Privacy Policy

This policy covers your use of the Bikfix web application at this domain. It does not cover the client websites or DNS records you connect Bikfix to manage — those remain your (or your client's) property and responsibility.

Account data: your name, email address, and a hashed (not reversible) version of your password.

Agency data: your agency's name, the clients and domains you add, and the DNS/incident history Bikfix generates while monitoring them.

Provider credentials: if you connect a client's Cloudflare API token, it is encrypted (AES-256-GCM) before being stored and is only ever decrypted in memory when Bikfix needs to call Cloudflare's API on that client's behalf.

Session data: a single-purpose login cookie. We don't use tracking or advertising cookies.

Automatically collected evidence: to diagnose an incident, Bikfix records DNS lookups and HTTP/HTTPS responses for the domains you add — this is operational data about your infrastructure, not about you personally.

Solely to run the service: authenticating you, storing your agency's configuration, detecting and diagnosing incidents, applying changes you approve, and showing you the resulting history.

If you set an OpenAI or Anthropic API key, the factual evidence Bikfix has already collected (not your account details) is sent to that provider to phrase the diagnosis narrative. This is optional and off by default.

We do not sell your data, and we do not use it for advertising.

Bikfix relies on a small number of infrastructure providers to operate:

Neon (database hosting) stores the application database. Cloudflare receives API calls made on your behalf, using the credential you provided, when Bikfix reads or changes DNS records you've asked it to manage. Optionally, OpenAI or Anthropic process diagnosis evidence if you've enabled that feature. None of these providers receive your Bikfix account password.

Passwords are hashed, never stored in plain text. Provider credentials are encrypted at rest. Every account belongs to exactly one agency, and Bikfix enforces that agencies cannot see or act on each other's data. Nothing is changed on your infrastructure without your explicit, logged approval.

As an early pilot-stage product, this has not yet been through a formal third-party security audit or penetration test.

You can ask us to access, correct, export, or delete your account data at any time by emailing us. If you're in the UK or EU, this includes the rights available to you under UK GDPR.

We keep your account and incident history for as long as your account is active. If you delete your account, we'll delete your personal data within a reasonable period, except where we need to keep something for legal or security reasons (e.g. audit logs of actions already taken on infrastructure).

Suseendar Muralitharan (individual), Flat 8, Argon Street, West Ealing, London, UK.
Email: support@bikfix.co.uk