Bike Fit Studio: Data processing agreement

Version 1

Effective: 9 October 2026

This agreement is between each studio that uses Bike Fit Studio ("the studio") and Montis.icu ("Montis"), operated by Clive King from the Canton of Vaud, Switzerland, reachable through the Bike Fit Studio contact page. The studio is the controller: it decides why and how its clients' data is used. Montis is the processor: it handles that data only for the studio. This agreement is part of the supplemental terms. The studio's owner accepts both once, by a tick in bikefit the first time they open the studio, and bikefit records who accepted, which version and when. It sets out what Article 28(3) of the GDPR and Article 9 of the Swiss Federal Act on Data Protection (FADP) require. For clients' data, it takes precedence over the terms.

1. Subject and duration

Montis processes personal data for the studio to provide Bike Fit Studio. This agreement lasts as long as the studio uses Bike Fit Studio, and until its data is returned or deleted (section 10).

2. Nature and purpose

Hosting and storing the studio's records; showing them to its team and, for finished fits, to the client in My fits; offering free times online and letting clients book, change and cancel online; sending the studio's emails to its clients, such as booking confirmations, reminders and a link to a finished fit; passing on messages from the studio's contact page to the studio by email; running the AI check and speech when the studio's team uses them; keeping it secure; and support.

3. Data and data subjects

• Clients: name, email, phone, sex, date of birth, language, how they heard of the studio and the record of their consent; riding history; goals, injuries, earlier fits and notes; their bikes; measurements, findings including pain, adjustments, feedback including a pain map; audio clips and transcripts; videos of them riding; AI check results, and what each check sent to the AI provider and got back, kept with the fit for support and deleted with it; a log of the emails sent to them. Health details are sensitive data, which the law protects more strictly (a special category under the GDPR).
• People who book: name, email, phone, reason, notes, the agreed terms, time and fitter; a coded form of their network for about a day.
• People who write to the studio through its contact page: name, email, subject and message. Montis passes the message on to the studio by email, with the sender's email as the reply address, and does not keep it. It keeps only a line in the email log, with a fixed subject: the address it went to, when, and whether it was sent.
• The studio's team: working hours, time off, and a fitter's own calendar if connected. Team members' sign-in accounts and roles are Montis's own, as the privacy notice says.

4. The studio's instructions

The supplemental terms, this agreement, and what the studio sets and does in the app are the studio's instructions. Montis processes the data only as instructed, unless the law requires otherwise; then Montis tells the studio first, unless the law forbids it. Montis tells the studio if it believes an instruction breaks data protection law. Montis's platform admins can open and change any studio's records and settings, but only to run, support and secure Bike Fit Studio, at the studio's request, or where the law requires it. Montis does not sell the data or use it for advertising or to train AI models.

The studio allows one use as Montis's own, as the privacy notice says: when a client signs in with Montis, Montis records their Intervals.icu athlete id and links it to the client records studios hold under the same email; the studio's team sees the id on the client's page. For that link Montis is a controller, not the studio's processor. My fits finds a client's finished fits by the email that Montis or an emailed sign-in link proves.

5. Confidentiality

Everyone Montis lets access the data is bound to keep it confidential.

6. Security

Montis keeps at least these measures, and may improve them but will not lower their overall level:

• HTTPS for every connection to Bike Fit Studio, and for its calls to other services;
• each studio's records marked as its own in a shared database, and access checked on the server for every page, form and file, by role;
• studios' AI keys encrypted (AES-GCM) and shown only by their last four characters; fitters' calendar addresses, and the events read from them, encrypted the same way, each address shown only by its host and last few characters;
• sign-in links stored only as hashes, working once;
• audio clips and videos in private storage, served only to signed-in users with access to the studio, except that a phone a fitter links to a fit as a camera, by a code shown on the fit, gets that fit's earlier video from the same side to line up its picture with;
• camera links stored only as hashes, each for one fit and one view, sending videos only into that fit, and working for at most 4 hours or until the fitter disconnects them (a video recorded before then may still be sent within the hour after);
• every change a person makes sent as a form, never by a plain link, and checked to come from bikefit itself, so other websites cannot make changes in a user's name;
• a robot check (Cloudflare Turnstile) and daily limits on the booking page and the contact pages;
• a log of who changed what;
• database backups for up to 30 days (Cloudflare D1 Time Travel).

7. Sub-processors

The studio allows Montis to use these sub-processors. Montis binds each by contract to data protection duties that protect the data at least as well as this agreement, and stays fully responsible to the studio for them. Where Montis's own AI account is used, the provider's terms limit its use of the data: Google and OpenAI do not use it to improve their products or services, and Anthropic does not train models on it. Each may keep prompts and answers for a time to check for misuse, as the table says. Montis uses only the providers' paid API services.

The studio picks which provider runs its AI check: Google (Gemini), OpenAI or Anthropic. Speech always uses Google (Gemini). When the studio uses its own key with an AI provider, or its own Stripe account in future, that provider works for the studio under the studio's own agreement. It is not Montis's sub-processor.

Montis tells the studio at least 30 days before it adds or replaces a sub-processor, by email to the studio's owners. The studio may object for good reason. If they cannot agree, the studio may end its use before the change.

8. Transfers

Data moves freely between Switzerland and the European Economic Area under the European Commission's adequacy decision for Switzerland and Switzerland's own list of adequate countries. The studio allows the transfers to the sub-processors above. Transfers to the United States rely on the EU-US and Swiss-US Data Privacy Framework where the company receiving the data is certified under it, such as Google LLC and, where certified, Cloudflare. Other transfers outside Switzerland and the European Economic Area, such as those by OpenAI and Anthropic, rely on the standard contractual clauses in the provider's terms.

9. Help with rights, security and breaches

• Rights requests: Montis passes on any request it receives about the studio's data and helps the studio find, export, correct or delete the records. The studio exports and deletes a client's data itself, in the app: Export gives one file with the client's records, bookings, email log lines and change log entries, with each spoken clip and video listed and linked for the studio's team, who download the recordings from those links to pass them on; Delete for good deletes the client and everything about them, including their clips, videos and their entries in the change log. Bookings made online under the same email in another person's name are that person's and stay. Clients send such requests to the studio through its contact page or its emails. A booking with no fit, such as one made online by someone who is not a client, the studio deletes for good in Bookings; Montis exports such bookings on the studio's request. Deleted data leaves the backups within 30 days.
• Security and assessments: Montis gives the studio the information it needs for its own security measures, impact assessments and consultations with an authority.
• Breaches: Montis tells the studio without undue delay after it becomes aware of a breach affecting the studio's data (Article 33(2) GDPR; Article 24 FADP). It says what it knows and helps the studio respond.

10. At the end

When the studio's use ends, Montis gives the studio an export of its data if it asks within 30 days. After those 30 days (or sooner, if the studio asks), Montis deletes the data, including the change log and copies. Deleted data leaves the backups within a further 30 days. Montis keeps only what the law requires it to keep.

11. Information and audits

Montis gives the studio the information it needs to show this agreement is kept. It allows audits by the studio or an auditor it appoints, bound to confidentiality, with reasonable notice and at the studio's cost.

12. Other terms and contact

Liability, law and courts are as in the supplemental terms. Changes to this agreement work as the terms say: Montis announces an important change at least 30 days ahead, by email to the studio's owners, and using Bike Fit Studio after that counts as accepting it. The rights of clients and other people whose data this is are not affected. The studio reaches Montis through the Bike Fit Studio contact page. Montis reaches the studio by email to its owners.