Privacy policy

• Owner: BBRAVE SENTINEL, S.L. (single-member company)
• Tax ID (NIF): B88862735
• Registered office: Calle Río Danubio, 2, portal 3, 2.º D, 28913 Leganés (Madrid), Spain
• Registration: Madrid Commercial Register, Sheet M-891920, 1st entry, electronic folio
• Email: soporte@destolen.com

For any data protection matter, write to soporte@destolen.com with the subject «Protección de datos» (data protection).

• Data: email address and password (managed by Firebase Authentication; we never see it) and, if you add them, name and city. We record the date and version of the privacy policy you accepted and whether you want to receive marketing communications.
• Purpose: to create and manage your account, identify you and send you service emails (verification, alerts, changes to your bikes and searches).
• Legal basis: performance of the contract (art. 6.1.b GDPR). Marketing communications only with your consent (art. 6.1.a GDPR), which you can withdraw at any time from the email itself or by writing to us.
• Country: that of your account, of each bike and of the theft (by default, your browser's; you can change it). We use it to know whether we search listings in that country and whether Search and Protection can be bought there. Legal basis: performance of the contract (Art. 6.1.b GDPR).
• Waiting list by country: if you try to buy in a country where we do not search yet and ask us to let you know (or try it with the country of the theft), we store your user, your email, the country, the language and the date to write to you when we start; we also count how many people are waiting in each country, without personal data, to decide where to open. Legal basis: your request (Art. 6.1.b GDPR) and our legitimate interest in deciding where to extend the service (Art. 6.1.f GDPR). You can ask us to remove you at soporte@destolen.com.

• Data: brand, model, type, colour, size, year, approximate value and purchase date; frame, motor and battery serial numbers; photos; the certificate with the bike's destolen No.
• Optional data: type of lock and tracker, insurance, where it is parked, main use, usual area, components, stickers and customisations.
• Purpose: to keep your bike's record, issue its certificate, let a buyer check whether it is reported stolen and recognise it if it is stolen. We automatically check with artificial intelligence (OpenAI) that photos show a bike or a serial number. If you have an active Search, we also search the web for up to 3 photos of your bike with Google Cloud Vision, to find pages where they appear (you'll see them in «Similar listings»).
• Legal basis: performance of the contract (art. 6.1.b GDPR).

Use of optional data for statistics and third-party services. Only if you accept it in a separate box that is never pre-ticked (current text: version «datos-bici-2026-10-14») do we use your bike's data, without personal data and in aggregate form, for theft statistics and third-party services (insurers, shops). The legal basis is your consent (art. 6.1.a GDPR). We record the date and version of the text when you give and when you withdraw it. You can withdraw it at any time in Settings → Use of your bikes' data; withdrawing it does not affect your registration or the search for your bike.

E-scooters. If you register an e-scooter we process the same data (without bike type or size) plus its DGT registration number and whether it carries the identification label, for the same purposes and on the same legal bases. We do not consult the DGT register: you type the number.

• Data: the bike's data and photos, the date and place of the theft, the description and, if you provide it, the police report number. If the bike had an AirTag or another tracker, you can add the temporary link to share its location.
• Purpose: during the Search, to look for second-hand listings that match your bike, show you in «My theft» the listings similar to your bike with a similarity percentage, email you about the most similar ones and record the outcome (for example, if you recover it).
• Public report page: so that you can share it, it shows the brand, model, colour, type, main photo, masked serial number, city, country and date of the theft. It never shows your contact details. It is visible while the report is active or marked as recovered.
• Sightings: anyone can report that they have seen your bike. We forward the report to you by email without revealing your address.
• Tracker link: only you and the destolen team can see it; it is never published. We use it only to help you locate the bike. These links expire after 7 days according to the provider (Apple or Google).
• Shareable alert (optional): if you create it in “My theft”, we publish on a page that anyone with the link can see (destolen.com/en/alert/…) and in an image for social media: the main photo of your bike (a copy without the file’s internal data, such as GPS location), the brand, model, colour, the area you enter (neighbourhood or town) and the day of the theft. Never your name, email, phone number, serial number, exact address or police report. The page is not indexed by search engines. We count visits and shares without storing data about who views it. Anyone who sees it can contact you with “Seen it?” through the same system as “I have found a bike”: neither of you sees the other’s details unless one decides to share them. Legal basis: your consent (art. 6.1.a GDPR), which you withdraw by turning off the alert; it turns off by itself when you get the bike back or the Search ends. Anything other people have shared on social media is beyond our control.
• Legal basis: performance of the contract (art. 6.1.b GDPR).

