Legal
Privacy policy
This policy explains what personal data BikeStudio collects, why, who can see it and how long we keep it. It applies to the BikeStudio rider app, the partner app for workshops and the website bikestudio.io.
1. Who we are
BikeStudio is operated by sooko.io, Indonesia (“we”, “us”). We are the controller of the personal data described here. Contact: sookoio01@gmail.com.
2. What we collect
Riders
- Phone number, used to sign you in with a one-time code sent by WhatsApp or SMS. You can use the map without signing in.
- Name (optional), shown to workshops you message and next to your reviews.
- Saved workshops, reviews (rating and text) and chat messages you send.
- Location: approximate or precise device location, only while the map is open and only if you grant permission. It is used to centre the map and sort workshops by distance. We do not keep a location history.
- Device and browser information: browser type, operating system, app version, IP address and language, from ordinary server logs.
- Usage events: which workshop profiles you open and taps on Call, WhatsApp, Directions and Chat. They are counted per workshop so the workshop can see how many riders reached it. They are not used for advertising.
- Push notification subscription, only if you turn notifications on.
Workshop owners
- Phone number for sign-in and so riders can call you; a WhatsApp number if you add one.
- Workshop name, address, map coordinates, opening hours, brands serviced, description and photos. This is your public profile.
- Serial numbers of the BikeStudio tools you register (YDIAG Pro, HDIAG Pro, AFR meter). We check them against our sales records to verify the workshop.
- Certificate number, partner tier and partner-since date assigned on approval; a photo of the installed signboard if you upload one.
- Chat messages exchanged with riders.
- Statistics: profile views and Call, Directions and Chat taps for your workshop.
Everyone
Server logs with IP address, request time and URL, kept for security and debugging.
3. Why we use it
- To provide the service: show workshops on a map, sign you in, deliver chat, keep your saved workshops.
- To verify workshops: match tool serial numbers to sales records, issue certificates and decide on approval.
- Safety and fraud prevention: detect abusive accounts, duplicate serial claims and spam in chat or reviews.
- Support: answer your questions and resolve disputes about reviews or verification.
- Improving the service: aggregate usage numbers only, never individual profiles for advertising.
4. Legal basis
We process personal data under Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, “UU PDP”) on these bases:
- Performance of a contract with you (Art. 20(2)(b)): account, profile, chat, verification, statistics.
- Your consent (Art. 20(2)(a)): device location, push notifications, optional name, photos. You can withdraw consent at any time; the service keeps working without those features.
- Legitimate interest (Art. 20(2)(f)): security logs, fraud prevention, aggregate statistics.
- Legal obligation (Art. 20(2)(c)): when a law or a lawful order requires us to keep or disclose data.
5. Location and notifications
The browser or app asks for location only when you open the map or tap “near me”. Approximate or precise is your choice in the device settings. The position is sent to our server only to compute the nearby list; it is not written to your account.
Push notifications are used only for chat replies and verification status updates. Turn them off in the app or in the device settings; we then delete the subscription.
7. How long we keep it
| Data | Kept |
|---|---|
| Account and profile | Until you delete the account |
| Chat messages | 24 months after sending, then deleted |
| One-time codes | 5 minutes, stored hashed |
| Location sent for “nearby” | Not stored |
| Usage events | 24 months as events, then per-workshop totals only |
| Server logs | 30 days |
| Backups | 14 days; deleted data leaves backups within 14 days |
| Tool serial and certificate records | Stay in our sales records; the link to your account is removed when the workshop leaves |
8. Your rights
Under UU PDP you can ask for a copy of your data, have it corrected or deleted, withdraw consent, object to processing and complain to the Indonesian data protection authority.
- Delete your account in the app under Account → Delete account. This removes your profile, phone number, saved workshops, push subscriptions, reviews and chat conversations. For a workshop it also removes the public profile and unlinks the serial numbers.
- Everything else: write to sookoio01@gmail.com with the subject “Privacy”. We answer within 14 days and may ask you to confirm the request from your phone number.
- Location: withdraw the permission in the device settings (Android: Settings → Apps → BikeStudio → Permissions; iOS: Settings → Privacy → Location Services; browser: site settings).
9. Security
- TLS on every connection between your device and our servers.
- One-time codes are stored hashed, expire after 5 minutes and are limited to 5 attempts.
- Role-based access: a workshop owner can edit only their own workshop; administrative access is limited to named sooko.io staff.
- Encrypted daily backups kept for 14 days.
- If a breach affects your data we notify you and the authority within 3×24 hours, as UU PDP requires.
10. Children
BikeStudio is not intended for people under 17. We do not knowingly collect their data. If you believe we have, write to us and we will delete it.
11. Changes
We publish new versions on this page with a new effective date. Material changes are announced in the app before they take effect. Using BikeStudio after that date means the new version applies.
12. Contact
sooko.io / BikeStudio, Indonesia. Email: sookoio01@gmail.com. Subject line “Privacy”.