MyRacing Privacy Policy

Version 2.2 | August 2026

1. Data Controller

The controller of your personal data under GDPR is:

Cottage 13 Katarzyna Brodzka-Demianiuk (operating the MyRacing Service)
NIP: 5262197414 | REGON: 527220630
Registered address: Chlina 13, 42-439 Zarnowiec, Poland
Contact: contact@myracing.online

This Privacy Policy applies to the MyRacing marketing website (myracing.online), web application (app.myracing.online) and mobile applications (iOS and Android), collectively the "Service".

2. Information We Collect

2.1 Information You Provide

Account information: name, email address, password (bcrypt hashed), country
Profile information: racing preferences, motorcycle details, setup configurations
Racing data: lap times, tire information, maintenance records, performance analytics
Payment information: handled entirely by Stripe; we do not store card details
Telemetry data (Pulse app): precise GPS location, speed and motion-sensor data recorded during track sessions you explicitly start and stop; recording continues in the background until you end the session. Optional connected devices add heart rate (Bluetooth heart-rate sensor) and engine data (OBD-II adapter). Telemetry is stored locally on your device and uploaded to your account only when you choose to upload a session.

2.2 Service Data Collected Automatically

Device information: device type, operating system
Usage data: features accessed, session duration
Log data: IP address, browser type, access times

We also create aggregate product statistics, such as the total number of tracks, motorcycles or sessions added to the Service. We use these totals to operate and improve MyRacing.

2.3 Website Measurement, Analytics and Advertising

On myracing.online we use anonymous, cookieless measurement of how the website is used. It is first-party only, sets no cookies, uses a random identifier kept only for the current browser-tab session (cleared when the tab is closed), is not used to recognise you across sites or visits, and is not shared with third parties. Because it produces only anonymous audience statistics, it runs by default without requiring consent. You can switch it off at any time under Cookie settings, and we also treat a browser “Do Not Track” or Global Privacy Control signal as an opt-out. It records information such as pages viewed, referring page, campaign parameters, CTA clicks, app-download clicks, device/browser type and approximate session engagement. We do not store your IP address in a form that identifies you for this measurement.

The following additional tools use cookies and remain off until you allow the relevant category in the cookie banner:

Analytics (Google Analytics): collects information about visits and interactions using cookies.
Advertising: Meta Pixel and Google advertising measurement collect page visits, campaign attribution and selected intent events, such as clicking a registration or app-download link. An intent event does not mean that registration or purchase was completed. These providers may set their own cookies or similar identifiers after consent.

The web server and any providers you allow also receive technical connection data, including IP address, as part of handling a request.

2.4 Third-Party Authentication

If you use Google Sign-In, we receive your name and email from Google to create or link your account. We do not receive or store your Google password.

3. Legal Basis for Processing (GDPR Article 6)

Contract (Art. 6(1)(b)): account registration, delivering the Service, processing payments
Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, service improvement, and anonymous first-party measurement of website audience (cookieless, with an opt-out)
Legal obligation (Art. 6(1)(c)): retaining payment records under Polish tax law
Consent (Art. 6(1)(a); Art. 9(2)(a) for heart-rate data): optional cookie-based analytics (Google Analytics) and advertising measurement; heart-rate data is recorded only when you pair a heart-rate sensor — pairing constitutes your explicit consent and unpairing stops collection; withdrawable at any time

4. How We Use Your Information

Provide, maintain, and improve the Service
Process transactions and manage subscriptions via Stripe
Send technical notices and support messages
Analyse usage patterns to enhance user experience
Generate anonymised aggregated analytics
Comply with legal obligations

5. Data Sharing and Disclosure

We do not sell your personal data. We share it only as follows:

5.1 Service Providers

Stripe, Inc. (USA) — payment processing and transactional emails. Transfer mechanism: Standard Contractual Clauses (SCCs). DPA included in Stripe standard terms.
Google — authentication (Google Sign-In) and, after the relevant website consent, Google Analytics, Google Tag Manager and Google advertising measurement. Google describes its privacy practices at policies.google.com/privacy.
Meta — after advertising consent, Meta Pixel for campaign measurement and attribution. Meta describes its privacy practices at facebook.com/privacy/policy.
Hostinger International Ltd. (EU/Lithuania) — hosting, VPS infrastructure, and transactional email (account verification, password reset). Data stored within the EU. No third-country transfer.
AI service (self-hosted Ollama on controller-owned infrastructure) — AI Racing Coach query processing. No third-party processor.

