plantains

Privacy Policy

Last updated: October 15, 2026

This Privacy Policy explains how Bike Monkey, Inc. ("we", "us", "Plantains") collects, uses and shares personal information through Plantains (plantains.app), our service for event registration forms (the "Service"), and the choices and rights you have.

1. Two kinds of people, two roles

  • Account holders are the organizers and their teammates who sign up for Plantains to run events. For their information, we decide how it's used (we're the "business" or "controller").
  • Registrants are people who fill in an organizer's form to register for an event. Their information is collected for the organizer, who decides what to ask and how to use the answers. For that information we act as the organizer's service provider ("processor"), and the organizer's own privacy practices also apply. If you're a registrant with a question about your information, contact the event organizer first; we'll help them respond.

2. Information we collect

From account holders

  • Account and profile details: name, email address, sign-in method, the organization's name, and your team role. Sign-in is handled by our authentication provider (Clerk), which also stores password hashes and sign-in security information; we never see your password.
  • Billing: your plan, subscription and invoices. Card details are collected and stored by Stripe; we only see limited details such as card brand, last four digits and expiry.
  • Your Stripe connection: the ID of the Stripe account you connect, and payment, refund and payout records needed to show your money in Plantains.
  • What you create: forms, settings, codes, tags and notes.
  • Records of your acceptance of our terms (which version, when, and from which IP address), and of actions taken in your account (for example, who changed or refunded a registration).

From registrants (for the organizer)

  • Whatever the organizer's form asks, which may include name, email, phone, address, birthdate, gender, emergency contacts, team names, clothing sizes, military status, medical or allergy notes, and other answers.
  • Electronic waiver signatures: the waiver text signed, typed name, optional drawn signature, date and time, IP address and browser information, and for minors, the parent's or guardian's details.
  • Payments: amount, items bought, discounts and payment status. Card details go directly to Stripe and the organizer's Stripe account; Plantains doesn't receive or store full card numbers.
  • Sign-in codes and links registrants use to see or change their registration.

Automatically, from everyone

  • Technical and log data: IP address, browser and device type, pages requested, and timestamps, used for security, abuse prevention and fixing problems.
  • Cookies: we use only cookies needed to run the Service, such as keeping you signed in and protecting forms from automated abuse. We don't use advertising cookies or third-party ad trackers.

3. How we use information

  • To provide the Service: show and process forms, record registrations and payments, send confirmations, receipts and other transactional emails, and support check-in.
  • To run accounts and billing: sign-in, team access, subscriptions, invoices and fees.
  • To keep the Service secure: prevent fraud, spam and abuse, enforce our terms, and investigate problems.
  • To support you and communicate about the Service, including changes to our terms and service notices.
  • To improve the Service using aggregated or de-identified information.
  • To comply with law and protect rights, safety and property.

We use registrant information only to provide the Service to the organizer, as they direct, and as the law requires. We don't sell personal information, and we don't "share" it for cross-context behavioral advertising.

4. How information is shared

  • With the event organizer. Everything a registrant submits on a form goes to the organizer who runs that form and to the teammates they give access. Organizers may export it and use it under their own policies.
  • With service providers who process data for us under contracts that limit their use of it:
    • Clerk (authentication and sign-in)
    • Supabase (database)
    • Vercel (hosting)
    • Stripe (payment processing and our billing)
    • Resend (email delivery)
    • Google, if you choose to sign in with Google
  • With the services an organizer connects. When an organizer sets up an integration (a webhook to a URL they choose, a Google Sheet in their own Google Drive, a group in their own MailerLite account, or invoices in their own Xero organisation), registrations on their forms are sent there at their direction.
  • With Stripe for payments. When a registrant pays, Stripe processes the payment for the organizer under Stripe's own Privacy Policy.
  • For legal reasons: to comply with law, a court order or lawful request; to enforce our terms; or to protect the rights, property or safety of us, our users or others.
  • In a business transfer: if we're involved in a merger, acquisition or sale of assets, information may be transferred as part of it, subject to this Policy.
  • With your consent or at your direction.

5. Google user data

If you connect a Google account to Plantains (for Google Sheets), Plantains receives that account's email address and access only to the spreadsheets Plantains creates or that you choose in Google's file picker (the drive.file permission): not your other files. We use this access only to create those spreadsheets and keep them up to date with your forms' registrations, as you set up. We store the access Google gives us encrypted, and you can remove it at any time by disconnecting Google in Plantains or in your Google account's settings.

We don't use Google user data for advertising, don't sell it, don't use it to develop or train AI models, and don't let people read it except with your permission, for security, or as the law requires. Plantains' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. How long we keep information

We keep account information while your account is open. Organizers decide how long registrations are kept while their account is open and can delete them. After an account is closed, we may delete its data after 90 days. We keep some records longer when needed for legal, tax, accounting, dispute or security reasons (for example, payment records and terms acceptances), and deleted data may remain in backups for a limited time.

7. Security

We protect information with encryption in transit, access controls, and reputable infrastructure providers, and we limit access to people who need it. No system is perfectly secure; if we learn of a breach affecting your information, we'll notify you as the law requires.

8. Your rights and choices

Depending on where you live, including in California, you may have the right to:

  • know what personal information we have about you and how we use and share it, and get a copy;
  • correct inaccurate information;
  • delete your information;
  • opt out of the sale or sharing of personal information (we don't sell or share it);
  • limit the use of sensitive personal information (we only use it to provide the Service);
  • not be discriminated against for using these rights.

Account holders can update most details in the app, and can email privacy@plantains.app for anything else. Registrants should contact the event organizer, who controls their registration; you can also write to us and we'll pass your request on and help them. We'll verify your identity before acting on a request, and you may use an authorized agent. We honor Global Privacy Control signals as a request to opt out, though we don't sell or share personal information.

California residents may also ask about disclosures of personal information to third parties for their direct marketing purposes ("Shine the Light"); we don't make such disclosures.

9. Children

Plantains accounts are for adults (18 or older). The Service isn't directed to children, and children under 13 should not submit information themselves. When a minor is registered for an event, a parent or legal guardian should complete the form. If you believe a child under 13 has given us personal information without a parent's consent, contact privacy@plantains.app and we'll work with the organizer to delete it.

10. Where information is stored

Plantains is operated from the United States, and information is stored and processed in the United States. If you use it from elsewhere, your information will be transferred to the United States.

11. Changes

We may update this Policy. If we make a material change, we'll tell account holders by email or in the Service before it takes effect. The date at the top shows when it last changed.

12. Contact

Privacy questions or requests: privacy@plantains.app