Privacy policy
The policy
1. Who controls your data
Vormkrijger, is the data controller for Host My Bike (https://www.hostmybike.com). For any privacy question or to exercise the rights below, contact us at admin at hostmybike.com.
2. What we collect, and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password, profile photo, bio, language | Create and run your account | Contract (Art. 6(1)(b)) |
| Parking spot address, exact + approximate coordinates | Show your listing on the map with a privacy-safe offset location | Contract |
| Messages sent to other members | Deliver conversations between hosts and guests | Contract |
| Login timestamp & IP address | Account security, fraud & abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Page views (with IP address masked) | Basic, aggregate usage statistics | Legitimate interest |
| Marketing email preference | Send optional product/marketing emails | Consent (Art. 6(1)(a)) — opt-in, revocable any time in your profile |
| Payment details (once paid membership is live) | Process your membership payment | Contract; handled by our payment processor, never stored on our servers |
3. Your exact address stays private
Your exact address is never published. It is stored securely, used only to compute an approximate map marker (randomly offset, so it can't be reverse-engineered to your door), and is shared with another member only when you explicitly send it inside a direct message.
4. Reports and safety reviews
If you or another member file a report about a conversation (for example, for harassment, a fake listing, or spam), our staff can view the messages exchanged between the reporter and the reported member, limited to the conversation the report concerns. This is necessary to verify the claim and decide what action, if any, to take — we can't fairly investigate a report without being able to see what was actually said. Our legal basis for this is legitimate interest (Art. 6(1)(f) GDPR): keeping the platform safe for everyone and enforcing our Community rules. Access is restricted to staff handling that report, every access is logged for accountability, and it is never used for any purpose beyond reviewing the report itself.
5. Who we share data with
- Our hosting provider, Easy Host, which stores the database and files on our behalf (a data processor, under contract) and to send account and notification emails.
- Stadia Maps, our geocoding provider, to turn addresses into map coordinates.
- Apple (APNs) and Google (FCM), only if you enable push notifications on a mobile device, solely to deliver those notifications.
- Law enforcement or regulators, only when legally required.
We do not sell your data, and we do not use advertising or tracking cookies.
6. How long we keep it
- Account data: for as long as your account is active, plus a limited period after you request deletion for legal/fraud-prevention record-keeping
- Messages: kept as part of the conversation history for both participants; if you delete your account, your messages remain visible to the other participant but are no longer linked to your identity.
- Page-view analytics: [retention period, e.g. 12 months], after which older rows are purged.
7. Your rights
Under the GDPR you have the right to:
- Access — see everything we hold about you. Use Download my data in your profile for an instant export, or email us.
- Rectification — correct inaccurate data any time from your profile page.
- Erasure — delete your account and personal data via Delete my account in your profile, or by emailing us.
- Restriction & objection — ask us to limit or stop certain processing.
- Portability — receive your data in a machine-readable format (the same export above is provided as JSON).
- Withdraw consent — turn off marketing emails any time from your profile, with no effect on your account itself.
- Lodge a complaint — with your national data protection authority. The Gegevensbeschermingsautoriteit / Autorité de protection des données, gegevensbeschermingsautoriteit.be
8. Security
Passwords are hashed (never stored in plain text), form submissions are protected against cross-site request forgery, and access to the admin panel is restricted to authorized staff. No system is 100% risk-free, but we take reasonable technical and organizational measures to protect your data.
9. Children
Host My Bike is not directed at children, and we don't knowingly collect data from anyone under 16.
10. Cookies
See our Cookies page for the full list of what we store and why.
Policy version 1.0.