Privacy Policy
Before Assessment Simulation Engine, for Bike features
Effective Date: June 29, 2026 · Trail Assessment and Construction Tools, LLC · Last Revised June 29, 2026
1. Who We Are
Trail Assessment and Construction Tools, LLC (“TrailACT”, “we”, “us”, “our”) develops and distributes Before Assessment Simulation Engine, for Bike features (“BASE-BF”), a standalone downloadable parametric and computational modeling application for mountain bike feature planning and design. BASE-BF runs entirely on the user’s local machine. It is not a cloud application, a browser-based service, or a hosted platform.
Questions about this Privacy Policy or requests to exercise your data rights should be directed to:
support@trailact.com · https://trailact.com/privacy
2. Scope — How This Policy Applies by Tier
BASE-BF’s data footprint is determined by the tier you use. The table below summarizes; full detail for each data category is provided in Section 4.
| Tier | Account Required | Data Collected | Server Contact |
|---|---|---|---|
| Free | No | Name, email, organization name (optional) | Software and Terms updates; version and safety-recall check (IP, timestamp, version string only) |
| Paid | Yes | Name, email, license key, timestamps, payment via Stripe | For license validation and version/safety-recall check |
3. Data We Collect
The BASE-BF Free tier requires no account and no internet connection for core functionality, with one exception described below. Except as described below, no information from Free-tier use is transmitted to TrailACT. Your designs, inputs, and outputs remain on your local machine.
At every launch and when you use the manual version-check button, BASE-BF makes a single outbound request to TrailACT’s update server to check the current application version and any outstanding safety recalls. This request is the only network communication made by the Free Tier. It transmits only your IP address, a timestamp, and the version string of your installed application – information inherent in any web request. Your IP address is processed by Hetzner’s standard infrastructure logging, which rotates automatically on a four-week cycle; TrailACT does not store, analyze, or link your IP address to any other data. No design files, inputs, outputs, or user-identifying information are transmitted or stored in connection with this check. The version-check response tells your application whether it is current and whether any safety recall applies; no other data is returned.
For the Free Tier, we collect only your name, email address, and organization name (optional) for the sole purpose of sending notices of software updates and updates to the Terms of Service and Privacy Policy.
The following is the complete data footprint for Paid Tier users. No data beyond this list is collected.
3.1 Account Identity Data
| What | Name, email address, and organization name (optional) |
|---|---|
| Why collected | Account creation, license assignment, support contact, legal consent record; optional product communications where consent has been given |
| Legal basis | Contract performance (license agreement); consent (optional product communications) |
| Stored | TrailACT-controlled database |
| Retention | Duration of active license plus 3 years following termination or expiration |
3.2 License Data
| What | License key, activation timestamp, license tier |
|---|---|
| Why collected | License enforcement, fraud prevention, audit trail |
| Legal basis | Contract performance |
| Stored | TrailACT licensing service |
| Retention | Duration of active license plus 3 years for audit purposes |
When BASE-BF validates your license, it transmits only your license key and the current application version number to TrailACT’s license validation server. No hardware identifier is transmitted to or stored by TrailACT. The validation server returns a yes/no response and writes no data to a database. The only server-side record of a validation event is Hetzner’s standard infrastructure access log, which rotates automatically on a four-week cycle and is not accessible to TrailACT except on explicit export request. The license key is pseudonymous personal data: it can be linked to an identified individual through TrailACT’s customer records. TrailACT treats the license key with the same protections as directly identifying data under all applicable privacy laws. In addition, at every launch and when you use the manual version-check button, BASE-BF makes a separate request to TrailACT’s update server to check the current application version and any outstanding safety recalls. This request transmits only your IP address, a timestamp, and your installed version string – information inherent in any web request. No license key or other identifying data is transmitted in connection with the version/recall check. Your IP address is processed solely by Hetzner’s standard infrastructure logging under the same four-week rotation described above.