E-scooters. If you report the theft of an e-scooter we process the same data plus its DGT registration number, which the checker and the API use to show that it is reported stolen, without giving any of your details. The Search for an e-scooter does not include listing monitoring yet (section 11).

• Data: the plan (monthly or annual), its status, the number of bikes covered and the subscription dates.
• Purpose: to provide Protection: monitoring second-hand listings for your covered bikes and activating the Search at no cost if you report one of them stolen.
• Legal basis: performance of the contract (art. 6.1.b GDPR).

• Data: payments are made on Stripe's payment page. We neither see nor store your card number; we store the customer, payment and subscription identifiers, the amount, date, status and your email.
• Purpose: to charge, invoice, manage your subscription (changes and cancellation from the Stripe portal) and prevent fraud.
• Legal basis: performance of the contract (art. 6.1.b GDPR) and compliance with tax and commercial legal obligations (art. 6.1.c GDPR).

Stripe processes payment data on our behalf and, for its own obligations (fraud prevention, payment regulations), as an independent controller under its privacy policy. You need an account to purchase: there is no payment without an account.

Billing address: when you pay, Stripe asks for your billing address. We use it to apply the VAT that corresponds to your country and to avoid selling from the United Kingdom; we store the country. Legal basis: performance of the contract and tax obligations (Art. 6.1.b and 6.1.c GDPR).

• Data: the serial number or destolen No. you look up and, when you check a registered bike, your IP address and browser data (user agent). We also use your IP, or your user account if you are signed in, to limit the number of checks.
• Response: it only says whether the bike is registered, its brand, model and main photo (unless the owner has made it private) and whether it is reported stolen and the source of the report. It never gives the owner's data, the full serial number or the certificate.
• Purpose: to answer your query, prevent abuse and bulk queries and protect the service.
• Legal basis: our legitimate interest in offering the check and preventing abuse (art. 6.1.f GDPR).

The checker and the API also look up the DGT registration number of e-scooters registered or reported on destolen, with the same rules: they only say whether it is registered or reported stolen and the type of vehicle, never the owner’s details.

• Form data: name, company, email, type of company, what you want to check, the message, the reason (documentation or pilot access), the language and an encrypted summary (hash) of the IP, never the plain IP.
• Purpose: to review your request and, if we approve it, send you the technical documentation; answer your request to join the pilot and contact you about it. The IP hash limits the number of requests.
• Legal basis: pre-contractual steps at your request (art. 6.1.b GDPR) and our legitimate interest in preventing abuse (art. 6.1.f GDPR).
• API use: we store the key used and the number of calls per month. For listing scores we do not store the listing or the seller data the company sends us.

A shop or workshop with an API key can register the bike it sells or services for you.

• Data the shop sends us: your email, the bike's data and serial number, up to three links to photos and its internal reference.
• What we do: we send you an email with a personal, single-use link that expires after 30 days. The bike is only added to your garage if you accept it with that same email. If you do not accept it, the link expires and the bike is not registered in your name. We only store an encrypted summary (hash) of the link.
• Purpose: to make it easier for you to register the bike the shop offers you and to measure how many registrations come through this channel.
• Legal basis: our and the shop's legitimate interest in offering you the registration (art. 6.1.f GDPR); if you accept, performance of the contract (art. 6.1.b GDPR). The shop must inform you that it shares your data with destolen.

If you do not want to receive these invitations, write to soporte@destolen.com.

