Privacy

Bike Fit Studio: Supplemental privacy notice

Version 1

Effective: 9 October 2026

This supplemental privacy notice adds to Montis's Privacy Policy for Bike Fit Studio ("bikefit"), at bikefit.montis.icu. Where they differ, this notice applies to Bike Fit Studio. Montis's policy still covers signing in with Montis, connecting Intervals.icu and Montis in general. Read this notice with the supplemental terms.

Who is responsible

Each studio is responsible (the controller) for its clients' data: client records, fits, bookings, messages sent through its contact page and its team's working data. Montis handles that data for the studio, as its processor, under the data processing agreement. Reach the studio through its own pages, including its contact page, by replying to its emails, or through the privacy page in its footer, if it has one.
Montis is responsible (the controller) for studio team accounts, sign-in to Bike Fit Studio and My fits, linking a client's Montis sign-in (their Intervals.icu athlete id) to the client records studios hold under the same email, messages sent through the Bike Fit Studio contact page, and its own logs. Montis.icu is operated by Clive King from the Canton of Vaud, Switzerland. Reach Montis through the Bike Fit Studio contact page.

What data, why and for how long

The legal bases below (the legal reasons for using the data) use the GDPR's terms; Montis follows the same approach under the Swiss Federal Act on Data Protection (FADP). For the studio's data, the studio decides its own bases; the usual ones are shown.

Data	Why	Legal basis	How long
Studio team accounts (Montis): Intervals.icu athlete id, name, email, language, when last seen; roles and invites; for a studio's owner, when they accepted the terms and which version	To sign in and to give each person the right access; to show which terms the studio accepted	Contract (Montis's Terms); legitimate interests in running bikefit for the studio	While the account or role exists; deleted on request. An owner's acceptance of the terms stays in the log of who changed what
Client sign-in (Montis): email, one-time sign-in link, session; a log of the sign-in emails sent (recipient, subject, status, not the text); for a client who signs in with Montis, their Intervals.icu athlete id, linked to the client records studios hold under the same email (those studios' teams see the id on the client's page)	To let clients see My fits; to keep one identity for a client across studios and Montis	Contract, at the client's request; legitimate interests for the link	A link works once within 48 hours; a session lasts 30 days. Old links and sessions and the email log go when a studio deletes the client for good and no other studio still has their email. The athlete id goes with the last client record linked to it, unless anything else in Bike Fit Studio still names the person: a role in a studio, or, for someone who has been on a studio's team, the fits and bookings they did, the consents they recorded or the changes they made, whose records keep who did them. Otherwise they are not yet removed automatically; Montis deletes them on request
Logs (Montis): page address (which can include a search typed by the team, such as a client's name), status and timing; Cloudflare's request logs, which include IP addresses	Security, fixing faults, preventing abuse	Legitimate interests	Up to 7 days in bikefit's own logs; Cloudflare keeps its network logs as its own privacy policy says
Clients and fits (studio): name, email, phone, sex, date of birth, language, riding history, how they heard of the studio; goals, injuries, earlier fits and notes; measurements, findings including pain, adjustments, feedback including a pain map; audio clips and transcripts if speech is recorded; videos of them riding if recorded; AI check results; a log of the emails sent to them (recipient, subject, status, not the text)	To carry out and record the fit, and to email the client their setup when it is finished	Contract with the client; for health details, the client's explicit consent, which the studio obtains; when the client is added, bikefit records that the studio has their consent, who recorded it and to which wording	As the studio decides; see below
Bookings (studio): name, email, phone, reason, notes, the agreed change and cancellation terms, time and fitter; a log of the emails sent (recipient, subject, status, not the text)	To book, remind, move or cancel	Contract with the client	As the studio decides; see below
Booking protection (studio): a coded form of the visitor's network, never the IP address itself	To limit bookings per network and stop abuse	Legitimate interests	About a day
Team working data (studio): working hours, time off, and a fitter's own calendar if connected	To offer free times	Contract; legitimate interests	Until changed; calendar events for 60 days ahead, refreshed each time
Messages to a studio (studio): through the studio's contact page, the sender's name, email, subject and message, emailed to the studio's own address with the sender's name and email as the reply address; a line in the email log: the address it went to, the studio, the time, whether it was sent and a fixed subject, not the one typed	To pass the message on, so the studio can answer; the log line also counts the day's messages for the daily limit, and Cloudflare briefly uses the sender's network to limit messages a minute	Legitimate interests in answering; steps before a contract, when the person asks about a fit or a booking	Bike Fit Studio does not keep the message; the studio keeps the email as it decides. The log line is not yet removed automatically; Montis deletes it on request
Messages to Montis (Montis): through the Bike Fit Studio contact page, the same details, emailed to Montis with the sender's name and email as the reply address; a line in the email log, as above	To answer questions about Bike Fit Studio, its terms and your data	Legitimate interests in answering; when you use your rights, Montis's legal duty to answer	Bike Fit Studio does not keep the message; Montis keeps the email only as long as it needs to answer and follow up. The log line is not yet removed automatically; Montis deletes it on request

