Privacy Policy

1. Data we collect

Account data

• Phone number and email address (used for sign-in).
• First and last name (you provide these).
• Profile photo if you choose to upload one.
• Preferred language and notification preferences.

Bike + service data

• Make, model, year, colour, mileage, stage build, and replacement history of motorcycles you register.
• Bookings, jobs, and service notes associated with your bikes.
• Photos of your bikes that you upload.
• Odometer photos. When you tap "Update odometer" in the app, your dashboard photo is sent to Claude Haiku (Anthropic) for optical character recognition, then stored in our private object storage. We keep the photo as part of the audit trail for your bike's mileage history so that disputes (drop-off mileage at the workshop, etc.) can be resolved against the source image. Each photo is associated with your account and only visible to you and Forty5° staff with explicit audit-permission.
• Rides. When you create or RSVP to a ride, the title, planned time, expected distance, optional meeting-point label and coordinates, and any logged km after the ride are stored. RSVPs and km logs are visible to other riders who can see the ride.

Chat history

• Messages you send to the AI Mechanic and the model's responses, retained so chat sessions remain readable on return.
• Daily message counts, used to enforce rate limits per tier.

Subscription + commerce data

• Subscription state (active, in trial, expired) — synced from Apple / Google via RevenueCat. We never see your payment-card details.
• A link between your Forty5° account and your Shopify customer record (matched by email) so we can show your order history in-app.

Location data

• Coarse location when you set a pickup, delivery, or ride meeting point. Location is collected only when you actively use those features — never in the background.

Diagnostic + crash data

• Crash reports and basic device-model / OS-version metadata via Firebase Crashlytics, used to diagnose bugs.
• Push-notification delivery receipts, used to confirm critical messages (booking confirmations, etc.) reached your device.

2. Why we collect it

We use the data above to:

• Run the app and the workshop (the core service you signed up for).
• Personalise the AI Mechanic — it can only give useful answers when it knows what bike you ride and your service history.
• Process subscriptions, apply member pricing, and enforce rate limits fairly across tiers.
• Communicate booking confirmations, reminders, and shop announcements.
• Improve the app by analysing crashes and usage patterns.
• Comply with UAE legal record-keeping obligations.

3. Third parties we share data with

We use a small set of trusted vendors to operate the Service. Each receives only the data they need to do their job:

• Supabase — database hosting, authentication, file storage. Data is stored in Supabase's EU region.
• Anthropic — powers the AI Mechanic + odometer OCR + image moderation. Your chat messages, attached photos, dashboard photos (when you update your odometer), and the bike context for each request are sent to Anthropic's API. Anthropic's enterprise terms mean they don't train on user inputs. We send only what the specific feature needs — odometer OCR does not see your chat history, the AI Mechanic does not see your odometer photos unless you attach one yourself.
• Voyage AI — embeds your AI Mechanic queries (member tier only) so we can retrieve relevant service-manual excerpts. Embeddings are derived data, not the raw query, but the query text itself is sent to Voyage to generate them.
• RevenueCat — manages our subscription lifecycle. Receives your Forty5° user ID and the receipt data Apple/Google send when you subscribe, renew, or cancel.
• Shopify — runs our parts catalogue. When your email matches a Shopify customer, we link the records and your member status is propagated as a customer tag for automatic discount eligibility.
• Apple + Google — process subscription payments and deliver the app via the App Store / Play Store. They receive only what their platform requires; we never see your payment card.
• Firebase (Google) — receives crash reports and push notification metadata.
• Railway — hosts our API server. No user data is stored on Railway permanently — it's the transit layer between the app and Supabase.

We do not sell your personal data to anyone. We don't use it for advertising. We don't share it with other riders.

4. Data retention

• Account + bike data: retained while your account is active, deleted within 30 days of account deletion.
• Booking / service records: retained for 5 years after the service date, as required by UAE consumer-protection law.
• Chat history: retained while your account is active. Deleted when you delete the chat session or your account.
• Odometer photos + readings: the photo blob is retained for 2 years (audit window for service-mileage disputes). The numeric reading on your bike record is retained for the life of the bike. Both are deleted within 30 days of account deletion (or sooner if you remove the bike).
• Ride content + RSVPs: retained while the ride exists in your history. Cancelled rides are soft-deleted after 90 days; attended rides are kept until you delete your account so your km log + badges remain accurate.
• Reports of harmful content: retained for 1 year so we can identify repeat violators, then anonymised.
• Subscription records: retained for 7 years after the last transaction, as required by UAE tax law.
• Crash logs: auto-deleted by Firebase after 90 days.

5. Your rights

You have the right to:

• Access the personal data we hold about you. Most of it is visible in the app under Profile and Garage; for anything else, email us.
• Correct data that's wrong. You can edit your profile and bikes directly in the app.
• Delete your account from Profile → Settings → Delete account. Some data may be retained for legal record-keeping (see retention).
• Export your data in a portable format. Email us and we'll send a JSON export within 30 days.
• Object to specific processing — for example, opting out of non-essential push notifications. Adjust these in Profile → Notifications.

6. Cookies + analytics

The forty5d.com website uses essential cookies for session management only. We do not use third-party advertising or analytics cookies. The app does not use cookies; it uses local secure storage for the session token.

7. Children

Forty5° is intended for riders aged 18 and over. We do not knowingly collect data from anyone under 18.

8. International transfers

Some of our vendors process data outside the UAE (Supabase EU, Anthropic US, Apple/Google US). When data leaves the UAE, we rely on the vendor's compliance with international data-protection frameworks (GDPR for EU vendors; SCCs for US vendors). You consent to these transfers when you use the Service.

9. Security

All data in transit uses TLS. Data at rest in Supabase is encrypted at the storage layer. We follow row-level-security best practices so riders can only see their own data — even our backend can't show one rider another rider's bikes or chat history without an explicit admin-tier credential.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Effective" date at the top of this page and notify you in-app for material changes. Continuing to use the Service after a change means you accept the updated policy.

11. Contact

Questions about your data? Reach us at contact@forty5d.com or visit the workshop in Dubai.