Privacy Policy

Last updated: September 2026

1. Who is responsible

The controller for bibs.bio is PrimeMerch OG, Liebenauer Gürtel 10, 8041 Graz, Austria, office@primemerch.co. We have not appointed a data protection officer, as we are not required to.

2. What we process and why

• Your account. You sign in with Google. Google then shares your name, email address, profile picture link and Google account ID with us, nothing else. We use them only to create your account, sign you in, suggest your display name and contact you about your account. We do not use this data for advertising, do not sell it and only share it with the service providers listed below (Art. 6(1)(b) GDPR, performance of contract). Without it we cannot provide an account.
• Your page content. Everything you add in the editor: name, sport, location, bio, social links, photos, logos, products, links, discount codes, results and races. Once you publish, this content is public on the internet, visible to anyone with the link and may be indexed by search engines (Art. 6(1)(b) GDPR). Only add personal data of other people, for example in photos, if you are allowed to.
• Technical data. When anyone visits a page, our hosting providers process the IP address, browser type and time of the request to deliver the page and keep it secure (Art. 6(1)(f) GDPR, legitimate interest in a secure, working service).
• Usage statistics. We use Vercel Web Analytics to count page views on bibs.bio. It works without cookies and does not identify individual visitors (Art. 6(1)(f) GDPR).
• Statistics for athletes. When someone visits an athlete page, we count the view and clicks on links, products, social profiles and discount codes, so the athlete can see how the page performs. We store only the type of action, the referring website's domain, the device type (phone, tablet, desktop) and the country derived from the request. We do not store IP addresses, store nothing on the visitor's device and cannot identify visitors (Art. 6(1)(f) GDPR). The data is deleted together with the athlete's account.
• Emails to us. If you write to us, we use your message and address to answer (Art. 6(1)(b) or (f) GDPR).

3. Cookies and storage in your browser

We only set cookies that are strictly necessary to keep you signed in. If you type a link name on our homepage before signing in, your browser keeps it locally so the setup can fill it in; it is not sent to us until you save it. Visitors of athlete pages get no cookies and nothing is stored on their device. Fonts are served from our own servers, so no requests go to Google Fonts.

4. Service providers and recipients

We work with these processors under data processing agreements:

• Supabase Inc. (database, login and file storage; servers in Frankfurt, Germany)
• Vercel Inc. (hosting, delivery network and analytics; functions run in Frankfurt)
• Google Ireland Ltd. (sign-in with Google, only if you use it)

These providers may access data from the USA, for example for support. Such transfers are based on the EU-US Data Privacy Framework or on standard contractual clauses (Art. 45 and 46 GDPR). Published page content is visible to everyone. We do not sell data and use no automated decision-making or profiling.

5. How long we keep data

We keep your data as long as your account exists. When you delete your account in Settings, your profile, all content, all uploaded images and your page statistics are deleted immediately. Server logs of our providers are deleted after a short period. We keep emails as long as needed to handle your request.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). Most of this you can do yourself in the editor. For anything else write to office@primemerch.co. You can also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb.gv.at).