Privacy Policy

Who this covers

This policy explains what the BYKKO Service platform records about the people who use it, why, and what happens to it. It covers staff, contractors and client contacts who sign in.

What is collected

Your account

• Your name and email address, and a photograph if you choose to add one.
• Your password, stored only as an argon2id hash. It cannot be read or recovered by anyone, including us - a forgotten password is reset, never looked up.
• The role and the sites you have been given access to.

Signing in

• The date and time of each sign-in, successful or not, and the IP address and browser it came from.
• Devices you have chosen to remember, so you are not emailed a link every time.

The work itself

• Jobs, checklists, faults, repairs and parts, with the account that recorded each one and when.
• Check-in and check-out times. These are used to calculate what a client is billed, so changes to them are recorded with the previous value.
• Photographs taken against a job, a bike or a fault.
• Bikes, stations and their locations. Station coordinates are the site's, not a person's - the platform does not track anyone's location.

Why it is collected

To run the servicing operation and to bill for it: to show a technician what to do, to record what was done, to work out what a client owes, and to answer questions about a job afterwards. Sign-in records exist to keep accounts secure and to make the audit trail meaningful.

None of it is used for advertising or profiling, and none of it is sold.

Cookies and what is stored in your browser

• A session cookie, which is what keeps you signed in. The platform does not work without it.
• A language cookie, set only if you choose a language before signing in.
• Your theme and text-size preference, kept in your browser's local storage so the app looks the same next time. It never leaves your device.

There are no analytics, advertising or tracking cookies of any kind.

Who else sees it

Each operator's records are kept separate from every other operator's inside the database, and staff only see the sites their role covers.

The platform relies on a small number of services to work:

• Amazon Web Services hosts the application and the database, in the Sydney region.
• Amazon Simple Email Service delivers sign-in links, invitations and password resets. It handles your email address and the contents of those messages.
• Your accounting software, when an invoice is pushed to it. Only invoice data goes across, and only when somebody chooses to send it.

Beyond that, information is disclosed only where the law requires it.

Where it is kept

In Australia, on servers in the AWS Sydney region. Backups are encrypted and are also held in Australia.

How long it is kept

• Service and invoice records are kept for as long as they may be needed for the operation and for tax and accounting purposes.
• Photographs are kept until somebody deletes them.
• Sign-in and audit records are kept so that questions about past work and past access can be answered.
• Closing your account does not delete the work you recorded, because that work belongs to the service history.

How it is protected

• All traffic is encrypted in transit.
• Passwords are hashed with argon2id and are never stored in a readable form.
• Signing in needs both a password and a link sent to your email address.
• Separation between operators is enforced by the database itself, not only by the application.
• Access is limited by role, and administrators cannot set a password on your behalf - they can only send an invitation.

Your rights

You can ask what is held about you, ask for it to be corrected, and ask for a copy. Ask your usual BYKKO contact. If you are not satisfied with how a request is handled you can complain to the Office of the Australian Information Commissioner.

Some information cannot simply be erased on request, because it forms part of a billing or service record that has to be kept.

Children

The platform is a work tool and is not intended for anyone under 16.

Changes

If this policy changes, the revised version appears at this address with a new date at the top.

Contact

Questions about this policy, or about the information held about you, should go to your usual BYKKO contact.