What bike.tools keeps, and who sees it

A shop's data is the shop's

Each shop's data is kept apart from every other shop's and is only ever used for that shop. We don't sell it, rent it, use it for advertising, or combine shops' data for research or for training models.

What we keep

• Accounts: staff names and email addresses, the shops they belong to and their access. Passwords are stored only as salted hashes; sign-in codes only as a keyed hash.
• The shop's own bike.tools data: settings, services, schedules, bookings, presets, workorder photos and status links.
• A copy of the shop's Lightspeed data: workorders (with their lines and, unless the shop turns it off, internal notes), customers, bikes, items and stock, employees and, with the shop's permission, time clock hours. It's what makes status pages, search, reports and the AI tools fast without asking Lightspeed every time. Lightspeed access tokens are stored encrypted.
• Riders: what they type when they book (name, email, phone, their bike and what it needs).
• AI usage: for each AI request, the model, the number of tokens and its cost, and who asked. Not the conversation itself: chats with the Shop Assistant aren't stored after the answer.

How long we keep it

• The copy of a shop's Lightspeed data is kept for 60 days after we last read each record, unless the shop's owner chooses, when connecting Lightspeed or later under Settings → Lightspeed, to keep its full history. They can change that at any time; turning it off deletes anything older than 60 days within the hour.
• When a shop disconnects Lightspeed, we revoke our access and delete the copy of its Lightspeed data straight away. The shop's own bike.tools data (bookings, services, settings) stays until the shop asks us to delete it.
• When a shop is deleted, everything belonging to it is deleted.

Who we share it with

Only the services bike.tools runs on, and only what each needs:

• Lightspeed, the shop's own point of sale, which we read from and, when staff ask, write workorders and customers to.
• Cloudflare hosts bike.tools, its database, files and email, and runs its AI models (Workers AI). With a shop's AI add-on, what staff type and the records the AI reads to answer (workorders, customers' names, bikes, items, and internal notes if the shop allows it) are sent to Workers AI to get an answer. Under Cloudflare's terms, it isn't used to train models.
• Stripe bills the add-ons. We never see card numbers.
• Bike Archive answers bike searches. It gets the words searched, never who searched them.

The Chrome extension

bike.tools for Lightspeed reads the Lightspeed page you have open (which workorder, customer or item it is, and the name of the employee logged in) to show its tools and to tell bike.tools which records to refresh. It talks only to bike.tools, with your bike.tools sign-in. It doesn't read other sites or your browsing history.

Riders

A rider's details are kept by the shop they booked with and shown only to that shop and to the rider. To see, correct or delete them, ask the shop; they can do it, or ask us to.

Keeping it safe

Everything travels over HTTPS. Tokens and links that open private pages are stored only as hashes, or encrypted where staff need to see them again. Staff access comes from each shop's own settings. If we ever find that someone got at data they shouldn't have, we'll tell the shops affected.

Questions

Email help@bike.tools. We'll answer, and delete or hand over a shop's data when its owner asks.

Last changed 31 October 2026.