Privacy policy
Draft for racegenie.app. Last updated: [DATE].
Who we are
Genie Dynamics Ltd ("we", "us") runs the service. We are a company registered in England and Wales, company number 17494764, registered office 128 City Road, London, EC1V 2NX. Our ICO registration number is [ICO NUMBER].
Contact us about your data: team@geniemotorsport.com.
Our two roles
We have two different roles under UK data protection law, depending on the data.
We are the controller (we decide why and how the data is used) for:
- your account and sign-in (name, email, which teams you belong to and your role);
- your myRaceGENIE driver profile, your age answer, your photo, your uploads, your stats and your public CV;
- the iPhone app (push token, app version, notification settings);
- billing for team owners;
- support requests;
- security records (server logs, the audit log, sign-in and access checks).
For this data, this policy applies and you contact us: team@geniemotorsport.com.
We are the team's processor (we handle data for the team, on its instructions) for the data a team puts into GenieCloud: its cars, meetings, sessions, recordings, laps, stints, fuel, video, line-ups, plans, debriefs, and its notes about its drivers and crew. The team is the controller of that data. It decides what to record, who in the team sees it and how long to keep it. Our agreement with the team (the team terms and data processing agreement, https://cloud.racegenie.app/team-terms) says what we may do with it: only run the service for the team.
If you want to see, correct or delete data a team holds about you, ask the team (its owner or manager). We will help the team answer. If you ask us, we will pass your request to the team.
This policy covers three products:
- raceGENIE, the Mac app. It works on your Mac. It sends nothing to us unless you sign in to GenieCloud and turn on sync, backup or video upload.
- GenieCloud, the team cloud (the team website and the services behind the apps).
- myRaceGENIE, the driver app for iPhone and the driver website.
What we hold
Your account (all products)
- Your name and email address, and your sign-in details. Sign-in is run by Clerk (see "Who we share it with").
- Which teams you belong to and your role in each.
- For myRaceGENIE: your age answer ("16 or over", or "16 or 17 and my parent or guardian agrees"), with the time you gave it.
Team data in GenieCloud
Your team uploads and owns this. It can include:
- cars, drivers, meetings, sessions, plans, notes and debriefs;
- driving data: telemetry, laps, stints and fuel;
- video (a reduced copy, uploaded from the team's Mac) and library backups;
- driver profiles: display name, name on licence, nationality, clubs, licence grade and expiry, helmet and HANS approval dates, and your weight in full kit and helmet (one current value with the date you set it, used for ballast). Licence and weight are stored encrypted. A team reads only the fields you tick for that team.
- a log of who changed what in the team (the audit log).
Your own data in myRaceGENIE
- Profile photo (location and camera details are stripped from the picture).
- Timing sheets you upload (PDF or CSV), the sessions and results read from them, and your stats.
- Your public racing CV, if you choose to publish one.
- Reminder and notification settings.
- Your phone's notification token (see below) and the app version.
Technical data
- Our servers log requests. The log includes your IP address, the time, the address requested and the result. API logs are kept for 90 days.
- Your phone gives us a push notification token so we can send you alerts. We also record which app version each device uses.
- We do not use advertising or analytics trackers. We do not use your location, camera or microphone.
Why we use it, and our lawful basis
| What | Why | Lawful basis |
|---|---|---|
| Account, teams, roles | To run your sign-in and your team's workspace | Contract |
| Team data, backups, video | To give the team the service it pays for | Contract |
| Driver profile, history uploads, stats | To give drivers myRaceGENIE | Contract |
| Notifications and emails about meetings, plans and announcements | To tell you what your team has sent. You can turn reminders off in the app | Contract; legitimate interest |
| Server logs, audit log, security checks | To keep the service secure and find misuse | Legitimate interest |
| Billing records (team owners) | To take payment and keep tax records | Contract; legal obligation |
| Public racing CV | To show it by link, only if you publish it | Consent. You can unpublish at any time |
| Guardian consent record (16 and 17) | To show we had a parent or guardian's agreement | Legal obligation; legitimate interest |
Our legitimate interests are running a secure service and preventing misuse. They do not override your rights.