3.3 Terms Acceptance Record
| What | User identifier, timestamp of acceptance, Terms of Service version number accepted |
|---|---|
| Why collected | Legal evidence of clickwrap consent; re-consent tracking on Terms of Service updates |
| Legal basis | Legal obligation and legitimate interest (enforceability of Terms) |
| Stored | TrailACT database |
| Retention | Duration of account plus 6 years following termination |
3.4 Payment Data
| What | Billing name, billing address, last four digits of card, payment method type, transaction ID, subscription tier, purchase date |
|---|---|
| Why collected | License billing, invoicing, fraud prevention |
| Legal basis | Contract performance |
| Stored | Stripe, Inc. (payment processor). TrailACT does not store raw card numbers. Stripe maintains PCI DSS compliance. |
| Retention | Per Stripe policy; transaction records retained for 7 years for tax and regulatory compliance |
3.5 Support and Communication Data
| What | Email content, support tickets, bug reports, and related correspondence |
|---|---|
| Why collected | Customer support and product improvement |
| Legal basis | Contract performance and legitimate interest |
| Stored | Hetzner Online GmbH (Gunzenhausen, Germany) |
| Retention | 2 years following ticket resolution |
4. What We Do Not Collect
TrailACT does not collect, store, or transmit any of the following from any tier:
- Design files, inputs, or outputs. These remain on your local device at all times
- Usage behavior, session telemetry, or application analytics of any kind
- Location data
- Cookies. BASE-BF runs on localhost, not a remote server; no browser cookies are set or read
- Authentication credentials beyond the license key
- Data from any other application on your device
- Sensitive personal data, including health records, financial account data, government identifiers, or biometric data
- Except name, email, and optional organization, any data from the Free tier, including usage patterns, device characteristics, or crash reports
5. How We Use Your Data
For paid-tier users, TrailACT uses collected data exclusively for the following purposes:
- Delivering, enforcing, and managing your license
- Processing payment through Stripe
- Providing customer support and responding to communications
- Maintaining legal records of Terms of Service acceptance for enforceability purposes
- Fraud prevention and license audit
- Notifying you of material changes to the Terms of Service or this Privacy Policy
- Sending optional product communications, including new Major Version announcements and upgrade offers, to users who have affirmatively opted in to such communications at the time of purchase
TrailACT distinguishes between two categories of communications: (a) essential communications, including license key delivery, terms acceptance confirmation, and material changes to these policies, which are sent to all registered users on the basis of contract performance or legal obligation and from which users may not opt out while holding an active license; and (b) optional product communications, including new Major Version announcements and upgrade offers, which are sent only to users who have affirmatively opted in at the time of purchase and which may be withdrawn at any time by contacting support@trailact.com.
For any Tier, TrailACT does not sell, rent, or share your personal data with third parties for marketing, advertising, or any commercial purpose unrelated to delivering your license. We do not use your data for behavioral advertising or profiling of any kind.
6. Sub-Processors and Third Parties
TrailACT shares limited personal data with the following categories of sub-processors solely as necessary to deliver the services described in this policy:
| Category | Provider | Data Shared | Purpose |
|---|---|---|---|
| Payment processing | Stripe, Inc. | Billing name, address, card last four digits, transaction records | License billing and PCI-compliant card processing |
| Infrastructure hosting | Hetzner Online GmbH (Gunzenhausen, Germany) | Email content and support correspondence; license key and app version (validation server, via rotating access log only); IP address, timestamp, and version string (version/safety-recall check, via rotating access log only — all tiers) | Web hosting, email, DNS, SSL certificate management, and license validation server infrastructure. EU-based data centers. GDPR Article 28 DPA executed. |
TrailACT does not use analytics providers, advertising networks, social login providers, or data brokers. TrailACT has executed a GDPR Article 28 Data Processing Agreement with each sub-processor listed above. All sub-processors are required to handle personal data only as directed by TrailACT and in a manner consistent with this Privacy Policy.
7. Data Retention
TrailACT retains personal data only for as long as necessary to fulfill the purposes described in this policy, to perform our contractual obligations, or to comply with applicable legal requirements.
| Data Category | Retention Period | Basis |
|---|---|---|
| Account identity data | Duration of active license plus 3 years following termination | Contract performance; legal hold |
| License data | Duration of active license plus 3 years for audit purposes | Contract performance; fraud prevention |
| Terms acceptance record | Duration of account plus 6 years | Legal obligation; legal hold |
| Payment records | Per Stripe policy plus 7 years for tax and audit compliance | Legal obligation (tax records) |
| Support communications | 2 years following ticket resolution | Legitimate interest |
Upon expiration of the applicable retention period, or upon a valid deletion request under Section 8, TrailACT will delete or anonymize your personal data, subject to any legal hold obligations.
8. Your Rights
8.1 Users’ Rights
Users may exercise the following rights by submitting a request to support@trailact.com. We will verify your identity before processing any request and will respond within 30 days.
- Access — Request a copy of the personal data TrailACT holds about you
- Correction — Request correction of inaccurate or incomplete personal data
- Deletion — Request deletion of your account and associated personal data, subject to retention obligations in Section 7. Deletion of your account will deactivate your license.
