1. Who We Are
We are TurnComms LTD, a UK-based business that provides AI-generated bicycle pricing and valuation reports based on user-entered bicycle details. We are the controller of the personal data described in this policy.
TurnComms LTD is registered in England and Wales, company number 15691570. Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. You can contact us at info@turncomms.com.
2. What Data We Collect and Store
We only store minimal data necessary for rate limiting and service operation. Specifically, we store:
- IP Address: Your IP address for rate limiting purposes.
- Hashed GPS Coordinates: If you provide location access, we store a privacy-preserving hash of your approximate location (reduced to ~100m precision).
- Request Timestamp: When you requested a valuation for rate limiting tracking.
- Basic Bicycle Information: Only the brand, model, and year you submit.
- Valuation Type: Whether you requested a basic or premium report.
- Payment Records: If you buy a premium report, we keep a short record of the purchase: Stripe's reference numbers for the payment, the date and time, and whether your report was delivered (with a short error code if it was not). It does not include your name, email address, IP address, address or card details. We use it to confirm your payment and to resolve any problem or dispute about your report. Stripe, which processes the payment, holds the full payment details, including the bicycle you entered and the country it was valued for, under its own privacy policy.
Data Retention: All of the above is deleted automatically on a fixed schedule. See section 7 for the retention periods.
Market data (not personal data): To give everyone asking about the same bike on the same day the same answer, we keep the public listing data found for each bike, year and country (listing titles, prices, sellers and links) for up to 7 days, together with any AI-written report text for it. We also keep original retail prices once found, as they are public facts. None of this is linked to you: your browser's session cookie only holds a reference to the result you looked at, and it is deleted when you close your browser.
What We Do NOT Store: Card and bank details are handled entirely by Stripe and never reach us. We do not collect names, emails or other contact details.
3. How Your Data Is Used
We use your data to:
- Calculate valuations from public listing data for the bike and country you choose, and produce the full report if you buy one.
- Prevent abuse of the free service (rate limiting).
- Improve the functionality and performance of the Website.
- Process payments via Stripe (we do not access card or bank details).
We use Stripe for payment, analytics, and other business services. Stripe collects identifying information about the devices that connect to its services. Stripe uses this information to operate and improve the services it provides to us, including for fraud detection. You can learn more about Stripe and read its privacy policy at https://stripe.com/privacy.
4. Use of Artificial Intelligence (AI)
Valuations are calculated by our own code from listing prices; AI does not set them. For the full report we use OpenAI for two tasks: an AI-assisted web search for the bike's original retail price (shown only with its source), and writing the report's summary and listing text, with every figure filled in by our code.
For these tasks OpenAI receives only the bike's brand, model, year and condition and the country you chose. It does not receive your IP address, location, payment details or any listing data. OpenAI processes this under its own terms and privacy policy.
5. Lawful Basis for Processing (UK GDPR)
We process your data under:
- Legitimate Interest: To provide and improve the bicycle valuation service.
- Consent: For optional analytics cookies and data collected via tracking technologies.
6. Third-Party Services and International Transfers
- Stripe: Payment processing is handled entirely by Stripe. Data may be transferred outside the UK or EEA. Stripe uses Standard Contractual Clauses (SCCs) and other safeguards to ensure GDPR compliance. See Stripe's Privacy Policy for more.
- OpenAI: Receives the bike details and country for the tasks described in section 4. No personal data is included.
- SerpAPI: Runs the Google Shopping search for your bike in your country. It receives the search (brand, model, year) and the country only, not your IP address or any personal data.
- Vercel and Supabase: Host the website and our database in London, United Kingdom (see section 9).
- Google Analytics: Only if you accept analytics cookies (see our Cookies Policy).
- OpenStreetMap (Nominatim): If you allow your browser to share your location, your approximate coordinates are sent to OpenStreetMap's service to find your country. They are not stored by us; we keep only a privacy-preserving hash for rate limiting (section 2).
- jsDelivr: Serves the country flag images in the region picker. Like any web server, it receives your browser's IP address when the image loads.
7. Data Retention
We keep personal data only for as long as we need it, and delete it automatically:
- Rate limiting records (IP address, hashed approximate location, request time, bicycle brand, model and year, valuation type): deleted after 30 days.
- Payment records (Stripe references, dates and report status): deleted after 180 days, which covers the period in which a card payment can normally be disputed. We create no record at all for checkouts that are not completed. Stripe keeps its own record of each transaction under its privacy policy, including to meet financial and legal obligations.
- Market data (public listing data and AI-written report text, not linked to you): deleted after 7 days.
- Original retail prices (public facts, not linked to you): kept; unsuccessful lookups are cleared after 30 days so they can be retried.
- Your valuation results: your browser's session cookie holds a reference to them until you close your browser.
No customer accounts or long-term profiles are created.
8. Your Rights
Under the UK General Data Protection Regulation (GDPR), you have the right to:
- Access the data we hold about you
- Request correction or deletion of your data
- Withdraw consent for optional data uses
To exercise your rights, contact us at: info@turncomms.com
9. Hosting and Cross-Border Data
Our Website runs on Vercel and our database on Supabase, both hosted in London, United Kingdom. The data we store, as described in section 2, is held in the UK.
Some services we rely on, such as Stripe and OpenAI (see section 6), may process data outside the UK. Where they do, we ensure the transfer meets UK GDPR requirements.
10. Contact
If you have questions or concerns about this policy, please email us at: info@turncomms.com