Privacy Policy

1. Who we are (controller)

TrackItMData ("the service") is operated by A&C Digital Ltd (registered in England & Wales, company no. [COMPANY NO.]), registered address [A&C DIGITAL LTD REGISTERED ADDRESS]. We are the data controller for the personal data described here. Our data-protection contact is [DPO/PRIVACY CONTACT EMAIL]. We are registered with the UK Information Commissioner's Office (ICO), registration [ICO REG NO.].

2. What personal data we process

TrackItMData is a motorsport lap-data analytics platform for individual drivers and teams. We process:

• Account & identity — your email, display name, and a hashed password; your account/team name and role (membership). Lawful basis: Contract.
• Driver identities & roster — driver names and pro flags held in an account's roster, and the attribution of laps/stints to a driver. Lawful basis: Legitimate interests (running the analytics) / Contract.
• Timing & telemetry — lap/sector times, positions and flags are operational data; the link to a driver is the personal element. Uploaded onboard video and telemetry (RaceLogic/AIM) may be footage/data of a person. Lawful basis: Legitimate interests / Contract (and Consent for AI parsing, below).
• Weekend logistics — who attended a race weekend (members or named guests), lodging/room assignments, and travel legs/passenger manifests. This is logistics only — we do not collect passport, national-ID or date-of-birth; a travel "reference" is a booking/flight ref, not an ID document. Lawful basis: Contract / Legitimate interests.
• Uploaded documents — tickets, credentials, paddock passes and hotel confirmations you upload may contain personal data; files are stored privately and reached only via authenticated, short-lived links. Lawful basis: Contract / Consent.
• Notes & media — free-text engineer notes and media attached to an entry may reference or depict individuals. Lawful basis: Legitimate interests.
• Invites & waitlist — an optional bound email on an invite code, a record of who redeemed which invite, and — for our marketing site — beta-waitlist and contact-form submissions (name, email, and what you told us). Lawful basis: Legitimate interests / Consent.
• Operational, security & consent logs — an append-only audit trail of governed actions (consent changes, data exports, erasures, sign-ins, authorisation denials, rate-limit trips) and cookie-consent records. Identifying values such as IP address and email are stored one-way hashed, never in the clear. Lawful basis: Legal obligation (consent/DSR records) and Legitimate interests (security). See our Cookie Policy for cookies.

The authoritative, per-collection record (our ROPA) is rendered inside the app's Privacy Center ("What data we hold"). Reference data (championships, circuits) and platform/AI/weather configuration contain no personal data.

3. Lawful bases (why we process)

• Contract (Art. 6(1)(b)) — to provide the service you or your team signed up for: your account, your teams' data, imports, analytics and weekend planning.
• Consent (Art. 6(1)(a)) — for optional features you switch on: AI parsing of image/scanned timing sheets (sends the sheet to a third-party AI provider; off by default), analytics cookies (off by default), and joining our beta waitlist. You can withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)) — running motorsport analytics, and keeping security/audit logs to protect the platform and its users. We store identifiers in these logs hashed to minimise data.
• Legal obligation (Art. 6(1)(c)) — keeping records of consent and of data-subject requests.

4. How we collect it

Directly from you (sign-up, profile, uploads, weekend planning, marketing-site forms); generated by your use (imports, analytics, logs); and, for weather back-fill, non-personal environmental readings fetched from a weather provider using a circuit's coordinates and a session date.

5. Who we share it with (sub-processors)

We do not sell your data. We use a small set of processors to run the service:

• Hosting & database — our application server and database run on a dedicated/VPS host [HOSTING PROVIDER + REGION]. EU/UK region.
• Object storage (big media) — onboard video and telemetry are stored on S3-compatible object storage [S3 PROVIDER + REGION], in a private bucket, reached only via short-lived signed URLs.
• Weather providers — historical conditions are fetched from Open-Meteo (keyless), and optionally Visual Crossing / the Met Office. Only a circuit's coordinates and a date are sent; no personal data.
• AI providers — only if you opt in to AI features: Anthropic and/or Mistral. The relevant content (e.g. an image-based timing sheet) is sent to the chosen provider to produce a result. Not used unless enabled.
• Email — transactional and beta-communication emails are sent via our email provider [EMAIL PROVIDER].

[Data-processing agreements (DPAs) with each sub-processor to be executed and referenced here.]

6. International transfers

Our hosting and storage are in the EU/UK [CONFIRM REGIONS]. Weather look-ups send only non-personal coordinates/date. AI providers may process content outside the UK/EU only when you opt in; where that involves a transfer, it is covered by the provider's transfer safeguards [e.g. UK IDTA / SCCs — TO CONFIRM].

7. Retention & deletion

We keep account and workspace data for the life of the account. When a person's seat is removed we apply an erase-vs-retain policy: we retain de-identified operational data (e.g. lap/sector rows, with the driver link removed) and remove identifying records (attribution, weekend presence, personal documents/media about that person). Uploaded document/asset bytes are deleted with their weekend or on erasure. Marketing waitlist/contact records are kept until you unsubscribe or ask us to erase them. Security/consent logs are kept as accountability records and pruned on age with governance events protected. Specific retention periods: [RETENTION SCHEDULE — TO CONFIRM].

8. Your rights & how to exercise them

You have the rights of access, rectification, erasure, restriction, portability and objection. Account holders exercise them from the in-app Privacy Center (Data rights): access/export/portability are fulfilled immediately as a machine-readable download; erasure/rectification are queued for an operator. If you don't have an account (e.g. you only joined the waitlist or sent us a message), use our self-service data request form to ask us to access or delete the data we hold for your email — we email you a link to confirm it's really you, then fulfil it. You can also use the Privacy / data request option on our contact form or email [DPO/PRIVACY CONTACT EMAIL]. We log each request.

9. Cookies

We use strictly-necessary cookies and (with consent) analytics cookies — see the Cookie Policy. Manage or withdraw consent anytime via "Cookie preferences" in the footer.

10. Security

Passwords are hashed (bcrypt); access tokens are short-lived; uploads are reached only via authenticated, short-lived links (no public URLs); audit logs never store raw IPs or secrets. [Further organisational/technical measures — TO DOCUMENT.]

11. Children

The service is not directed at children; it is a closed beta for motorsport teams and drivers [MINIMUM AGE — TO CONFIRM].

12. Changes

We may update this policy; material changes will be notified in-app and re-consent sought where required.

13. Complaints & contact

Contact us at [DPO/PRIVACY CONTACT EMAIL]. You may also complain to the UK ICO (ico.org.uk). A&C Digital Ltd, [A&C DIGITAL LTD REGISTERED ADDRESS].