Privacy Policy

Version 1 · Effective date: October 21, 2026

Data controller: Infobit LLC, 407 Lincoln Road, Suite 6G, Miami Beach, Florida 33139, United States
Privacy contact: [email protected]

1. Scope

This Privacy Policy explains how Infobit LLC collects, uses, stores, shares, protects and deletes personal data in connection with RaceData.

It applies to the public website, forms, free trial, platform, subscriptions, support, communications, artificial intelligence features, cookies, analytics and all other interactions with RaceData.

2. Roles of Infobit LLC

Infobit LLC acts as data controller with respect to account, billing, usage, support, security and RaceData's own marketing data.

With respect to the data that the customer uploads or manages on the platform (for example, data about drivers, team members, files and technical data), the customer acts as data controller and Infobit LLC acts as data processor, in accordance with the Data Processing Agreement (DPA) included in Part D of the RaceData Security, Data and Communications document. Individuals whose data was uploaded by a customer may address their requests to that customer or to [email protected], and RaceData will channel them accordingly.

3. Data we collect

We may collect:

• Account data: first name, last name, email, phone number, country, team, organization, role and credentials.
• Billing data: purchased plan, billing cycle, payment status, invoices and the data necessary to process payments through Stripe. RaceData does not store full card data.
• Usage data: IP address, browser and device (user agent), logs, in-app events, activation actions, configuration, sessions, access records, and date and time of use.
• Data uploaded by the customer: files, setups, lap times, spreadsheets, car data, racing series, sessions, tyres, fuel, tasks, reports, comments and other uploaded information. Supported file types include CSV, XLSX, PDF, images, videos, data acquisition files (MoTeC, AIM, RaceLogic, among others) and ZIP, with a limit of 2 GB per file.
• Motorsport technical data: performance information, geolocation/GPS data contained in files uploaded by the user, technical history and operational data. Onboard videos uploaded by the user may include visible faces, voices or license plates.
• Support data: messages, access authorizations, tickets and assistance history.
• Marketing data: communication preferences, newsletter, email engagement, forms, cookies and pixels.
• AI data: prompts, responses, generated reports and the context used by AI features.

In the case of invited users who are minors (13 years of age or older, or the higher minimum age required by applicable law), RaceData will only process the minimum access data: first name, last name, email and phone number, under the responsibility of the account holder who issues the invitation and who represents that they have the consent of the minor's parents or guardians. RaceData does not knowingly collect data from children under 13; if it becomes aware of such collection, it will delete the data.

RaceData is not designed to store health, biometric or medical data.

4. Purposes

We use data to:

• Create and manage accounts.
• Verify email addresses.
• Provide the service.
• Manage the free trial, subscriptions, payments and billing.
• Enforce plan limits and overages.
• Provide support.
• Maintain security, auditing and abuse prevention.
• Send transactional and onboarding communications.
• Send commercial communications where consent or another valid basis exists.
• Improve the user experience.
• Comply with legal obligations.
• Operate AI features when enabled.

5. Legal bases

Where regulations such as the GDPR (European Union), the LGPD (Brazil), Law 25,326 (Argentina) or other data protection laws apply, the legal bases may include: performance of a contract, consent, legitimate interest, compliance with legal obligations, and protection of security and fraud prevention.

6. Customer data and confidentiality

Technical and sporting data uploaded by the customer is considered confidential by default. RaceData may use aggregated and anonymized data for statistics and product improvement; it does not perform anonymized benchmarking that directly compares one customer against others, except with express authorization or an accepted change of terms.

7. Payments

Payments are processed exclusively through Stripe and are charged by Infobit LLC in the United States. Stripe may process payment data in accordance with its own policies. RaceData does not store full card numbers or security codes.

8. Subprocessors

RaceData may share data with providers necessary to operate the service, including hosting, database, storage, transactional email, analytics, monitoring, AI, payments and marketing automation providers. The current list of subprocessors is available in Part E of the RaceData Security, Data and Communications document.

RaceData does not sell personal data.

9. Artificial intelligence

RaceData may use AI providers such as Anthropic and OpenAI. AI features may process customer data to generate recommendations or reports. RaceData does not use customer data to train AI models. Prompts and responses are stored until the customer deletes them or, at the latest, until the account is deleted in accordance with the retention periods.

10. Cookies, analytics and pixels

RaceData may use cookies, analytics, advertising pixels and similar technologies to operate the website, measure usage, improve campaigns and perform remarketing. Users can manage their preferences as described in Part A (Cookies) of the RaceData Security, Data and Communications document.

11. International transfers

RaceData hosts and processes data on Amazon Web Services (AWS), in the Virginia and Oregon regions (United States), and may transfer it to other countries where its subprocessors operate. Where required by applicable law, RaceData will apply appropriate transfer mechanisms, such as the Standard Contractual Clauses approved by the European Commission and other reasonable contractual, technical and organizational measures to protect the data.

12. Retention

Data is retained for as long as necessary to provide the service, comply with legal obligations, resolve disputes and enforce retention policies. Data from free trials that do not convert may be deleted 90 days after the end of the trial. Data from cancelled accounts will be retained for 90 days to allow reactivation and export on request, and may then be permanently deleted. Details are set out in Part C of the RaceData Security, Data and Communications document.

13. User rights

Depending on the applicable jurisdiction, users may request access, rectification, updating, deletion, objection, restriction, portability of their data, or withdrawal of consent. Requests may be sent to [email protected]. RaceData will respond within 30 days of receiving the request, unless applicable law establishes a shorter period, and may request information to verify the identity of the requester.

Users also have the right to lodge a complaint with the competent data protection authority, such as the supervisory authority of their country of residence in the European Union, the Autoridade Nacional de Proteção de Dados (ANPD) in Brazil, or the Agencia de Acceso a la Información Pública (AAIP) in Argentina.

For users in Argentina: the data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is demonstrated, as established in Section 14, subsection 3 of Law No. 25,326. The Agencia de Acceso a la Información Pública, in its capacity as the supervisory body of Law No. 25,326, has the authority to handle complaints and claims filed by those whose rights are affected by non-compliance with the applicable personal data protection rules.

For users in Brazil and in other jurisdictions that require a contact channel for data subjects: Infobit LLC designates [email protected] as its contact channel.

14. United States residents

Where United States state privacy laws apply (such as the California Consumer Privacy Act), residents of those states may exercise their rights of access, deletion, correction and opt-out by writing to [email protected]. RaceData does not sell personal data. The use of advertising pixels for remarketing purposes may be considered "sharing" data for behavioral advertising; users may opt out through the cookie settings or by writing to [email protected]. RaceData will not discriminate against anyone who exercises these rights.

15. Security

RaceData applies security measures such as HTTPS/TLS, encryption at rest for confidential data, daily backups, weekly restoration tests, audit logs, malware scanning and access controls. RaceData will also offer two-factor authentication (2FA).

16. Security breaches

In the event of a security incident affecting personal data, RaceData will notify affected customers without undue delay and, at the latest, within 72 hours of confirming the incident, and will notify authorities and data subjects where required by applicable law. RaceData also communicates relevant incidents in real time through status.racedata.app.

17. Communications

RaceData may send transactional communications related to the service. Commercial communications, newsletters or promotions require separate, optional consent, with their own unsubscribe mechanism.

18. Changes to this Policy

RaceData may modify this Privacy Policy. Material changes will be notified in accordance with the RaceData Terms of Service.

19. Contact

Privacy inquiries: [email protected].