Your Privacy Matters

Introduction

RaceOps (“we,” “our,” or “us”) operates the RaceOps platform at raceops.app. This Privacy Policy explains how we collect, use, share, and protect your information when you visit our website, use our platform, or interact with our services.

We believe privacy is a fundamental right, not a feature. RaceOps is built on a foundation of transparency, minimal data collection, and respect for the people who trust us with their information.

This Privacy Policy applies to all users of our website and platform, including visitors to our consumer website, registered platform users, beta signup participants, demo requestors, and career applicants.

Information We Collect

Personal Information You Provide

When you interact with RaceOps, you may provide personal information including:

• Account Information: Email address, name, and password (stored in hashed form, never in plain text) when you create a platform account
• Beta Signup: Email address when you sign up for early access
• Demo Requests: Name, email address, phone number, company or team name, team size, racing series, and any message you include
• Career Applications: Name, email address, LinkedIn profile URL, and application message
• Community Feedback: Display name and feedback content when participating in our community platform

Operational Data

When you use the RaceOps platform as a registered user, you may store operational data related to your racing team, including asset inventories and compositions, compliance records and safety certifications, workflow procedures and work orders, personnel information and role assignments, location and venue data, vendor and purchase order records, track event schedules and results, driver resumes and qualifications, and engineering logs and notes.

This operational data belongs to you and your racing team. We process it solely to provide and improve our services.

Automatically Collected Information

When you visit our website, we automatically collect limited usage data through Umami, our self-hosted, privacy-focused analytics platform. Umami does not use cookies, does not track individuals across sessions, and does not collect personally identifiable information.

The usage data we collect includes:

• Page views and navigation patterns
• Scroll depth and section engagement
• Referral sources
• Device type and browser information (aggregated, not individual)
• Geographic region (country-level only, derived from IP address which is not stored)

We also capture UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) from marketing links to understand how visitors discover RaceOps. These parameters are associated with form submissions, not with browsing behavior.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the RaceOps platform
• Process your beta signup, demo request, or career application
• Send transactional communications related to your account or requests
• Understand how visitors interact with our website to improve the experience
• Ensure platform security, prevent fraud, and maintain audit trails
• Comply with legal obligations
• Respond to your inquiries and support requests

We do not sell your personal information. We do not use your data for advertising. We do not build behavioral profiles of our website visitors.

How We Share Your Information

We do not sell, rent, or trade your personal information with third parties for their marketing purposes. We may share information in the following limited circumstances:

• Service Providers: We use infrastructure providers (Amazon Web Services) to host our platform. These providers process data on our behalf under contractual obligations to protect your information.
• Platform Notifications: If your team administrator enables Slack integration, certain platform notifications may be sent to configured Slack channels. This is opt-in and controlled by your team administrator.
• Legal Requirements: We may disclose information if required by law, legal process, or government request, or to protect the rights, safety, or property of RaceOps, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify affected users before their information becomes subject to a different privacy policy.
• With Your Consent: We may share information with third parties when you explicitly consent to such sharing.

Data Security

We implement industry-standard security measures to protect your information including:

• Encrypted data transmission via TLS/HTTPS on all connections
• Hashed passwords using industry-standard algorithms (never stored in plain text)
• Tenant-isolated databases ensuring your team's data is completely separated from other organizations
• Role-based access control (RBAC) with 44+ granular permission types
• Forensic-grade audit logging of all platform operations
• JWT-based authentication with secure token rotation
• Infrastructure security through AWS with regular security reviews

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but we are committed to promptly addressing any security incidents.

Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this policy:

• Active Accounts: Account and operational data is retained for the duration of your active account.
• Inactive Accounts: We may retain account data for up to 12 months after account inactivity before deletion.
• Beta Signups & Demo Requests: Contact information is retained for up to 24 months or until you request deletion.
• Career Applications: Application data is retained for up to 12 months after submission.
• Analytics Data: Aggregated, anonymized analytics data may be retained indefinitely as it cannot identify individuals.
• Audit Logs: Forensic event logs are retained for the life of your account to maintain data integrity and compliance capabilities.

You may request deletion of your personal information at any time by contacting us at privacy@raceops.app.

Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate personal information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Data Portability: Request your data in a structured, commonly used, machine-readable format.
• Opt-Out: Opt out of marketing communications at any time.
• Restriction: Request restriction of processing of your personal information in certain circumstances.

To exercise any of these rights, contact us at privacy@raceops.app. We will respond to verified requests within 30 days.

California Residents

Under the California Consumer Privacy Act (CCPA), you have additional rights including:

• The right to know what personal information is collected and how it is used
• The right to delete personal information
• The right to opt-out of the sale of personal information (note: we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

European Residents

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR) including the rights listed above and the right to lodge a complaint with your local data protection authority.

Children's Privacy

RaceOps is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete such information.

If you believe a child under 16 has provided us with personal information, please contact us at privacy@raceops.app.

International Data Transfers

RaceOps is based in the United States and our servers are located in the United States. If you are accessing our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States.

By using our services, you consent to the transfer of your information to the United States. We take appropriate measures to ensure that your information receives an adequate level of protection in accordance with applicable data protection laws.

Third-Party Services

Our platform integrates with or relies on the following third-party services:

• Amazon Web Services (AWS): Cloud infrastructure hosting, content delivery (CloudFront), and storage. AWS processes data under their shared responsibility model.
• Umami Analytics: Self-hosted on our infrastructure. No data is shared with third parties. Privacy-focused by design with no cookies, no personal data collection, and no cross-site tracking.
• Slack: Optional integration for platform notifications. Only enabled when configured by your team administrator. Data shared is limited to notification content.

Each third-party service has its own privacy policy. We encourage you to review their policies if you have concerns about their data practices.

Cookies and Tracking Technologies

RaceOps takes a minimal approach to tracking:

• We do not use advertising cookies.
• We do not use third-party tracking pixels.
• We do not use cross-site tracking technologies.
• Our analytics platform (Umami) is self-hosted and operates without cookies.

We use essential cookies only for authenticated platform sessions (JWT authentication tokens), session management and security, and user preferences (such as theme selection).

These essential cookies are strictly necessary for platform functionality and cannot be disabled while using the platform.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify users by:

• Posting a prominent notice on our website
• Updating the “Last Updated” date at the top of this policy
• Sending email notification to registered users for significant changes

We encourage you to review this Privacy Policy periodically. Your continued use of our services after any changes constitutes acceptance of the updated policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

RaceOps Privacy Team
Email: privacy@raceops.app
Website: raceops.app

For data protection inquiries, please include “Privacy Request” in your subject line to ensure prompt handling.