and stores summaries (one-second series, charts, maps, trends), which are personal data just like the file they come from.

Bicycle documents, service requests and loose components. On a bicycle record, you and the workshops to which you have given access can upload documents (PDFs or images): the purchase invoice, the warranty, the manual, the technical data sheet, a receipt. A document of this kind may contain the personal data of the person who bought the bicycle, such as their name, address and tax code. If you ask a workshop for work with a service request, we process the description of the problem, its category, the bicycle and the parts you indicate, and up to 4 photographs and one video of at most 60 seconds. If you record the video with the app, the phone may also ask you for access to the microphone, which we use only for the audio of that video; before uploading, the app removes the embedded metadata from photos and videos, including location data. If you bring a component removed from the bicycle to the workshop (a wheel, a fork, a shock absorber), the workshop records its make, model and, where there is one, its serial number, also from a photograph (§ 4): like the bicycle, the component is yours and is visible to the workshops to which you have given access.

3. Purposes and legal bases

Providing your data is optional, but necessary in order to use the services offered by the app. In particular, the use of the messaging channels with workshops — with possible AI assistance (§ 4) — is not mandatory: you can always contact the workshop through alternative channels (telephone, in person), and your data will not be processed by means of AI. The "Cranky" AI assistant is likewise optional: the same operations always remain available through the app interface.

Workshop referral programme. Where a customer workshop invites another workshop, we process the email address of the invited workshop provided by the inviter for the sole purposes of delivering the invitation, attributing the referral and granting the related credits. Legal basis: the legitimate interest of CrankPal and of the inviting workshop in promoting the service (Art. 6(1)(f) GDPR) and, for the invited workshop that signs up, the performance of pre-contractual measures (Art. 6(1)(b) GDPR). The information required by Art. 14 GDPR is provided through this notice, referenced in the invitation email; the invited workshop may object at any time and stop receiving further invitations. Attribution relies on first-party technical cookies (see the Cookie Policy); the inviter and the invitee can each see only the status of the referral (invited, signed up, active), never each other's operational data. Invitations not followed by registration and attribution data are kept for the time needed to manage the programme and prevent abuse; granted credits follow the accounting retention terms.

Messages and invitations to workshops listed on CrankPages. From the app you can also contact a workshop that does not use CrankPal but is listed on CrankPages, the public directory of bicycle workshops: ask for its telephone number, send it a message or a service request (§ 4) and invite it to CrankPal with a code that grants it a longer trial period. For you, the legal basis is the performance of the contract (Art. 6(1)(b) GDPR): we forward the message by email in our own name, with a platform reply address, introducing you to the workshop with your first name and surname and your profile image, and the reply reaches you in the app without your email address ever being disclosed to the workshop. In the invitation, on the other hand, which presents you to the workshop as the person recommending CrankPal, your first name and surname and your profile image appear only with your explicit and separate consent (Art. 6(1)(a) GDPR), which we ask for each time: without your name we send no invitation. For the workshop receiving the email, which has not asked us for anything, the legal basis is your and CrankPal's legitimate interest (Art. 6(1)(f) GDPR) in delivering a request from one of its customers: this is why we write to it only once per message (no reminders until it replies), send it at most one invitation per person, do not write to it if it has asked not to be contacted, and every email carries the information notice required by Art. 14 GDPR and a one-click unsubscribe link. A service request counts as a message: until the workshop replies you cannot send it anything else, and the request is not sent if your conversation with it is already awaiting its reply. The telephone number you ask for is delivered to you one at a time, within a daily cap, and is not shown in any list.

4. Recipients

The data may be processed by suppliers appointed as processors pursuant to Art. 28 GDPR: hosting/cloud, email services, payment service providers, accounting and legal advisors. If you ask for early access to the app, or your workshop invites you to it, your name and email address are passed to Apple Inc. (USA/Ireland), which sends you the TestFlight beta invitation and distributes the pre-release version, or to Google LLC (USA/Ireland), which does the same for Android through Firebase App Distribution. Affiliated workshops process the data of their own customers as independent controllers; for such data CrankPal acts as a processor under a data processing agreement (DPA). A workshop has access to your data only in one of the following cases:

Each workshop sees only the data created after the authorisation, in addition to the bicycle with its aggregated history. Interactions between you and a workshop are not visible to other workshops. You can withdraw access at any time from your personal area. You can also exclude a single bicycle from a single workshop: from then on that workshop no longer sees it, neither its record nor its history, while the documents it has already issued, such as invoices and receipts, remain with it as the law requires. Your body weight is not disclosed to anyone: neither the workshops nor the other people who use the bicycles you ride can see it. It feeds into the brake wear estimate of those bicycles, and whoever sees them, the workshop included, sees the estimate, never your weight; for training we use it only internally and in pseudonymised form, and the trained models contain only aggregated coefficients, not anyone's weight. The data are not sold to third parties.