• Messages to a bike owner: anyone can write to the owner of a registered bike through destolen. We store the message and the sender's email and IP and deliver it to the owner without revealing the owner's address. Legal basis: the legitimate interest of the sender and the owner in communicating without revealing their details, and ours in preventing abuse (art. 6.1.f GDPR).
• Found bike reports: if you tell us you have found a bike, we store what you tell us (serial number or destolen No., brand, model, colour, place, date, description and photos), your user account and, if you leave them, your name, email and phone. If it matches a registered bike or a theft report with Search, we notify the owner only with the brand, model, approximate area and date, never with your details or your description. The owner can write to you through destolen: we forward their message to your account email and you decide whether to reply and whether to share your contact details. Neither of you sees the other's email unless you choose to share it. Legal basis: the legitimate interest of the finder and the owner in returning the bike without revealing their details, and ours in preventing abuse (art. 6.1.f GDPR).
• Bike transfers: if you transfer a bike, you give us the email of the recipient. We send them a link to accept it, which expires after 7 days. Legal basis: performance of the contract with the person transferring (art. 6.1.b GDPR) and, regarding the recipient, our legitimate interest in completing the requested transfer (art. 6.1.f GDPR).

To search for stolen bikes, a server of ours in the European Union (Hetzner, in Helsinki, Finland) periodically collects bike listings from publicly accessible second-hand listing portals and websites.

• Listing data: title, description, price, photos (or their links), the date, the link and the listing's location rounded to about 11 km. We do not store the seller's name, alias or ID on the portal: we replace them with a pseudonymous code (a hash made with a secret key that only we hold). This is pseudonymisation, not anonymisation: with that key and the portal ID the code can be linked back to the seller's account, and the listing itself remains public on the portal. That is why we still treat this data as personal data, with the same safeguards. Retention periods are in section 15.
• Purpose: to check whether a listed bike matches a bike reported stolen. We compare the listing data (brand, model, colour, serial number if shown…) and the photos, the latter with an OpenAI artificial intelligence model.
• Similar listings: we calculate a similarity percentage between each listing and the bike (details and, where possible, photos) and show the bike’s owner, in their account, the listings similar to their bike: title, photo, price, portal, approximate area, date and link to the public listing, never data about the seller. We email them about the most similar ones. They are the result of an automatic comparison and it is the owner who decides. We do not contact sellers, do not publish their data and do not take decisions about them: the match is an indication the owner can take to the police.
• Proactive search for bikes reported stolen: in addition to the bikes reported on destolen, we look in those listings for bikes that appear as stolen in public sources (Bike Index, the Mossos d'Esquadra list of stolen bicycles and public stolen-bike boards). The comparison is automatic: if a listing’s serial number matches that of a bike recorded as stolen in those sources (a similarity, not proof), we may notify whoever is looking for that bike (through the source itself), the police or the listing's portal, only with the link to the listing and the public reference of the theft and never with the seller's personal data; we do not contact the seller.
• Selling signals: to detect resale patterns, the team analyses the listings of the last 90 days of each seller account, identified only by a pseudonymous code. It is an internal tool: it is not shown to anyone outside the team and does not decide anything on its own.
• Legal basis: the legitimate interest (art. 6.1.f GDPR) of theft victims in recovering their bikes and ours in providing the service, together with the general interest in hindering the sale of stolen goods. We consider that this interest prevails because we only process data the seller has already made public, the minimum necessary, without publishing or sharing it except with the bike’s owner (the listings similar to their bike) and, where the law requires, with the authorities.
• Where the data comes from: from the second-hand listing portals and websites shown in this list, which we keep up to date.
• Your rights as a seller: you can object to this processing or exercise your other rights by writing to soporte@destolen.com with the listing link. As we do not contact sellers, we inform them through this policy.

For now we only monitor bike listings: we do not monitor e-scooter listings or compare their photos with listings.

From theft reports, bike registrations and public sources (such as the Mossos d'Esquadra and Bike Index lists), we produce statistics on bike thefts: most stolen brands and models, areas, bike types, locks and similar data. We publish some of them, such as The most stolen bikes and the theft map, and we do not publish any figure based on fewer than 10 cases, so that no individual case can be recognised.

These statistics are an important part of our business: we may share or sell them to third parties, such as insurers, shops, manufacturers or public bodies, always aggregated and anonymised, without identifying or allowing the identification of any person. We do not sell personal data.