Bike Fit Studio does not yet delete client or booking records automatically. Removing a client only hides the record and their bikes; it stays, with their fits, clips, videos and bookings, until the studio deletes it. The studio exports and deletes its clients' data itself, in the app: Export gives one file with a client's records, fits (with the fit details each AI check sent and the answer it got back), bookings, the emails logged about them, their requests about their data and their entries in the log of who changed what; spoken clips and videos are listed in it with a link only the studio's team can open, and the studio downloads the recordings from those links to send them with the file. Delete for good deletes the client and everything about them, including their fits, clips and videos, their bookings (also those made online under their email in their name), the emails logged about them and their entries in the log of who changed what; only a line that a client was deleted, by whom and when, stays. Bookings made online under the same email in someone else's name, and the emails about them, are that person's and stay. Bookings made online by someone who is not a client can't yet be exported or deleted in the app; Montis exports or deletes them when the studio asks. When no other studio still has the client's email, their sign-in links, sessions and the log of their sign-in emails go too. Bike Fit Studio also keeps a log of who changed what, with the details changed; its entries stay after a record is only removed. Deleted data leaves Cloudflare's database backups within 30 days.

A client asks a studio for a copy of their data, or to delete it, through the studio's contact page or its emails, as its privacy notice says; the studio is responsible for the request, answers it and does what was asked in the app.

Bike Fit Studio does not sell personal data, show advertising, use analytics or tracking, or use client data to train AI models.

Montis gets a team member's name and email, or athlete id, from the studio that invites them, and links a client to the records studios hold under the client's email. A team member needs an Intervals.icu athlete id or an email that the studio has added; My fits needs an email. Without them, a person cannot use Bike Fit Studio or My fits.

The AI check and speech

A studio can use an AI check of a fit and speech input once it has a key for an AI provider: its own account, or Montis's account if Montis sets up its own key for the studio. The AI check uses the provider the studio picks: OpenAI, Anthropic (Claude) or Google (Gemini). Speech always uses Google (Gemini). With the studio's own key, the provider works for the studio, under the studio's own agreement with it. With Montis's key, the provider works for Montis, as its sub-processor. Montis decides which models, and whether speech, each studio is offered. The AI check runs only when someone in the studio's team asks for it, and speech only when someone in the team records a clip. The studio's owner or admins can also compare models on one fit, which sends the same fit details to each provider picked.

The AI check sends the fit's details, never the client's name or contact details.
What each check sent and got back (its request with these details, and the provider's answer, also for each model compared) is kept with the fit in the studio's private storage, for Montis's platform admins to look into a check when supporting the studio; the fit details it sent and the answer are in the client's export, and it is deleted with the fit's clips and videos when the studio deletes the client for good.
Speech sends the recorded clip to Google Gemini, to transcribe it and propose measurements and findings, which the fitter accepts or rejects. Whatever is said in it goes, a name included. The clip is kept in the studio's private storage.

Montis never uses client data to train AI models. With Montis's own key, Montis uses only the providers' paid API services. Under their terms, Google and OpenAI do not use the data to improve their products or services, and Anthropic does not train models on it. Under those terms, each provider keeps prompts and answers for a short time to check for misuse: Google for up to 55 days and OpenAI for up to 30 days; Anthropic deletes them within 30 days unless they are flagged for misuse. With the studio's own key, that account's terms set what the provider keeps and whether it may use the data.