Bicycles used by more than one person. The owner of a bicycle can let other people registered with CrankPal use it, by inviting them with a link or a QR code (bicycle sharing) or by adding it to their family group. The people who use it see the bicycle and its maintenance status (components, estimated wear, kilometres, treatments) and record their own rides on it, which count towards the wear of its components. Of your rides on a bicycle you use with others, the other people who use it see only the day, the kilometres, the elevation gain, whether it was wet and your first name: never the time, the route, the duration or any health data. The name shown on each ride is that of the person who rode it. Rides that come from the bicycle's sensor, which recognises the bicycle and not the rider, or that are recorded with the app are attributed to the person who uploaded them (for sensor rides, usually the owner): if the attribution is wrong, the owner and the person shown as having ridden it can correct it by choosing among the people who have access to the bicycle, and we record who made the correction and when. Rides imported from Strava, Garmin, Apple Health or Health Connect, on the other hand, always remain with the person who imported them. The correction changes the name shown on the ride and the weight taken into account by the brake wear estimate (§ 2), but it does not move the ride from one history to another: the person who uploaded it, even if they did not ride it, keeps seeing it in full in their own history, while the person who rode it sees it among the bicycle's rides with only the information listed above. When you ask to use a bicycle, the owner sees your first name, surname and email address, in order to recognise you before confirming; the same applies to the administrators of a family group when you ask to join it. The members of a family group see the name of the group, the first name and role of the other members and the bicycles that each owner has chosen to add to the group. The workshop to which the owner has given access sees that the bicycle is used by more than one person and, of the rides recorded on it by the others, the day, the kilometres, the elevation gain and the weather, without their names: these are needed to estimate the wear of the bicycle, not to know who rides it. The invitation link or QR code shows whoever opens it the first name of the person inviting and the bicycle, or the name of the group: it should only be sent to the person it is meant for. When you leave the sharing or the group, or the owner removes your access, the bicycle is no longer visible to you and your rides remain yours, detached from the bicycle; the kilometres already counted remain with the components. Legal basis: performance of the service requested by the person sharing the bicycle and by the person accepting the invitation (Art. 6(1)(b) GDPR).

Bicycles prepared by a workshop, and inspections. A workshop can register a bicycle in your name (model, components, the distance read at the workshop, work done) and send it to you with an email that comes from the workshop itself, with a single reminder after seven days: until you accept it in the app the bicycle stays with the workshop, and nothing enters your account without your confirmation; if you answer “It's not my bike” the registration is closed. When you or a workshop record the outcome of a component inspection (OK, worn, needs replacing, replaced), the outcome goes into the bicycle's logbook together with who recorded it and the workshop's note, and is used to work out the next due date; outcomes recorded by workshops are also used to improve the forecasting model. Your answers about the bicycle's history and use (in use since, distance ridden, rides in the wet, where it is kept, how often basic care is done, expected distance per month) are data about the bicycle: with a change of ownership only the history answers travel with it, without your name, and the usage answers are reset. Your weight remains personal data processed only with your consent, and for a bicycle ridden by others anonymous weight bands are used.

Bicycle documents. Whoever uploads a document to a bicycle record chooses who can see it. The workshop chooses between “workshop only” and “workshop and cyclist”: in the second case you, as the owner of the bicycle, can see it too. You choose between “only me” and “me and my workshops”, meaning the workshops with which you have an active connection and for as long as it remains active, and you can also show it to the members of the family group in which you have placed the bicycle, chosen one by one. A workshop never sees the documents that another workshop has uploaded to the same bicycle, nor the ones you keep to yourself. When ownership of the bicycle is transferred, the new owner receives only the documents that the outgoing owner ticks in the confirmation, because a purchase invoice carries the data of the person who bought the bicycle: the others that the outgoing owner had uploaded are deleted, and those uploaded by a workshop become visible to that workshop only. The files are stored, like the photographs of the bicycle, in the cloud storage of our hosting provider (Cloudflare), appointed as a processor; we remove the embedded metadata from images, including location data (EXIF/GPS).

