DriverPeak Privacy Policy

Draft — last updated [DATE]. This is a working draft prepared for internal review and does not constitute legal advice. Have this reviewed by a qualified attorney familiar with your operating jurisdictions before publishing.

1. Who we are

DriverPeak ("we," "us," "our") provides a platform for uploading, analyzing, and comparing motorsports telemetry data. This policy explains what information we collect, how we use it, and the choices you have.

2. Information we collect

Account information — email address, display name, and password (stored as a salted hash, never in plain text).

Team and role information — team memberships, roles (driver, coach, admin), and invite activity.

Vehicle and session metadata — car details you enter (name, make, model), session type, and the track you upload a session against.

Telemetry data — the raw contents of files you upload (e.g. .vbo, .xrk, .xrz, .ld, .ldx, .ibt), including GPS location traces recorded by your logging hardware or simulator during a driving session, along with vehicle data such as speed, throttle, brake, RPM, and gear.

Device sync data, if you use the desktop sync agent — a device identifier and an upload-scoped access token tied to your account. The agent does not transmit any data other than the telemetry files you've configured it to watch.

Usage data — standard technical logs (IP address, browser/device type, timestamps) generated by using the service.

3. GPS and location data — a specific note

Telemetry files you upload may contain GPS coordinates recorded during a driving session. This location data reflects where a vehicle was driven (e.g. a racetrack), not your personal home address or day-to-day movements, but we treat it with the same care as other location data. We do not sell this data, and we do not use it to track you outside the context of the sessions you choose to upload.

4. How we use your information

To provide the core service: parsing your uploaded files, detecting laps, computing comparisons, and displaying your session history.
To operate team features: showing your sessions to team members you've joined or invited, per your team's configuration.
To maintain and improve the service, including diagnosing bugs and understanding how features are used in aggregate.
To communicate with you about your account, security notices, or changes to this policy.
To enforce our Terms of Service and prevent abuse (e.g. rate limiting).

We do not sell your personal information or telemetry data to third parties.

5. Who can see your data

You always have access to your own sessions and data.
Members of a team you belong to can see sessions uploaded under that team, according to the team's structure — this is a core, intentional feature of the product, not incidental sharing. Team membership is only granted via an explicit invitation you accept, or by you creating/joining a team yourself.
We (DriverPeak staff) may access data as needed to provide support, investigate issues, or maintain the service — we do not access your data for any other purpose.
We do not share your data with advertisers, data brokers, or any third party for their own marketing purposes.

6. Data retention

We retain your account and session data for as long as your account is active. If you delete your account, we will delete your personal information and uploaded telemetry within [X days], except where retention is required by law or for legitimate business purposes such as fraud prevention.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at [privacy email]. We will respond within the timeframe required by applicable law.

If you are in the European Economic Area or UK, you have rights under the GDPR/UK GDPR, including the right to lodge a complaint with your local data protection authority.

If you are a California resident, you have rights under the CCPA/CPRA, including the right to know what personal information we collect and to request deletion.

This section needs jurisdiction-specific legal review — DriverPeak's actual target markets should be confirmed and each region's requirements addressed explicitly, not just referenced generally.

8. Data security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS) and hashed credential storage. No system is completely secure, and we cannot guarantee absolute security.

9. Third-party services

We use third-party infrastructure providers (e.g. hosting, database, and monitoring services) to operate DriverPeak. These providers process data on our behalf under appropriate agreements and do not use your data for their own purposes.

List actual sub-processors here once finalized — e.g. Railway, and any monitoring/analytics tools in use.

10. Children's privacy

DriverPeak is not directed at children under [13/16, per applicable law]. If you believe a child has provided us with personal information, contact us and we will delete it.

Note: motorsports, and karting specifically, involves minors as drivers with adult account holders — this section needs careful legal thought given that context, not a generic template answer.

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes via email or a notice within the app.

12. Contact us

Questions about this policy: [privacy email / contact method]

Reminder: this draft is a starting point, not a finished legal document. Before publishing, have it reviewed against DriverPeak's actual data practices, target jurisdictions, and applicable law (GDPR, CCPA, and any motorsports/minor-specific considerations).