Paddock privacy notice

Last updated: 25/10/2026

This notice explains what personal data Paddock processes, why, and what rights you have. It covers the web app at paddock.racing/green, the Paddock desktop app for Mac and Windows, and the Paddock iPhone and iPad app.

1. Who is responsible

Letter22 Information Technologies SLU, NIF B22556708, Paseo Porta Coeli 53, 46530 Puçol (Valencia), Spain ("Paddock", "we").

Contact for data protection: privacy@paddock.racing.

2. What we process, why, and on which legal basis

Your account

• Data: your e-mail address, your name, your password (stored only as a hash), your language and display settings, your privacy choices, and the records of your sign-ins (stored only as hashes).
• Purpose: to give you an account, sign you in on the web and in the apps, keep you signed in, and let you reset your password.
• Legal basis: the contract with you (Article 6(1)(b) GDPR).

Access requests and invites

• Data: your name, e-mail address and role, the optional fields (team, class, data logger, country) and your message.
• Purpose: to decide about an invite and to send it to you.
• Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time: write to privacy@paddock.racing, and we delete your request. An invite that we already sent is deleted 90 days after it expires.
• Retention: a declined request is deleted at once, an open request 180 days after its last change, an unused invite 90 days after it expires, and the request when you create your account with the invite. A used invite stays as the record of who invited you, until you delete your account.

Your sessions and telemetry

• Data: the files that you upload from your data logger (for example MyChron) and the values that Paddock reads from them: GPS positions and times, speed, engine and temperature channels, lap and sector times, the device and its file names. Also the session details, the tracks, kart profiles, setups, notes and your corrections, the weather of a session, and the address of a YouTube video that you link to a session.
• Purpose: to store your sessions and show, analyse and compare them, and to keep the desktop app and the cloud in sync.
• Legal basis: the contract with you (Article 6(1)(b) GDPR).

Drivers that you record

You can create driver profiles (name, date of birth, height, photo, biography, weight readings) and link sessions to them. A driver does not need an account.

• Legal basis: our legitimate interest and yours to analyse the driving (Article 6(1)(f) GDPR).
• Your duty: you may create a profile and upload the data of another person only when you are entitled to do so, and you tell that person about this notice.
• Children: a child under 14 can appear in Paddock only as a driver profile that a parent, a guardian or a team creates. The adult who creates it confirms that a parent or guardian has consented (Article 8 GDPR, Article 7 of the Spanish data protection law LOPDGDD). From the age of 14, a person can have an account of their own.

Feedback

• Data: the message that you send from the app, its category, the page, your browser type and your account.
• Purpose: to fix faults and improve Paddock.
• Legal basis: our legitimate interest (Article 6(1)(f) GDPR).

AI features

• Data: your question, and the session, lap, track, kart and driver values that the feature needs (for example lap times, channel statistics, driver and track names). We store the answers and a cost record of each request.
• Purpose: summaries of sessions and laps, the engine health analysis and the assistant chat about your own data.
• Legal basis: the contract with you (Article 6(1)(b) GDPR). The AI features give information only. They make no decision about you.

Maps and linked videos

• Purpose: to show satellite imagery under your GPS traces, and to play a YouTube video that you linked to a session.
• What Google receives: when a page with a map or a linked video opens, your browser loads it from Google. Google receives your IP address, your browser data, the page address and the map area on the screen. The GPS traces themselves are drawn in your browser and are not sent to Google.
• Legal basis: our legitimate interest to show your sessions on a map (Article 6(1)(f) GDPR), and the contract with you for a video that you linked (Article 6(1)(b) GDPR).

Weather and place lookups

• Purpose: to show the weather of a session and a track, and the town and country of a track.
• What is sent: for the weather forecast, our server sends your position with rounded coordinates, or the position of a track or of a place that you chose. For the rain radar, it sends the rounded coordinates of an area. For the weather history, it sends the first GPS point of a session or the average of its GPS points. To look up a place, it sends the position of a track, the centre of the GPS points of a session, or the rounded position used for a forecast. To search for a place, it sends the text that you type. The server sends no name, no e-mail address and no IP address of yours.
• Legal basis: our legitimate interest (Article 6(1)(f) GDPR).

Public race results

• Data: the names of drivers, their class, kart number, nationality and lap times, as published in public race results: the Speedhive results (circuit lap records) and the live timing of public races.
• Source: we obtain these data from the organisers' public results on Speedhive and from the live timing of Apex Timing. We do not obtain them from you.
• Purpose: to show circuit lap records and live race timing to the users of Paddock.
• Legal basis: our legitimate interest to show the public results of a circuit (Article 6(1)(f) GDPR). You can object: write to privacy@paddock.racing.

Backups, testing and security

• Backups: we keep encrypted backups so that we can restore Paddock after a failure.
• Testing: before a new version goes live, we test it on a copy of the data on our private test server. The copy has no sign-in secrets, and only the operator can reach that server.
• Server logs: our servers log each request (the path, the method and errors, never your password or a query).
• Legal basis: our legitimate interest in a secure and working service, and our duty to restore data after an incident (Article 6(1)(f) and Article 32 GDPR).

3. Who receives your data

We use these providers:

The weather and place services (Open-Meteo, OpenStreetMap, RainViewer) receive coordinates, dates and the text of a place search, without your name, e-mail address or IP address.

We do not sell your data. We do not use it for advertising. Other users of Paddock can see public race results. They cannot see your other data.

4. How long we keep your data

• Account and sessions: until you delete them or your account. A deleted session first goes to the trash. When you delete your account, your account and your data are deleted at once; tracks, start lines and track proposals that you added stay for everyone, without your name. A fingerprint (hash) of your account number stays for 15 days, so that old sign-ins no longer work, and the backups keep your data until they expire.
• Data exports: 7 days after the export is ready.
• Sign-in records: removed 30 days after they expire.
• Feedback and AI cost records: 24 months.
• At Anthropic: the content of an AI request is deleted within 30 days.
• Public race results: lap records as long as the circuit is in Paddock; the live timing of a race until we delete the race (you can ask us to delete it).
• Backups: up to 12 months. After a deletion, your data leaves the backups when those backups expire.

5. Your rights

You have the right to:

• access your data and get a copy;
• correct it;
• have it deleted;
• restrict its processing;
• get it in a portable format;
• object to processing that rests on our legitimate interest.

With an account, you can do two things yourself in Settings, section "Your data": "Export my data" gives you a zip file with your data and your original logger files (access and portability), and "Delete my account" deletes your account and your data at once (erasure; the backups keep them until they expire, see section 4).

For every other right, and when you have no account, write to privacy@paddock.racing. When you have an account, write from its e-mail address. We answer within one month.

You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the authority of the EU country where you live.

6. Do you have to give us your data?

An account needs an e-mail address and a password. Without them we cannot give you an account. Everything else is optional.

7. Data on your own devices

• The desktop app keeps your library (sessions, videos, settings) on your computer. Videos stay on your computer and are never uploaded.
• The iPhone and iPad app keeps downloaded sessions on the device until they are uploaded.
• The web app stores in your browser only what it needs to work: your sign-in, your language, your date and time format, and your layout choices. It uses no analytics and no advertising cookies. When a linked YouTube video loads, YouTube can set its own cookies.

8. Changes

When this notice changes, we show the new version in the app and ask you to accept it again.