Privacy Policy

This policy explains what personal data PitManager processes, why, and what rights you have. The controller for account and billing data is [operator legal name], [registered address], reachable at [contact email]. For personal data your team enters about its members, drivers or crew, the team (through its owner) determines the purpose — we process that data on the team's behalf to provide the Service.

1What we collect

• Account data — name, surname, email, password (stored only as a bcrypt hash), optional avatar, phone and emergency-contact details you choose to add.
• Team and operations data — everything your team enters: vehicles, parts, service records, jobs, tyres and brakes, setups, calendars, championship entries, compliance records, timing connections.
• Media — photos, incident videos and documents your team uploads.
• Billing data — plan, invoices, billing profile (company name, address, VAT number). Card or bank details go directly to our payment provider and never touch our servers.
• Security and audit data — login and security events with IP address and timestamp, kept in an audit log.
• Support data — messages you send through the support channel.

We do not run advertising trackers and we do not sell personal data.

2Why we process it (legal bases)

• Providing the Service (contract, GDPR art. 6(1)(b)) — accounts, team features, storage, live timing, support.
• Billing and bookkeeping (contract and legal obligation, art. 6(1)(b)–(c)) — subscriptions, invoices, tax records.
• Security (legitimate interest, art. 6(1)(f)) — audit logs, rate limiting, abuse prevention, breach-password checks at signup.
• Service messages (contract) — verification, password-reset, billing and important product emails. We do not send marketing email without separate consent.

3Who processes it for us

We use a small set of processors, each bound by a data-processing agreement:

Where a provider processes data outside the EU/EEA, transfers rely on an adequacy decision or the EU Standard Contractual Clauses.

When your team connects an external live-timing feed, timing data flows from that provider through our relay to your browser; we act only as a conduit for that feed.

4How long we keep it

• Active accounts and teams — for as long as the account or team exists.
• After cancellation or team deletion — a 90-day grace period during which the owner can recover the data, after which it is permanently purged, including media in storage.
• Deleted user accounts — deactivated immediately; residual personal data is removed on the same purge cycle.
• Invoices and tax records — kept for the statutory retention period regardless of account deletion.
• Audit logs — kept for up to 12 months for security purposes.
• Backups — encrypted database backups roll over automatically; purged data disappears from backups as they expire.

5Cookies and local storage

The app does not use advertising or analytics cookies. It stores in your browser's local storage: your session tokens (so you stay signed in), your active team selection, interface preferences, and similar functional state. Clearing site data in your browser signs you out and resets these.

6Security

• All traffic is encrypted in transit (TLS/HSTS).
• Passwords are stored only as bcrypt hashes; new passwords are checked against known-breach lists at signup using a privacy-preserving (k-anonymity) lookup.
• Access is scoped per team with role-based permissions; security-relevant actions are audit-logged.
• Sessions can be revoked everywhere by changing your password or logging out.

7Your rights

Under the GDPR you can request access to, correction of, deletion of, or a portable copy of your personal data, object to processing based on legitimate interest, and withdraw any consent. Write to [contact email] — we respond within one month. You can also lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be) or the supervisory authority of your own country. For data controlled by your team (section: controller), we may refer your request to the team owner.

8Changes

We will announce material changes to this policy in the app or by email before they take effect. The version and effective date are shown at the top of this page.