Privacy Policy

1. Data Controller

The controller responsible for data processing on this website is:

Apex Telemetry
Email: [email protected]

2. Purposes and Legal Bases

We process personal data only to the extent required under applicable law, including the GDPR.

• Website operation, security, and abuse prevention (Art. 6(1)(f) GDPR).
• User account authentication and account access (Art. 6(1)(b) GDPR).
• Payment processing and subscription management (Art. 6(1)(b) GDPR).
• Customer support and communication (Art. 6(1)(b) or Art. 6(1)(f) GDPR).
• Compliance with legal obligations (Art. 6(1)(c) GDPR).

We use your email address to send you account notifications, coaching session summaries, product updates, and relevant sim racing content. We will never sell your data to third parties.

3. Categories of Data

• Account data: email address, user ID, role, and subscription status.
• Driving data: the laps and sessions you record with the desktop app or the Android app from your Gran Turismo 7 sessions (car, track, lap times, and the telemetry of each lap), the app version and platform you use, and the coaching results we calculate from them.
• Usage data: requested pages, request timestamps, and technical request metadata.
• Payment data: transaction and billing details handled through Stripe.
• Communication data: support requests and messages, feedback you send (including the score, comment and, if you give it, your name, plus technical details such as IP address, country and city), notes you write about your sessions, and your newsletter and email preferences.

When you create an account, we collect your email address and record your consent to receive platform communications. We store the date and time this consent was given.

4. Processors and Recipients

We use external service providers that process data on our behalf or under their own responsibility:

• Supabase (authentication and user management): Privacy Policy
• Stripe (payment processing): Privacy Policy
• Cloudflare (hosting, CDN, edge infrastructure, and storage of recorded session files): Privacy Policy, DPA
• Railway (hosting of the service that analyses your sessions): Privacy Policy
• Resend (delivery of account, coaching and newsletter emails): Privacy Policy

5. International Transfers

Data may be processed outside the EU/EEA (including the United States). Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses under Art. 46 GDPR or other lawful mechanisms.

6. Retention Periods

• Account data: until you delete your account (see "Deleting Your Account" below) or the end of the processing purpose.
• Billing and payment records: as required by applicable legal retention obligations; they are kept by our payment provider.
• Security and server logs: only for as long as necessary for operations and security.
• Support data and feedback: until your account is deleted, then removed (see below).
• Backups: overwritten automatically on a rolling schedule; a deleted account is never restored from a backup.

We retain your personal data for as long as your account is active.

7. Deleting Your Account

You can delete your account yourself at any time: sign in, open Account (in the Android app, the Account tab), go to the Danger Zone and choose Deactivate Account. If you cannot sign in, email us and we will delete the account within 30 days. The steps are explained on our account deletion page.

When an account is deleted:

• Your name, email address, login and password recovery details, subscription, newsletter subscription, email preferences, feedback comments, session notes and support messages are deleted straight away and can no longer be restored.
• Your lap times and session history are kept, but only in anonymized form: they carry no name, email address or other contact detail, and nobody can connect them to you. We keep them so that leaderboard times and our overall driving records stay correct for other drivers. Because this data can no longer be linked to a person, it is no longer personal data.
• Your customer record at Stripe (name and email address) is deleted. Payment and billing records are kept by Stripe for as long as the law requires. Routine backups age out automatically and are never used to restore a deleted account.

8. Your Rights

Under GDPR, you may have the right to access, rectify, erase, restrict, object, and receive a portable copy of your data.

To exercise your rights, contact us at [email protected].

You have the right to access, correct, or delete your personal data at any time. To unsubscribe from marketing emails, click the unsubscribe link in any email or contact us at [email protected]. You can delete your account yourself as described in section 7, or ask us to do it at the same address.

9. Complaints

You have the right to lodge a complaint with a supervisory authority if you believe your personal data is processed unlawfully.

10. Policy Updates

We may update this Privacy Policy to reflect legal, technical, or operational changes.