AI can make mistakes. The AI only informs. The fitter decides. Bike Fit Studio makes no decisions with legal or similarly significant effects.

Who receives data

Cloudflare runs Bike Fit Studio: hosting, the database, file storage, email sending, the robot check (Turnstile) on the booking and contact pages, and logs. Turnstile receives the visitor's IP address and browser signals.
Montis's sign-in service (montis.icu) confirms who is signed in with Montis. Bike Fit Studio reads only the athlete id and email.
The AI providers above, only when someone in the studio's team runs the AI check, compares models or records speech.
A fitter's calendar host, such as Google Calendar, only when the fitter connects their own calendar.
Stripe, only if a studio turns on online payments in future, under the studio's own Stripe account.
WhatsApp or a studio's website, only when you follow a link to them from a studio's pages or emails; what you send there is under their own terms.
Montis's platform admins can open and change any studio's records and settings, but only to run, support and secure Bike Fit Studio, at the studio's request, or where the law requires it.

Where data is held

Montis is operated from Switzerland. Bike Fit Studio's database is placed in Western Europe. Recorded clips are in Cloudflare's file storage (R2), which is not restricted to Europe. Requests reach Cloudflare's network at the location nearest the visitor, which can be outside Europe. Cloudflare is a United States company.

For customers in Switzerland, such as Montis, the AI providers contract through their Irish companies: Google Cloud EMEA Limited, OpenAI Ireland Ltd and Anthropic Ireland, Limited. Their United States companies may also handle the data. The AI providers may process it in several countries, including the United States.

Data moves freely between Switzerland and the European Economic Area, because each recognises the other's data protection as adequate. Transfers to other countries, such as the United States, rely on the EU-US and Swiss-US Data Privacy Framework where the company is certified, as Google LLC is, and otherwise on the standard contractual clauses (data protection terms approved by the authorities) in its terms, as with OpenAI and Anthropic. Montis sends a copy of these safeguards on request.

Cookies and browser storage

Bike Fit Studio uses only what it needs to work, so it shows no cookie banner:

montis_session: Montis's sign-in cookie (see Montis's policy);
bf_rider: a client's My fits sign-in, 30 days;
bf_studio, bf_theme and bf_bookings_view: the last studio, light or dark, and the bookings view, 1 year;
bf_camera: on a phone linked to a fit as a camera, that link, sent only with the camera's own requests, for as long as the link works (at most 4 hours);
browser storage: a fit stage not yet sent while offline, a recorded clip until it is sent (on a phone used as a camera, until it is sent or discarded), the booking form until you book or close the tab, a copy of what you typed in a form you just sent until the next page opens or you close the tab (so the form can come back filled in if something went wrong), and your answer to the offer to install the app.

On a shared device, sign out and let unsent fit data finish sending.

Security

Connections use HTTPS. Each studio's data is kept apart, and who may see what is checked on the server for every page and form. Studios' AI keys and fitters' calendar addresses are stored encrypted. Sign-in links are stored only as hashes and work once. Audio clips are private to the studio's team. The booking and contact pages have a robot check and daily limits. Bike Fit Studio keeps a log of who changed what. No internet-connected service can guarantee absolute security.

Your rights

Under the GDPR and the FADP, you may ask for access to your data, correction, deletion, restriction or objection, and a copy to take elsewhere. Where processing relies on your consent, you may withdraw it for the future.

Clients: ask the studio first; it is responsible for your records. Montis helps the studio answer. If you cannot reach the studio, contact Montis and it will pass your request on.
Studio teams and My fits sign-in: contact Montis.
People who write through a contact page: for a studio's contact page, ask the studio; for the Bike Fit Studio contact page, contact Montis.

Montis or the studio may need to confirm who you are before answering. You may also complain to the data protection authority where you live or work. In Switzerland that is the Federal Data Protection and Information Commissioner (FDPIC); EU authorities are listed by the European Data Protection Board.

Children

Bike Fit Studio is meant for adults. A studio that fits a minor gets a parent's or guardian's consent where the law requires it.

Changes

Each change is a new version, published here with its version number and date. Studios are told of important changes by email to their owners.

Contact

For your records as a client, contact the studio. For anything else, contact Montis through the Bike Fit Studio contact page.