• Legal basis: to produce anonymised statistics with the data needed for the service, our legitimate interest (art. 6.1.f GDPR), a purpose compatible with the one for which the data were collected (art. 6.4 GDPR). Your bike's optional data are only used if you have accepted it (section 3).
• Anonymised statistics are no longer personal data.
• Anonymous statistics when data is deleted: when data reaches the end of its retention period (section 15), in some cases we count it before deleting it, with nothing that could identify anyone: unpaid or discarded reports (brand, model, type, colour, province and month), the bikes of accounts deleted for inactivity (brand, model, type and province) and checker queries (brand, province if known, day and result). We do not publish any figure from these counts with fewer than 10 cases either.

• Support: if you write to us, we use your data to reply. Legal basis: performance of the contract or, if you are not a user, our legitimate interest in assisting you (art. 6.1.b and 6.1.f GDPR).
• Security: we log technical data (IP, dates, errors and administrative actions) to protect the service, limit abuse and solve incidents. Legal basis: our legitimate interest (art. 6.1.f GDPR).
• Website usage statistics: we count visits to the public pages and some steps of the service (bike checks and their result, theft reports started and paid, bikes registered, plans purchased, business requests and language changes) with Umami, hosted by BBRAVE SENTINEL, S.L. on its server in the European Union (Hetzner, in Helsinki, Finland). No cookies or persistent identifiers. We do not store your IP: it is used on the spot to work out the country, region and city and to calculate an encrypted visit code that changes every day, and is then discarded. We never send your email, your user account, serial numbers or bike or report identifiers. We keep the page, the referring domain, the type of browser, system and device, the screen size, the language and that approximate location. If your browser asks for Do Not Track, nothing is sent. Legal basis: our legitimate interest in knowing how the website is used in order to improve it (art. 6.1.f GDPR); you can object by turning on Do Not Track. More information in the Cookie policy.

We do not take decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you. The similarity percentage (calculated with the help of artificial intelligence) only sorts the listings we show the bike’s owner: it does not decide anything about anyone. The owner decides whether a listing is their bike and, if so, goes to the police; we do not contact the seller or take any action concerning them. The listing risk score offered by the business API is indicative: it supports the company's decision, it is not a verdict.