Jobs subcontracted between workshops. If the workshop handling your bike entrusts a specific job to another workshop or repairer of the network (a subcontracted job), the latter only receives the technical data needed for the work (bike make, model and components, serial number, description of the issue, photographs, diagnosis) — never your name or contact details. The recipient processes such data as an autonomous controller, for the sole purpose of performing the work, and is contractually prohibited from attempting to identify or contact you.

AI assistance in conversations with workshops. If the workshop you are communicating with has enabled the AI assistance features, the text of the messages in the conversation (stripped of email signatures and quoted text) is transmitted to Anthropic, PBC (United States), appointed as a sub-processor, in order to generate summaries, draft replies and classifications (intent, urgency, sentiment) for the benefit of the workshop. We do not transmit your profile data (name, email, telephone number); however, the free text of the messages is not anonymised and may contain the personal data you write in it: we encourage you not to include unnecessary data in your messages (e.g. health or financial data). Under the contractual commitments in place between CrankPal and the supplier, the content is not used to train the supplier's models and is retained only for the time strictly necessary for processing; should these conditions change, we will update this privacy policy. Providing data through the messaging channels is optional (see § 3).

"Cranky" AI assistant. If you use the conversational assistant, the chat text, the page context and the account data needed for the reply (e.g. bicycles, service history, appointments) are transmitted to Anthropic, PBC (United States), appointed as a processor. Under the contractual commitments in place, the content is not used to train the provider's models and is retained by the provider only for the time strictly necessary for processing. Conversations are retained by CrankPal for 90 days (§ 7); a sample may be reviewed by authorised staff, in pseudonymised form, for quality and safety purposes. If you ask for human support, the conversation is shared with the support team only with your consent. We encourage you not to include unnecessary data in the chat (e.g. health or financial data). The assistant does not make decisions with legal effects based solely on automated processing: actions are executed only upon your confirmation.

AI reading of photographs. Some optional features read a photograph instead of asking you to type in a value: the photo of the frame number, in order to transcribe the code stamped on the frame, the photo of the serial number of a loose component (a wheel, a fork or a shock absorber that you bring to the workshop removed from the bicycle, § 2), in order to transcribe its code, and the photos of the bicycle and of its components, in order to recognise the part and its model. When one of these features is used, only the image concerned is transmitted, together with the reading instruction, to Anthropic, PBC (United States) — the same supplier used for the other AI assistance features, appointed as a sub-processor where the feature is used by the workshop and as a processor where the processing is carried out by CrankPal. We do not transmit your profile data (name, email, telephone number); the photograph, however, is not anonymised and may show, in addition to the part, whatever surrounds it: we encourage you to frame the detail rather than people or the surroundings. Under the contractual commitments in place, the images are not used to train the supplier's models and are retained by the supplier only for the time strictly necessary for processing. The result is a suggestion: it becomes a record only after a person confirms it. Before the photograph is stored we remove its embedded metadata, including location data (EXIF/GPS); where it is kept, the photo remains attached to the bicycle or component record and follows the retention terms set out in § 7.

Bicycle model catalogue. To suggest the make, model and factory-fitted components of your bicycle we rely on an external provider of a bicycle model catalogue, appointed as a processor pursuant to Art. 28 GDPR. Searches originate from our server and contain only the text you typed or the filters you chose (make, year, category), never your name, your account or your device identifier; the photographs of the models reach your phone through our systems, without your device contacting the provider.

Workshops listed on CrankPages. When you write to a listed workshop, send it a service request or invite it, the workshop receives an email with your first name and surname and your profile image (the photo you uploaded, the avatar you chose or, failing that, your initials) and, depending on the case, the text of your message, your request or the code and a description of CrankPal; it does not receive your email address, your telephone number or any other data from your account. The workshop's address we write to comes from publicly available sources, collected in CrankPages, and is not shown to you. If the workshop replies, its reply enters your conversation in the app; if it signs up to CrankPal with your code, you are notified so you can connect it, and the workshop knows that the registration originated from your invitation.

Service requests. A service request (§ 2), with its photos and video, reaches only the workshop you choose. If it is a workshop to which you have given access, it finds the request in its management system and replies to you in the app with a message, a quote or a date to confirm. If it is a workshop listed on CrankPages that does not use CrankPal, we send it an email under the conditions set out in § 3, with a link valid for 7 days to a page where it can see the request, including photos and video, and from which it can reply by proposing a date, without registering; its reply reaches you in the app.

