Ovaj je dokument dostupan na talijanskom i engleskom jeziku. U nastavku je engleska verzija, koja je mjerodavan tekst.
Privacy policy
Version 1 · Last updated: 14 July 2026
1. Data controller
CrankPal S.r.l., with registered office at Via Benedetto Marcello, 6 – 20124 Milano, Tax Code/VAT No. 14801630964, PEC [email protected]. Email: [email protected].
2. Data we process
Depending on how you use CrankPal, we process: identification and contact data (name, email, telephone number, address); data relating to your bicycles and their maintenance; booking data and data on your interactions with workshops; website and app usage data (IP addresses, technical logs, device identifiers); subject to authorisation through your device permissions (iOS/Android), your location, in order to show you nearby workshops and record your rides; if you connect third-party services (e.g. Strava, Garmin), the data of your rides, including GPS tracks, necessary for predictive maintenance. If you are a workshop operator, we process the data described in § 5.
3. Purposes and legal bases
- Provision of the app service and management of the relationship (Art. 6(1)(b) GDPR — performance of the contract);
- Predictive maintenance and related features (Art. 6(1)(b) GDPR — performance of the contract);
- "Cranky" conversational AI assistant (answers about the app and its features, maintenance guidance, actions at your request and upon your confirmation): provision of the feature (Art. 6(1)(b) GDPR — performance of the contract); sample-based human review of conversations, in pseudonymised form, for quality and safety purposes (legitimate interest, Art. 6(1)(f) GDPR);
- Improvement of the predictive maintenance models and algorithms and of the AI assistance for workshops: we process usage data (rides/routes, component wear, maintenance work) in aggregated and anonymised form in order to develop, train and improve the algorithm and the quality of the service, including after termination of the account. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in improving a safety-relevant feature and in product development, as well as in facilitating your interactions with workshops (Art. 6(1)(f) GDPR); we have carried out the balancing assessments (LIA), available upon request. You have the right to object at any time (Art. 21 — see § 8). Once irreversibly anonymised, the data are no longer personal data (Recital 26 GDPR);
- Geolocation (searching for nearby workshops, recording rides): subject to consent collected through the iOS/Android system permissions (Art. 6(1)(a) GDPR), which may be withdrawn at any time from your device settings;
- Compliance with legal, accounting and tax obligations (Art. 6(1)(c) GDPR);
- Platform security and abuse prevention (legitimate interest, Art. 6(1)(f) GDPR);
- Service communications and, subject to your specific and revocable consent, promotional communications (Art. 6(1)(a) GDPR).
Providing your data is optional, but necessary in order to use the services offered by the app. In particular, the use of the messaging channels with workshops — with possible AI assistance (§ 4) — is not mandatory: you can always contact the workshop through alternative channels (telephone, in person), and your data will not be processed by means of AI. The "Cranky" AI assistant is likewise optional: the same operations always remain available through the app interface.
Workshop referral programme. Where a customer workshop invites another workshop, we process the email address of the invited workshop provided by the inviter for the sole purposes of delivering the invitation, attributing the referral and granting the related credits. Legal basis: the legitimate interest of CrankPal and of the inviting workshop in promoting the service (Art. 6(1)(f) GDPR) and, for the invited workshop that signs up, the performance of pre-contractual measures (Art. 6(1)(b) GDPR). The information required by Art. 14 GDPR is provided through this notice, referenced in the invitation email; the invited workshop may object at any time and stop receiving further invitations. Attribution relies on first-party technical cookies (see the Cookie Policy); the inviter and the invitee can each see only the status of the referral (invited, signed up, active), never each other's operational data. Invitations not followed by registration and attribution data are kept for the time needed to manage the programme and prevent abuse; granted credits follow the accounting retention terms.
4. Recipients
The data may be processed by suppliers appointed as processors pursuant to Art. 28 GDPR: hosting/cloud, email services, payment service providers, accounting and legal advisors. Affiliated workshops process the data of their own customers as independent controllers; for such data CrankPal acts as a processor under a data processing agreement (DPA). A workshop has access to your data only in one of the following cases:
- Registration workshop: it has access to your profile from the moment the account is created, if you registered through its website or your account was created at the counter;
- Workshops added to your favourites: they have access from the moment you add them from your personal area (an explicit act of consent, recorded with date/IP/device);
- Workshop invitations: a workshop may invite you by email/SMS or in-app notification. The invitation remains pending for a limited validity period, indicated in the invitation itself, and does not grant the workshop any access: access is granted only if you expressly accept the invitation within that period. If you decline the invitation or let it expire, no data is shared. Every invitation, acceptance, refusal and withdrawal is recorded with date, IP, device and the version of the terms in force, as evidence of consent.
