Privacy Policy

1. Who we are (controller)

TrackItMData ("the service") is operated by A&C Digital Ltd (registered in England & Wales, company no. [COMPANY NO.]), registered address [A&C DIGITAL LTD REGISTERED ADDRESS]. We are the data controller for the personal data described here. Our data-protection contact is [DPO/PRIVACY CONTACT EMAIL]. We are registered with the UK Information Commissioner's Office (ICO), registration [ICO REG NO.].

2. What personal data we process

TrackItMData is a motorsport lap-data analytics platform for individual drivers and teams. We process:

• Account & identity — your email, display name, and a hashed password; your account/team name and role (membership). Lawful basis: Contract.
• Driver identities & roster — driver names and pro flags held in an account's roster, and the attribution of laps/stints to a driver. Lawful basis: Legitimate interests (running the analytics) / Contract.
• Timing & telemetry — lap/sector times, positions and flags are operational data; the link to a driver is the personal element. Uploaded onboard video and telemetry (RaceLogic/AIM) may be footage/data of a person. Lawful basis: Legitimate interests / Contract (and Consent for AI parsing, below).
• Weekend logistics — who attended a race weekend (members or named guests), lodging/room assignments, and travel legs/passenger manifests. This is logistics only — we do not collect passport, national-ID or date-of-birth; a travel "reference" is a booking/flight ref, not an ID document. Lawful basis: Contract / Legitimate interests.
• Uploaded documents — tickets, credentials, paddock passes and hotel confirmations you upload may contain personal data; files are stored privately and reached only through your signed-in session — there are no public or shareable links to them. Lawful basis: Contract / Consent.
• Notes & media — free-text engineer notes and media attached to an entry may reference or depict individuals. Lawful basis: Legitimate interests.
• Invites & waitlist — an optional bound email on an invite code, a record of who redeemed which invite, and — for our marketing site — beta-waitlist and contact-form submissions (name, email, and what you told us). Lawful basis: Legitimate interests / Consent.
• Operational, security & consent logs — an append-only audit trail of governed actions (consent changes, data exports, erasures, sign-ins, authorisation denials, rate-limit trips) and cookie-consent records. Identifying values such as IP address and email are stored one-way hashed, never in the clear. Lawful basis: Legal obligation (consent/DSR records) and Legitimate interests (security). See our Cookie Policy for cookies.

The authoritative, per-collection record (our ROPA) is rendered inside the app's Privacy Center ("What data we hold"). Reference data (championships, circuits) and platform/AI/weather configuration contain no personal data.

3. Lawful bases (why we process)

• Contract (Art. 6(1)(b)) — to provide the service you or your team signed up for: your account, your teams' data, imports, analytics and weekend planning.
• Consent (Art. 6(1)(a)) — for optional features you switch on: AI parsing of image/scanned timing sheets (sends the sheet to a third-party AI provider; off by default), analytics cookies (off by default), and joining our beta waitlist. You can withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)) — running motorsport analytics, and keeping security/audit logs to protect the platform and its users. We store identifiers in these logs hashed to minimise data.
• Legal obligation (Art. 6(1)(c)) — keeping records of consent and of data-subject requests.

4. How we collect it

Directly from you (sign-up, profile, uploads, weekend planning, marketing-site forms); generated by your use (imports, analytics, logs); and, for weather back-fill, non-personal environmental readings fetched from a weather provider using a circuit's coordinates and a session date.

5. Who we share it with (sub-processors)

We do not sell your data. We use a small set of processors to run the service:

• Hosting & database — OVH, London, United Kingdom. Our application server and database run on a dedicated virtual server there, as do uploaded video and large media. (Uploaded documents are in the separate object storage below.) OVH is an infrastructure provider: it does not use your data for anything of its own.
• Object storage (uploaded documents) — OVH Limited (OVHcloud), Paris (EU-WEST-PAR), EU. Object storage for documents uploaded by teams — championship documents, race tickets, team logos, help images, weekend documents and car setups. These files may contain personal data of team members and drivers. The bucket is private, encrypted at rest and versioned; files are reached only through our app, under your signed-in session — never by a public or shareable link. Covered by OVH’s Data Processing Agreement v6.0 (21.03.2022), and stored in the EU only.
• Content delivery network — BunnyWay, informacijske storitve d.o.o. (bunny.net), Medvode, Slovenia (EU). A content delivery network and reverse proxy in front of all our public websites: our app (app.trackitmdata.com), admin site (admin.trackitmdata.com), marketing website (www.trackitmdata.com; the bare trackitmdata.com only redirects there) and our cookieless analytics (analytics.trackitmdata.com). All traffic to those sites passes through Bunny’s EU edge servers in transit — your IP address, request metadata, browser user agent, cookies, and the page and API content. For the marketing website and analytics that means your IP address, user agent, the page URL and the referring page, and anything you submit in the marketing website’s forms (beta waitlist, contact or data request), which is sent to our app’s API. Nothing personal is cached, and API responses are never cached. Bunny’s edge logs keep your IP address anonymised (the last part dropped). Covered by bunny.net’s Article 28 Data Processing Agreement, and processed in the EU only.
• Video storage — BunnyWay, informacijske storitve d.o.o. (bunny.net Stream), Medvode, Slovenia (EU) — the same company as our content delivery network above. It stores, encodes and delivers video uploaded to our video library: onboard, pit-lane and coaching footage, which shows and may identify the drivers, crew and others filmed, together with who uploaded it and the details we attach to it (the race weekend, session, car and person it concerns). Unlike the content delivery network, which only carries traffic, Bunny keeps these videos. They are stored in Germany (EU), in one location, and delivered through Bunny’s EU edge servers. How long we keep them is in §7.
• Weather providers — Open-Meteo (keyless), and optionally Visual Crossing or the Met Office. Every look-up is made by our server and sends only a circuit’s coordinates and a date. No personal data, and no request from your browser — so they are not processors of your personal data at all, and are listed here only so you can see they were not overlooked.
• AI providers — Anthropic and/or Mistral, only if you opt in to AI parsing. The image you upload (a timing-sheet screenshot, which may show driver names) is sent to the chosen provider to be read back as numbers. It is off by default, there is no administrator override, and the feature is not currently active — no provider key is configured, so nothing has been sent to either. Processing may take place outside the UK/EU; this is the one exception to the regions above.
• Email — Brevo (Sendinblue SAS), France (EU). Transactional email — address verification, invitations, notifications. Brevo receives the recipient’s email address and name and the message we generate.
• E-signature — Zoho Corporation B.V., EU data centre. Used to circulate and sign closed-beta agreements. Zoho receives the signatory’s name and email address and the agreement document.
• Off-site backup storage — Hetzner Online GmbH, Falkenstein, Germany (EU). Our database and the files held on our server are backed up nightly to encrypted off-site storage. (Documents in the object storage above are not in these archives — that bucket keeps its own versioned copies.) The backups are encrypted before they leave our server with a key the storage provider never receives, so Hetzner cannot read any of it. How long data persists there after you delete it is in §7.