- Objection — Object to processing based on legitimate interest
- Portability — Request your personal data in a structured, machine-readable format
Certain data may be retained following a deletion request where TrailACT is subject to a legal hold obligation (for example, Terms acceptance records maintained for legal enforceability purposes). We will notify you if any retention obligation prevents full deletion.
8.2 California Users (CCPA / CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to know what personal information is collected, used, shared, and sold
- Right to delete personal information (subject to exceptions)
- Right to correct inaccurate personal information
- Right to opt out of the sale or sharing of personal information. TrailACT does not sell or share personal information for advertising or commercial purposes unrelated to your license
- Right to limit use of sensitive personal information. TrailACT does not collect sensitive personal information as defined by the CPRA
- Right to non-discrimination for exercising your privacy rights
To exercise these rights, contact support@trailact.com. We will verify your identity and respond within the timeframe required by applicable law. You may also designate an authorized agent to make a request on your behalf.
8.3 EU and UK Users (GDPR / UK GDPR)
If you are located in the European Economic Area or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and/or UK GDPR:
- Right of access to your personal data
- Right to rectification of inaccurate personal data
- Right to erasure (“right to be forgotten”), subject to legal retention obligations
- Right to restriction of processing
- Right to data portability
- Right to object to processing based on legitimate interest or for direct marketing purposes
- Right to lodge a complaint with your local supervisory authority
The lawful basis for processing each category of your personal data is identified in Section 3. Where processing is based on legitimate interest, you may request details of the specific legitimate interest asserted and we will respond within 30 days.
8.4 Canadian Users (PIPEDA)
If you are located in Canada, your personal data is collected, used, and disclosed in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. You have the right to access personal data held about you and to challenge its accuracy. Contact support@trailact.com to exercise these rights.
9. Age Requirements
BASE-BF is intended for users who are at least 18 years of age.
TrailACT does not knowingly collect personal data from individuals under 18. If we become aware that personal data has been collected from a person under 18, we will delete that data promptly. If you believe we may have collected data from a minor, please contact us at support@trailact.com.
10. Data Security
TrailACT maintains reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. Specific measures include:
- Encrypted transmission (TLS) for all license validation communications between BASE-BF and TrailACT servers
- Access controls limiting internal access to personal data to personnel with a legitimate business need
- PCI DSS-compliant payment processing through Stripe, with no storage of raw card data by TrailACT
- Periodic review of security practices
No method of electronic transmission or storage is completely secure. In the event of a data breach that affects your personal data, TrailACT will notify you as required by applicable law, including the New York SHIELD Act, and will take reasonable steps to mitigate any harm.
11. Cookies and Browser Storage
BASE-BF is a standalone desktop application. Its user interface is rendered locally using Streamlit, which opens in your default browser pointed at localhost (127.0.0.1). Because the application runs locally and does not connect to a remote server for UI delivery:
- TrailACT does not set, read, or access any browser cookies
- No third-party tracking scripts or analytics are loaded
- No browser fingerprinting is performed
- No cross-site tracking of any kind occurs
Streamlit may store session state locally in your browser’s memory while the application is running. This data is cleared when you close the application or the browser tab and is never transmitted to TrailACT or any third party.
12. Jurisdictional Scope
This Privacy Policy is governed by the laws of the State of New York. TrailACT is based in the United States. BASE-BF is available for download globally. TrailACT’s infrastructure is hosted by Hetzner Online GmbH, a German company operating EU-based data centers. Processing by Hetzner does not involve a transfer of personal data outside the European Economic Area. Payment processing is handled by Stripe, Inc., a US-based entity. Transfers of payment data to Stripe are made pursuant to Standard Contractual Clauses under Article 46(2)(c) GDPR, incorporated into Stripe’s Data Processing Agreement.
13. Changes to This Policy
TrailACT may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or product features. We will handle updates as follows:
- Material changes: TrailACT will notify users by email before a material change takes effect, and will update the effective date on this page. Continued use following notice of a material change constitutes acceptance.
- Non-material clarifications: Minor updates that do not affect your rights or our data practices will be posted with an updated effective date without advance notice.
We encourage you to review this policy periodically. The current version is always available at trailact.com/privacy.
14. Contact and Data Rights Requests
For any question about this Privacy Policy, to exercise a data right described in Section 8, or to report a potential privacy concern, please contact:
Trail Assessment and Construction Tools, LLC
Privacy inquiries: support@trailact.com
Website: https://trailact.com/privacy