• Account: while you have it. If you ask for its erasure, we delete the data, except those we must keep blocked to comply with legal obligations. If you do not use it for 3 years, we will warn you by email and, if you do not sign in within the following 30 days, we will delete it together with your registered bikes, their photos and their certificates. Before that we count your bikes anonymously (brand, model, type and province). If one of them is reported as stolen, it still appears as stolen in the checker, without any of your data.
• Registered bikes, photos and certificate: while they are in your garage or until you delete them or your account.
• Search: lasts 30 days from activation (30 more if the guarantee applies). The tracker link is deleted when the Search ends. Matches discarded by the team or marked «not my bike» are deleted 90 days after the Search ends. The rest (the report, the matches and their outcome) is anonymised 2 years after it ends: we remove your user, your email, the photos and the precise location, and only the brand, model, province, dates and outcome remain.
• Notified matches without a reply: 14 days after the notification they are marked «no reply» (not deleted); you can reply later.
• Similar listings: the ones you do not mark, or hide, are deleted 180 days after we detect them; the ones you save or mark as “It is my bike” or recovered, 1 year after you mark them, and until then we also keep the monitored listing.
• Unpaid or discarded reports: shown to you in «My theft» for 30 days and you can discard them. 90 days after they are created or discarded we delete them with their photos; only an anonymous count remains (brand, model, type, colour, province and month). The bike in your garage is not touched.
• Shop registrations (pre-registrations): the link expires after 30 days. If you do not accept it, 30 days after it expires (or is cancelled) we delete your email, the photos, the shop's reference and the serial numbers; only the shop, the brand, the month and the status remain.
• Pending transfers: deleted after 7 days if not accepted.
• Anonymous messages: read messages are deleted after 90 days; unread ones after 12 months.
• “I've found a bike” reports: the report (what you tell us, your contact details and the photos) is kept while it is open; if it does not match any bike, it is closed after 180 days. We delete it with its photos 180 days after it is closed (because the owner was notified, it was dismissed or it expired) and, in any case, 360 days after you send it. Messages between the owner and the person who found the bike are deleted on the same timescales, counted from the last message.
• Shareable alerts: when an alert is turned off (by you, when you get the bike back or when the Search ends), the page stops showing the bike’s details and we delete the published photo immediately; 30 days later we delete the rest (the alert, your consent and the counters). If you delete your account, they are deleted straight away.
• Support requests (help and contact form): your name, email and message are deleted 12 months after the last reply or change.
• Messages from shops and workshops about your bike (API): the message, your reply and the shop's email are deleted 180 days after the last message or reply.
• Invitation codes: if you use a code from your club or group, we keep which code you used, the date and your email. The email is kept while your account exists; if you delete it (or we delete it for inactivity), we remove your email and your user from the redemption and only the date and the code remain. 12 months after the code expires we delete the emails of all its redemptions.
• Drafts in your browser: what you leave half-done when reporting or purchasing is deleted automatically after 7 days.
• Monitored listings and seller data: listings without a match are deleted 60 days after we last saw them published; listings of high-end bikes (listing price, or the usual market price of that model, of €2,000 or more) are deleted 120 days after, so that we can detect expensive bikes that are kept for a while and advertised again later or on another portal. Those with a confirmed match are kept while the Search lasts and for 1 year afterwards; then we delete the listing's link, price and photos and only the outcome and its dates remain. Those with a match pending review are kept while the Search lasts (and at least for the normal 60 or 120 days); pending matches are deleted when the Search ends. If the match is dismissed, the listing follows the normal period. If a court, the police or a complaint requires it, we keep a listing blocked for as long as necessary.
• Proactive search findings (bikes reported stolen in public sources that turn up in a listing, section 11): while a finding is pending review, or confirmed and not yet reported, we keep the finding and its listing (currently with no maximum period). If the team dismisses it, we delete the finding 90 days after the review and the listing follows its normal period. If we notify someone, we keep the listing for 1 year from the notice and the finding (with the listing's link) for 2 years; then we anonymise it: we remove the listing and the theft reference, and only the source, portal, type of match, dates and outcome remain.
• Serial number checker: the IP address and browser data are deleted after 90 days. Before that we count the checks each day anonymously (brand, province if known, day and result).
• Business requests (API form): rejected or unanswered requests are deleted 12 months after the last contact or status change.
• API usage: the log of each call, 13 months; the monthly count per key, 6 years.
• Technical and security data: audit logs, 90 days; security events, 12 months; email sending limits, 7 days.
• Payments and invoices: 6 years (commercial records; tax records become time-barred after four). Stripe keeps the payment data according to its own policy.
• Consents: the date and version of the text, while your account exists and for 3 years afterwards.
• Anonymised statistics: no time limit, as they are not personal data. We do not publish any figure based on fewer than 10 cases.
• Waiting list by country: until we tell you that we have started searching in your country, until you ask us to remove you or until you delete your account.
• Sales to other EU countries: if we apply the VAT one-stop shop scheme, the data of those sales (country, date, amount and VAT) are kept for 10 years, as required by EU rules.

We do not sell personal data. We use these providers (processors), under contract and only to provide the service:

• Google (Firebase and Google Cloud): accounts (Firebase Authentication), the website database, photos and files, web hosting and server functions, which run in the europe-west1 region (Belgium). Firebase Authentication is a global Google service and may process data outside the European Economic Area, in the US.
• Google Cloud Vision: searches the web, from its European Union endpoint, for up to 3 photos of your bike while you have an active Search, to find pages where they appear. It only receives the bike photos, never your personal data.
• Hetzner Online: server in Helsinki (Finland) with the bike and listing database, the listing monitoring and the website usage statistics (Umami, which we run ourselves).
• Amazon Web Services (Amazon SES): sending emails from the Ireland region (eu-west-1).
• OpenAI (OpenAI Ireland Ltd., under a signed data processing agreement): analysis and comparison of photos of bikes and listings. It may process the data in the US (section 17) and does not use it to train its models.
• Stripe (Stripe Payments Europe, Ltd., Ireland): payments and subscriptions.
• ScraperAPI (US): monitoring infrastructure through which requests to listing portals pass.

