Privacy Policy

This policy explains what personal data ApexTrace AI collects, why, who we share it with, how long we keep it and your rights. ApexTrace AI is run by the ApexTrace AI team, based in the United Arab Emirates, as the “controller” responsible for your personal data. The short version: we collect what’s needed to run the app, we never sell your data, we don’t use advertising trackers, and you can delete everything at any time.

What we collect, and why

*Legal bases under the UK and EU GDPR. “Contract” means we need it to provide the Service you asked for. “Legitimate interests” means a reasonable business need that doesn’t override your rights. Where we rely on consent, you can withdraw it at any time without affecting what happened before.

We don’t make decisions about you by automated means that have legal or similarly significant effects. The AI coaching is advice you can take or leave.

Who we share it with

We use trusted service providers who process data only on our instructions, to run the Service:

• Supabase: accounts, sign-in and our database (servers in Mumbai, India).
• Render: our API server, which runs the physics and the AI requests (Singapore).
• Netlify: hosts the website (global network).
• OpenAI: the AI features. We send only what the feature needs: a track map image, a track or kart name, or text found while researching a track. Never your name, email, age, weight or GPS laps. OpenAI doesn’t use data sent through its API to train its models.
• DuckDuckGo: web searches for a track or kart name when researching it. No personal data is included.
• Stripe: payments and subscriptions (Stripe acts as its own controller for fraud prevention and payment rules).
• Google or Apple: only if you choose to sign in with them.
• Our email provider: to send account emails, and marketing emails if you opted in.

We don’t sell or rent your personal data, and we don’t share it for advertising. We may disclose data if the law requires it, to protect people’s safety or our rights, or to a business that takes over ApexTrace AI (which would have to honour this policy).

International transfers

Our providers store and process data in several countries, including India, Singapore, the United States and the EU. Where data leaves the UK, the EU or the UAE, we rely on our providers’ data protection terms, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, to keep it protected to the same standard.

How long we keep it

• Your account, details, tracks and karts: until you delete them or your account. Deleting your account removes them from our live systems straight away; copies in encrypted backups expire within 30 days.
• Payment records: as long as tax and accounting law requires (usually 5 to 7 years), even after you delete your account.
• Server logs: up to 30 days.
• Data in your browser (tracks if you’re not signed in, Race Night, GPS files, preferences): until you clear it or sign out.

Your rights

Depending on where you live (including under the UK GDPR, the EU GDPR and the UAE’s Personal Data Protection Law), you have the right to:

• access the personal data we hold about you and get a copy;
• correct it: edit your details any time from Your details in the account menu;
• delete it: use Delete account in the account menu, which removes everything at once;
• take it with you in a portable format;
• object to or restrict how we use it;
• withdraw consent where we rely on it, for example to marketing or to using your weight;
• complain to a data protection authority, such as the UK Information Commissioner’s Office (ico.org.uk), your local EU authority, or the UAE Data Office. We’d appreciate the chance to sort it out first.

To use any of these rights, contact us by aryanguptafirm@gmail.com. We’ll reply within 30 days and may need to check it’s really you.

Security

Data travels over encrypted connections (HTTPS). Passwords are hashed, every database table is locked so each account can only reach its own rows, and payment details stay with Stripe. No system is perfectly secure, so if we ever have a breach that puts you at risk, we’ll tell you and the relevant authorities as the law requires.

Children

ApexTrace AI isn’t for children under 13 and we don’t knowingly collect their personal data. A parent or guardian can create an account and use it on a younger driver’s behalf. If you think a child under 13 has given us their details, contact us and we’ll delete them.

Cookies and browser storage

We use only the browser storage needed to keep you signed in and remember your work and settings. No advertising or cross-site tracking. See the Cookie Policy.

Changes

If we change this policy in a way that matters, we’ll tell you in the app or by email before it takes effect.