Who sees your data
- Your team. What the team sees depends on the team's sharing rules and your own choices. Your team owns the team's records. You own your own part, such as your uploads and your profile. If a team stops sharing with you, you keep your own uploads.
- Other teams never see your data, unless you choose to share your personal benchmarks.
- The public sees only a racing CV you have published, and only what you chose to show.
- Our staff look at a team's data only while a team owner has given permission, for a limited time, and each look is logged where the team's owners can see it. Staff see counts and settings, never laps, notes, profiles or video.
- Our processors (companies that handle data for us, under contract):
| Processor | What for | What it gets | Where |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, storage, database, email sending (SES), AI analysis (Bedrock) | All the data above | London (eu-west-2). The website files are also served through CloudFront's edge network, which has no personal data beyond request details |
| Clerk | Sign-in, teams and invitations | Name, email, sign-in details, team membership | United States |
| Stripe | Team billing | Team owner's name, email and payment details. Card numbers go to Stripe only | United States and elsewhere, under Stripe's terms [CONFIRM] |
| Expo | Delivering push notifications to the iPhone app | Your push token and the notification text | United States |
For a team's data, these companies are our sub-processors under the team terms and data processing agreement, and we act on the team's instructions.
We do not sell your data. We do not show ads. We do not track you across other companies' apps or websites.
Aerial imagery. Circuit aerial imagery from Bluesky can be viewed inside the app only. It is not part of your data and you cannot download it.
Transfers outside the UK
Clerk, Stripe and Expo are based in the United States. We rely on [CONFIRM WITH EACH: the UK-US data bridge certification, or the UK addendum to the international data transfer agreement] and the data processing agreements we have signed with them. AWS holds your data in London.
How long we keep it
- While your account or team is active: we keep your data.
- If a team's paid plan ends: its data is read-only for 90 days. Then the cloud copy is deleted.
- If a team owner deletes the team: it closes after a cooling-off period and its data is erased 90 days later.
- Backups: database backups roll off within 35 days. Earlier versions of stored files are kept for 30 days after a deletion.
- Server logs: 90 days.
- If you delete your account: your account goes 7 days after you confirm, and your own data 30 days after you confirm (see the account deletion page).
- Billing records: as long as tax law requires [CONFIRM: usually six years].
Your rights
You can ask us to:
- show you the data we hold about you (access) and give you a copy (export);
- correct it;
- delete it;
- stop using it for a purpose based on legitimate interest (object);
- restrict how we use it, or move it to another service.
Email team@geniemotorsport.com. We reply within one month. Some of these you can do yourself:
- Delete your account: in the app or on the website (Profile, then Your data). See the account deletion page.
- Export your data: in the app or on the website (Profile, then Your data). You get a zip of everything we hold about you; the download is kept for 7 days.
- Correct your details: in Profile, in the app or on the website.
- Unpublish your CV: in Profile.
If you are unhappy, tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Young drivers
You must be 16 or over to use myRaceGENIE. If you are 16 or 17, a parent or guardian must agree, and you confirm that in the app. We record when. You cannot publish a public CV without that agreement. We do not knowingly hold data about anyone under 16. If we find we do, we delete it. A team may hold a junior driver's details in its own records; the team is responsible for having the right permission from the parent or guardian.
Special category data
We do not collect health data. GenieCloud and myRaceGENIE do not hold your date of birth, licence number, emergency contact or any medical information. Your age is recorded only as an answer ("18 or over" or "16 or 17"). A team may record its own medical check or emergency contact for a meeting in raceGENIE on its own Mac; that stays on the team's Mac and is never sent to GenieCloud. Please do not put health data in notes or uploads.
Security
Data is held in AWS London, encrypted at rest, and sent over encrypted connections. Licence and weight are encrypted again at field level. Each team's data is separated and checked on every request. An independent security review is planned before launch. [CONFIRM before publishing; remove if not done.]
Cookies
See the cookie notice. We use sign-in cookies only.
Changes
If we change this policy in a way that matters, we will tell team owners and drivers by email or in the app before it takes effect.