Other recipients:

• The bike’s owner (with Search or Protection) sees the link and public data of the listings similar to their bike (title, photo, price, portal, approximate area and date), never data about the seller.
• Buyers and businesses checking a serial number only receive what is described in sections 7 and 8, never the owner's data.
• Authorities, courts and police, when a law requires it or when you ask us to.
• Third parties receiving statistics: only aggregated and anonymised data (section 12).

Sharing with third parties (Settings → Privacy). These are switches that are off by default and that you can change at any time; we keep the date of every change and the version of the text. None of them gives third parties your name, email, phone number or address: if someone wants to contact you, we write to you ourselves. The legal basis is your consent (art. 6.1.a GDPR).

• Police: when you mark a listing as “It is my bike”, you can download from «My theft» or «My vehicles» a report for the police with your theft report, the serial number, the photos of the bike and the link, photos and details of the listing. You always have it, whether the switch is on or not. If you turn it on, destolen may provide that report to a police force that asks for it in writing quoting your theft report; otherwise we only provide it when the law or a court requires us to.
• Shops and workshops: if a shop or workshop that is an API client checks the serial number of your registered bike that is not reported stolen, we email you and the API tells them they can ask us to put them in touch with you, with a reference. We do not give them any of your details.
• Insurers: if an insurer that is an API client checks the serial number of your registered bike, the API tells them since when it has been registered on destolen, without any of your details. With this switch on you can also sign up your bikes to the insurer offers programme: offers will reach you through destolen, never directly from the insurer. The programme has not started yet.

If your bike is reported stolen, whenever any company that is an API client checks its serial number, the API replies that it is reported stolen (section 8) and we always email you, whether the switches are on or not, because it is part of the service (art. 6.1.b GDPR). For checks that trigger a notice or that an insurer sees, we keep which bike, which company, when and whether you were notified (never the number checked), so that we notify you at most once a day per bike and company and can prove it. If the police ask us in writing quoting your theft report, we can tell them which company checked your stolen bike and when.

External services loaded by the website: fonts are downloaded from Google Fonts and maps from OpenStreetMap. When loading them, your browser sends them your IP address. They do not set destolen cookies (more information in the Cookie policy).

Some providers may process data outside the European Economic Area, mainly in the US:

• Google: Firebase Authentication (a global service) and Google Fonts, which receives your IP address when your browser downloads the fonts.
• OpenAI: comparison and analysis of photos of bikes and listings. Our contract is with OpenAI Ireland Ltd., which may transfer the data to OpenAI OpCo, LLC (US).
• Stripe: payments are handled by Stripe Payments Europe, Ltd. (Ireland), which may transfer payment data to Stripe, Inc. (US).
• ScraperAPI: requests to the portals, and the listings we download, pass through this provider.

In those cases, the transfer relies on the EU-US Data Privacy Framework when the provider is certified and, otherwise, on the standard contractual clauses approved by the European Commission, with any appropriate supplementary measures.

The rest of the processing takes place in the European Union: Google Cloud server functions in the europe-west1 region (Belgium), email sending with Amazon SES in Ireland (eu-west-1) and our Hetzner server in Helsinki (Finland), with the listings database, the monitoring and the usage statistics. OpenStreetMap map tiles are served from the United Kingdom, which has an adequacy decision from the European Commission.

You can ask us for information about these safeguards at soporte@destolen.com.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, withdraw your consent without affecting prior processing, and not be subject to decisions based solely on automated processing.

How: write to soporte@destolen.com with the subject «Protección de datos», from your account email or explaining how to identify you. We will reply within one month, which may be extended by two further months in complex cases; if so, we will tell you.

You can also correct your bikes' data in «My vehicles», withdraw the data-use consent in Settings and unsubscribe from marketing communications from the email itself.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). We would appreciate it if you wrote to us first, in case we can solve it.

We apply reasonable technical and organisational measures: encrypted connections (TLS), also between our servers and the database; passwords managed by Firebase Authentication; single-use links stored only as an encrypted summary (hash); restricted access to data; masked serial numbers on public pages; and usage limits to prevent abuse.

destolen is not aimed at children under 14 and we do not knowingly collect their data. If you are under 14, you need the consent of your parents or guardians. To purchase paid services you must be of legal age.

We will publish any new version on this page with its update date. If the change is significant, we will notify you by email or in your account.