DataLab and raw data. DataLab is a CrankPal service running on a server separate from the workshops' management system: workshops have no access to your raw data or to DataLab. The pseudonymised copies for training and the de-identified files (§ 7) are accessible only to CrankPal staff authorised by name, with logged access and a confidentiality undertaking, and are not disclosed to third parties. The DataLab map is Apple Maps (MapKit JS by Apple Inc.): to draw it, your browser downloads the map images directly from Apple's servers, which receive your IP address and the area of the map you are looking at and process them as an independent controller, under their own privacy policy; the route of the ride is drawn by your browser on top of the map and is not sent to Apple. Because the map opens framed on the ride, the images requested from Apple reveal its area, not its route. Besides the images, MapKit JS sends Apple technical usage statistics: the visible area rounded to the degree, the zoom level, the device type, operating system and browser, and a random session identifier that is not stored on the device. MapKit JS uses no cookies or other browser storage. If you choose «Open in MATLAB Online», we generate a personal download link valid for 30 minutes: the ride file is downloaded by MathWorks' systems on your initiative and from then on is processed under the terms of the MathWorks service you use.

5. Workshop operators

If you use the CrankPal management system as a workshop operator (owner, manager, mechanic), we process your data (name, email, telephone number, role, credentials, access and activity logs, clock-in/clock-out records and working times) for two distinct purposes: (a) on behalf of your employer, as a processor within the meaning of Art. 28 GDPR — the workshop remains the controller; (b) for CrankPal's own purposes (security, abuse prevention, product improvement in aggregated form) as an independent controller (legitimate interest, Art. 6(1)(f) GDPR). The rights set out in § 8 also apply to you; for the processing referred to under (a), we will forward your request to your workshop.

Management system session recording. To provide support and improve the product, operators' use of the management system may be recorded in masked form by means of a session replay tool hosted on CrankPal's own infrastructure (not a third-party provider). Masking is enabled by default: the text and values of input fields, email addresses and numbers (telephone numbers, cards, IBANs) are obscured, and passwords are never captured. This feature can be disabled for an individual workshop on request to Customer Support.

Note dictation and linked phone. In the management system you can dictate notes instead of typing them. The transcription does not go through our systems: it is performed by your browser's speech recognition, which may send your voice to its manufacturer for that purpose (Apple with Safari, Google with Chrome) under the terms of that service. In the internal notes of a work order the management system also records the voice message, which remains attached to the note on behalf of the workshop (point (a)): it is deleted when the note is deleted, when your user profile is anonymised (the text of the note remains) and when the workshop's data is deleted. If you link your phone to the “CrankPal Workshop” app for scans and signatures, we store the name and model that the phone declares, a device credential, of which we keep only a fingerprint, and the code with which Apple's notification service delivers notifications to it; the link can be revoked from the management system or from the phone and ends automatically when you change your password or role or when your user is deactivated.

Verifying ownership of a CrankPages listing. If you claim your workshop's listing in the public CrankPages directory, we verify that you are the owner by sending a one-time code to the contact (email or phone) already on the listing. If those contacts are missing or no longer accessible, you can ask for an assisted verification by attaching a document proving ownership of the business (for example a company registry extract, a licence, or the owner's ID): we process it for the sole purpose of establishing your entitlement before handing you control of a public page (Art. 6.1.b GDPR — pre-contractual measures; Art. 6.1.f — legitimate interest in preventing a business's page from being claimed by third parties). The document is accessible only to authorised staff and is deleted within 30 days of the decision; a record of the request remains, without the attachment. Sending a document is optional: without it, the other verification routes remain available.

6. Transfers outside the EU

Where a supplier processes data outside the European Economic Area, the transfer takes place on the basis of appropriate safeguards (e.g. the EU Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework). This is the case, in particular, of Anthropic, PBC (United States) for the AI assistance and photograph-reading features (§ 3 and § 4) and, where it is established outside the European Economic Area, of the provider of the bicycle model catalogue (§ 4).

7. Retention

We retain the data for the time necessary for the purposes indicated and, for accounting/tax data, for the periods required by law (as a rule, 10 years). Account data is deleted or anonymised upon request, without prejudice to retention obligations. Usage data intended for improving the algorithm is rendered anonymous or aggregated within a defined period and, once irreversibly anonymised, no longer constituting personal data (Recital 26 GDPR), may be retained and used without time limits, including after the deletion of the account or unsubscription. Conversations with the "Cranky" AI assistant are retained for 90 days from the last interaction and then deleted; the related technical logs are kept in pseudonymised form. For your body weight, we keep only the latest value from each source, with the date it was measured, until you withdraw your consent or delete your account: in either case it is deleted and no longer enters subsequent training, while models already trained remain, because they do not contain it; a record of the granting and withdrawal of consent is kept, without the weight, as evidence of consent.