5.2 Legal Requirements

We may disclose data where required by law or to protect the rights and safety of MyRacing or our users.

5.3 Business Transfers

In a merger or acquisition your data may transfer. We will notify you before it becomes subject to a different privacy policy.

6. International Data Transfers

Some providers, including Stripe, Google and Meta, may process data outside the EEA. Where required, they use transfer safeguards such as the European Commission's Standard Contractual Clauses. Contact us for details of safeguards for a specific transfer.

7. Data Retention

Account and profile data: retained for account duration; deleted within 30 days of account closure
Racing and performance data: retained for account duration; deleted with account
Payment and transaction records: 5 years from transaction date (Polish tax law)
Server log data: maximum 12 months, then deleted
AI Racing Coach queries: not stored in persistent form linked to your identity
Website consent choice: stored in your browser until you clear site data or we replace it with a new consent version
Optional website analytics and advertising data: retained according to the settings and retention rules of the relevant analytics or advertising service

8. Data Security

HTTPS/TLS encryption in transit
bcrypt password hashing
CSRF protection on all state-changing operations
Access controls limiting data to authorised personnel
Regular security assessments

9. Your Rights Under GDPR

Access (Art. 15): request a copy of your data
Rectification (Art. 16): request correction of inaccurate data
Erasure (Art. 17): request deletion, subject to legal retention obligations
Restriction (Art. 18): request limits on how we use your data
Portability (Art. 20): receive your data in machine-readable format
Object (Art. 21): object to processing based on legitimate interests
Withdraw consent (Art. 7(3)): at any time for consent-based processing
Lodge a complaint (Art. 77): with the Polish DPA — Urzad Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl — or your local supervisory authority

To exercise these rights: contact@myracing.online or use self-service tools at app.myracing.online/profile. We respond within 30 days.

10. Children's Privacy

The Service is not directed to anyone under 16. We do not knowingly collect data from children under 16. Contact us immediately if you believe we have done so.

11. Cookies, Similar Storage and Your Choices

Essential storage is used to operate the website and remember the choices made in the banner. Beyond that:

Website measurement (on by default, no cookies): anonymous first-party measurement of how the website is used. It sets no cookies and does not track you across sites. It runs without consent because it produces only anonymous statistics; you can switch it off under Cookie settings, and we treat a browser “Do Not Track” or Global Privacy Control signal as an opt-out.
Analytics (Google Analytics): off until you allow it. Uses cookies.
Advertising: Meta Pixel and Google advertising measurement. Off until you allow it.

Before you make a choice, no cookie-based analytics or advertising service is loaded. If you reject analytics, Google Analytics is not loaded and Google receives an analytics-denied signal. If you reject advertising, Meta Pixel is not loaded and Google receives advertising-denied signals. Google Tag Manager is used only when at least one cookie-based category has been allowed and applies the separate Google consent signals for each category. You can accept all, reject all or choose categories separately, and change or withdraw your choice at any time using the Cookie settings button in the footer; anonymous website measurement can be switched off there too. Changing a consent choice is followed by a page reload so disabled scripts stop running; known optional cookies for the rejected category are removed from the MyRacing domain.

12. Changes to This Policy

We will notify you of material changes by email and/or notice within the Service at least 14 days before they take effect.

13. Contact

Cottage 13 Katarzyna Brodzka-Demianiuk (operating as MyRacing)
Email: contact@myracing.online
Website: https://myracing.online
Address: Chlina 13, 42-439 Zarnowiec, Poland

We respond to all data protection enquiries within 30 days.