Privacy policy

We collect only what is necessary to operate the service: account credentials, bookings, payment details, communications with shops, and limited technical data. We do not sell personal data, and we do not run third-party advertising on the platform.

RadMoo is operated from Berlin, Germany. For the purposes of the GDPR, RadMoo acts as the data controller for personal data collected through the platform.

You can reach our data protection point of contact at contact@radmoo.de.

We process the following categories of personal data:

• Account data. Name, email, hashed password (or Google account identifier when signing in via Google).
• Booking data. Bikes you register (with photos), issue descriptions, pickup addresses, status history, quotes, and order codes.
• Payment metadata. Payment method tokens, transaction IDs, and invoice information. Full card numbers never touch our servers — they are tokenised by Stripe.
• Location data. Coordinates of shops (provided by the shop) and pickup addresses you enter for SOS bookings.
• Communication data. Messages, status notes, and support emails.
• Technical data. IP address, browser and device information, session identifiers, and pages visited.

We use personal data to:

• Provide and operate the service (account, bookings, status updates).
• Process payments and issue invoices.
• Coordinate pickup, delivery, and repair with partner shops.
• Respond to support requests and improve the product.
• Comply with our legal obligations (tax, accounting, fraud prevention).

We process personal data under the following GDPR bases:

• Performance of a contract (Art. 6(1)(b)) — to deliver the booking and subscription you signed up for.
• Legitimate interests (Art. 6(1)(f)) — to keep the platform secure, prevent fraud, and improve the service.
• Consent (Art. 6(1)(a)) — for non-essential cookies and marketing emails. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to keep tax and accounting records as required by German law.

We share the minimum data necessary with the following processors:

• Stripe — payments and subscription billing.
• Cloudinary — secure storage of bike photos.
• MongoDB Atlas — primary application database.
• Google — optional sign-in (only when you choose it), and Google Analytics for page-view statistics (only if you enable analytics cookies).
• Partner workshops — your name, contact details, bike information, and the booking-specific details needed to perform the repair.

We have data-processing agreements in place with each processor. We do not sell personal data and do not share it with third parties for advertising.

Account and booking data is retained while your account is active and for up to 24 months after deletion, after which it is purged (except where longer retention is required for accounting and tax law — typically 10 years in Germany).

Server access logs are kept for up to 30 days for security purposes.

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (where no overriding legal obligation applies).
• Restrict or object to processing.
• Port your data to another provider.
• Withdraw consent for non-essential processing at any time.
• Lodge a complaint with your local supervisory authority — for users in Berlin, the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

To exercise any of these rights, email contact@radmoo.de. We respond within 30 days.

We use TLS encryption in transit, encrypted storage at rest, industry-standard password hashing, and role-based access controls. Despite our efforts, no system is perfectly secure — if you suspect your account has been compromised, contact us immediately.

Some of our processors (e.g. Stripe) operate infrastructure outside the European Economic Area. Where this is the case we rely on the European Commission’s Standard Contractual Clauses or adequacy decisions to ensure your data remains protected.

RadMoo is not designed for children under 16. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us so we can remove it.

Questions, requests, or complaints? contact@radmoo.de.

See also our Terms of Service and Cookie Policy.