Photographs of the bicycle. The photographs of the bicycle, of its components and of the frame number are retained for as long as the bicycle exists on the platform, as they document the condition of the bicycle and of the parts fitted to it over time. The photograph of the frame number in particular is the evidence that that frame passed through that workshop, and it is needed in the very cases where the frame number matters: reporting a theft and transferring ownership. A shorter retention period would make it useless precisely when it is needed. The photographs are deleted, together with the stored files, upon deletion of the account (Art. 17 GDPR, § 8) and when the bicycle record is removed; the embedded metadata, including location data (EXIF/GPS), is removed before the photograph is stored (§ 4).

Ride routes and sensor data. The route of a ride follows the ride: it is deleted when you delete the ride or the account. The data of compatible sensors is a snapshot updated by the phone and is deleted when you unpair the sensor, when the bicycle is permanently deleted or together with the account. The identity of the person who carried the encrypted data of a CrankPal sensor to the server is kept for 90 days from the delivery and then removed; the sensor's log data remains linked to its owner.

Raw sensor data. Files uploaded for the CrankPal Pro service are retained, with your identifier, while the subscription is active and for 90 days after it ends; those uploaded only with consent to training, for up to 24 months. After these periods the file is not deleted: we remove your identifier, keep the file in de-identified (pseudonymised) form for research and for the training of the models, and delete the original. The de-identified file has no predetermined retention period: we keep it for research with the safeguards of Art. 89 GDPR (§ 3). This also applies to files that had no basis for training, or for which you withdrew consent or objected; in the de-identified copy heart rate remains only if the file still had a basis for training and your explicit consent to its use. A de-identified file still contains the route with its times and therefore remains personal data: for this reason we keep the link with your account, which allows us to delete it if you ask for your account to be deleted. The summaries computed by DataLab are deleted together with the file they come from; the training copies are deleted when you withdraw consent or object, or when your account is deleted. Withdrawing consent or objecting does not delete the uploaded files or those already de-identified.

Favourite workshops, messages and invitations to listed workshops. The listed workshops saved among your favourites and the conversations with them follow your account: they are deleted together with it. The invitation code, once generated, is a promise made to the invited workshop, which may keep it and use it even after some time: when your account is deleted the code remains valid but is detached from you and your name is removed. A code that is never used expires after one year. The address of the workshop we wrote to is kept for the time needed to manage the conversation, to avoid writing to it again during the quiet periods and to honour any request of its not to be contacted.

Bicycle documents, service requests and loose components. Bicycle documents are retained for as long as the bicycle remains on the platform, because they accompany its history (the purchase, the warranty): they are deleted, together with the files, when the person who uploaded them removes them, upon deletion of your account (including those that workshops have uploaded to your bicycles) and when the bicycle bin is emptied, 30 days after the bicycle is deleted. The export of your data (§ 8) contains the data of the documents concerning you, not the files, which you can download from the app or your personal area. Service requests, with their photos and video, are deleted 90 days after they are closed or after a proposed date has been accepted; a draft that is never sent is deleted after 24 hours, a request with no activity for 60 days is closed automatically, and so is a request to a listed workshop that has not replied within the 7 days of the link. For a listed workshop, the text of the request also remains as a message in your conversation with it and follows the fate of that conversation. Loose components, with their serial number and its photograph, remain linked to your account and are deleted together with it; the workshop may delete them earlier if no work order or quote refers to them.

8. Your rights

Pursuant to Arts. 15-22 GDPR you have the right of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw any consent given. In particular, for processing based on legitimate interest — including the improvement of the predictive algorithm (§ 3) — you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR), by writing to [email protected] or from your settings; objecting does not affect data that has already been anonymised or aggregated. For raw sensor data, consent can also be withdrawn and objection exercised by turning off the «Record raw data» switch in the app, which also removes the training copies already made; it does not, however, remove the files already de-identified, nor does it prevent the uploaded files from being de-identified at the end of the period set out in § 7 (§ 3 and § 7). De-identified files are deleted when your account is deleted. From the app/your personal area you can export your data and delete your account yourself. For any other requests, write to [email protected] (reply within 30 days). You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

9. Cookies and similar technologies

The website uses first-party technical cookies (e.g. storing your selected region), which are always active, and first-party measurement tools based on identifiers stored in your browser, activated only with your consent through the banner; we do not use third-party profiling cookies. Full details, including durations, purposes and preference management, are set out in the Cookie Policy.

10. Changes

We may update this privacy policy; material changes will be communicated through the website or the app.

© 2026 CrankPal S.r.l. الخصوصية · الشروط