Each workshop sees only the data created after the authorisation, in addition to the bicycle with its aggregated history. Interactions between you and a workshop are not visible to other workshops. You can withdraw access at any time from your personal area. The data are not sold to third parties.
Jobs subcontracted between workshops. If the workshop handling your bike entrusts a specific job to another workshop or repairer of the network (a subcontracted job), the latter only receives the technical data needed for the work (bike make, model and components, serial number, description of the issue, photographs, diagnosis) — never your name or contact details. The recipient processes such data as an autonomous controller, for the sole purpose of performing the work, and is contractually prohibited from attempting to identify or contact you.
AI assistance in conversations with workshops. If the workshop you are communicating with has enabled the AI assistance features, the text of the messages in the conversation (stripped of email signatures and quoted text) is transmitted to Anthropic, PBC (United States), appointed as a sub-processor, in order to generate summaries, draft replies and classifications (intent, urgency, sentiment) for the benefit of the workshop. We do not transmit your profile data (name, email, telephone number); however, the free text of the messages is not anonymised and may contain the personal data you write in it: we encourage you not to include unnecessary data in your messages (e.g. health or financial data). Under the contractual commitments in place between CrankPal and the supplier, the content is not used to train the supplier's models and is retained only for the time strictly necessary for processing; should these conditions change, we will update this privacy policy. Providing data through the messaging channels is optional (see § 3).
"Cranky" AI assistant. If you use the conversational assistant, the chat text, the page context and the account data needed for the reply (e.g. bicycles, service history, appointments) are transmitted to Anthropic, PBC (United States), appointed as a processor. Under the contractual commitments in place, the content is not used to train the provider's models and is retained by the provider only for the time strictly necessary for processing. Conversations are retained by CrankPal for 90 days (§ 7); a sample may be reviewed by authorised staff, in pseudonymised form, for quality and safety purposes. If you ask for human support, the conversation is shared with the support team only with your consent. We encourage you not to include unnecessary data in the chat (e.g. health or financial data). The assistant does not make decisions with legal effects based solely on automated processing: actions are executed only upon your confirmation.
5. Workshop operators
If you use the CrankPal management system as a workshop operator (owner, manager, mechanic), we process your data (name, email, telephone number, role, credentials, access and activity logs, clock-in/clock-out records and working times) for two distinct purposes: (a) on behalf of your employer, as a processor within the meaning of Art. 28 GDPR — the workshop remains the controller; (b) for CrankPal's own purposes (security, abuse prevention, product improvement in aggregated form) as an independent controller (legitimate interest, Art. 6(1)(f) GDPR). The rights set out in § 7 also apply to you; for the processing referred to under (a), we will forward your request to your workshop.
Management system session recording. To provide support and improve the product, operators' use of the management system may be recorded in masked form by means of a session replay tool hosted on CrankPal's own infrastructure (not a third-party provider). Masking is enabled by default: the text and values of input fields, email addresses and numbers (telephone numbers, cards, IBANs) are obscured, and passwords are never captured. This feature can be disabled for an individual workshop on request to Customer Support.
6. Transfers outside the EU
Where a supplier processes data outside the European Economic Area, the transfer takes place on the basis of appropriate safeguards (e.g. the EU Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework). This is the case, in particular, of Anthropic, PBC (United States) for the AI assistance features (§ 3 and § 4).
7. Retention
We retain the data for the time necessary for the purposes indicated and, for accounting/tax data, for the periods required by law (as a rule, 10 years). Account data is deleted or anonymised upon request, without prejudice to retention obligations. Usage data intended for improving the algorithm is rendered anonymous or aggregated within a defined period and, once irreversibly anonymised, no longer constituting personal data (Recital 26 GDPR), may be retained and used without time limits, including after the deletion of the account or unsubscription. Conversations with the "Cranky" AI assistant are retained for 90 days from the last interaction and then deleted; the related technical logs are kept in pseudonymised form.
8. Your rights
Pursuant to Arts. 15-22 GDPR you have the right of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw any consent given. In particular, for processing based on legitimate interest — including the improvement of the predictive algorithm (§ 3) — you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR), by writing to [email protected] or from your settings; objecting does not affect data that has already been anonymised or aggregated. From the app/your personal area you can export your data and delete your account yourself. For any other requests, write to [email protected] (reply within 30 days). You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
9. Cookies and similar technologies
The website uses first-party technical cookies (e.g. storing your selected region), which are always active, and first-party measurement tools based on identifiers stored in your browser, activated only with your consent through the banner; we do not use third-party profiling cookies. Full details, including durations, purposes and preference management, are set out in the Cookie Policy.
10. Changes
We may update this privacy policy; material changes will be communicated through the website or the app.