Data-processing agreements. We are being straight about this rather than implying more than we have. Two are in place: OVH’s Data Processing Agreement version 6.0 (21.03.2022) forms part of the OVHcloud Public Cloud agreement we accepted on 19 September 2026, and it covers the object storage above; and bunny.net’s Article 28 Data Processing Agreement, which we accepted on 25 September 2026, covers the content delivery network above. Our VPS hosting sits under a separate OVH agreement, and no Article 28 data-processing agreement has yet been executed and filed for it, or for Brevo, Zoho, Hetzner or the AI providers. Each publishes a standard agreement; completing them is outstanding work and this notice will be updated, naming them, when it is done.

6. International transfers

Our hosting is in the United Kingdom, uploaded documents are stored in France (Paris), video uploaded to our video library in Germany, and our backups are in the EEA (Germany). Traffic to all our public websites (app, admin site, marketing website and analytics) passes through our content delivery network’s EU edge servers (the provider is in Slovenia). Email is processed in France and e-signature in an EU data centre; the UK treats the EEA as providing an adequate level of protection, so those transfers need no additional mechanism. Weather look-ups send only non-personal coordinates and a date. AI providers may process content outside the UK/EU, but only if you opt in, and the feature is not currently active; before it is, the transfer will be covered by the provider’s safeguards (UK IDTA / SCCs) and this section will say which.

7. Retention & deletion

We keep account and workspace data for the life of the account. When a person's seat is removed we apply an erase-vs-retain policy: we retain de-identified operational data (e.g. lap/sector rows, with the driver link removed) and remove identifying records (attribution, weekend presence, personal documents/media about that person). Video in our video library is kept for 18 months from upload; after that the team is asked to review it and either keep it or delete it. Nothing is deleted automatically. A video deleted in the app, or when the account is erased, is deleted from our video storage provider too. Uploaded document/asset bytes are deleted with their weekend or on erasure. Marketing waitlist/contact records are kept until you unsubscribe or ask us to erase them. Security/consent logs are kept as accountability records and pruned on age with governance events protected. Specific retention periods: [RETENTION SCHEDULE — TO CONFIRM].

Backups. We keep encrypted off-site backups so the service can be restored after a failure. Deleting something removes it from our live systems straight away, but it remains inside backups already taken until those expire — up to 12 months. Backups are immutable, so they cannot be edited to remove one person without destroying their value as a restore point. They are encrypted such that the storage provider cannot read them (§5), they are used only to restore the service, and nothing is ever served to anyone from a backup.

8. Your rights & how to exercise them

You have the rights of access, rectification, erasure, restriction, portability and objection. Account holders exercise them from the in-app Privacy Center (Data rights): access/export/portability are fulfilled immediately as a machine-readable download; erasure/rectification are queued for an operator. If you don't have an account (e.g. you only joined the waitlist or sent us a message), use our self-service data request form to ask us to access or delete the data we hold for your email — we email you a link to confirm it's really you, then fulfil it. You can also use the Privacy / data request option on our contact form or email [DPO/PRIVACY CONTACT EMAIL]. We log each request.

9. Cookies

We use strictly-necessary cookies and (with consent) analytics cookies — see the Cookie Policy. Manage or withdraw consent anytime via "Cookie preferences" in the footer.

10. Security

Passwords are hashed (bcrypt); access tokens are short-lived; uploads are reached only through your signed-in session, with no public or shareable links; audit logs never store raw IPs or secrets. [Further organisational/technical measures — TO DOCUMENT.]

11. Children

The service is not directed at children; it is a closed beta for motorsport teams and drivers [MINIMUM AGE — TO CONFIRM].

12. Changes

We may update this policy; material changes will be notified in-app and re-consent sought where required.

13. Complaints & contact

Contact us at [DPO/PRIVACY CONTACT EMAIL]. You may also complain to the UK ICO (ico.org.uk). A&C Digital Ltd, [A&C DIGITAL LTD REGISTERED ADDRESS].