Privacy Policy

Last updated: October 10, 2026

1. Introduction

RaceTagger ("we," "our," or "us") is a race photography analysis service operated by Federico Pasinetti, based in Italy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at racetagger.cloud, our desktop application for Windows and macOS, and any related services (collectively, the "Service").

We are committed to protecting your privacy and complying with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Italian data protection laws (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018).

Data Controller: Federico Pasinetti, operating as RaceTagger. Contact: privacy@racetagger.cloud

2. Information We Collect

2.1 Account Information

When you register for our Service, we collect:

• Email address (required for account creation and authentication)
• Name (if provided)
• Password (stored as a secure hash, never in plain text)
• Account creation date and last sign-in timestamp
• Communication and marketing preferences, including your marketing consent choice (see Section 2.7)

2.2 Payment Information

When you purchase token packages, we collect billing information through our payment processor, Stripe, Inc. We do not store credit card numbers or full payment details on our servers. We retain:

• Transaction records (amount, date, token package purchased)
• Billing country and tax identification details (for VAT/tax compliance via Stripe Tax)
• Stripe customer and payment identifiers

2.3 Image and Photography Data

Our core service processes your photographs for race number detection and participant identification. When you use our analysis features:

• Desktop App (On Your Computer): The desktop app reads your photos on your device. Depending on the sport category, subject detection, race-number reading and face recognition run locally with ONNX models (face recognition is described in Section 2.4). Local processing does not replace the cloud: every analysis needs an internet connection and sends data to our cloud infrastructure, as described in the next bullet. Offline, you can only review and export results that were already analyzed.
• Desktop App (Sent to the Cloud): For every analysis, downscaled copies of your photos (at most 1920 pixels on the long side) are transmitted for analysis to our cloud infrastructure and, where cloud AI is used, to Google Cloud Vertex AI (Gemini) (Section 4.1). A copy made from a JPEG file carries the metadata of that file: EXIF, IPTC and XMP, such as camera model, lens, date taken, camera serial number, the Artist and Copyright fields, keywords (which can include people's names) and, if present, GPS position. A copy made from a RAW file is cut from the JPEG preview embedded in the RAW file; in Nikon NEF and Canon CR3 files that preview carries no camera, date or location information, so neither does the copy (other RAW formats can differ). Copies made from other formats, such as TIFF, can carry part of the metadata, for example XMP fields. In sport categories that use crop analysis, crops of the detected subjects (currently at most 1024 pixels on the long side, cut from your original photo — for RAW files, from the JPEG preview embedded in the file) may be transmitted as well. If the additional verification check (a second, independent AI reading of each matched subject) is enabled for your account, the images it sends — crops, or the whole frame when no subject box is available — are at most 1600 pixels on the long side. Of all this, only the downscaled copies are kept in storage, with the metadata they carry; crops are not stored. Full-resolution originals leave your computer only if you start the optional HD upload ("Upload HD Originals" in the Results page, "Upload HD" in the Delivery page) or if you turn on automatic HD upload for a gallery in Delivery (off by default); they are then uploaded to our gallery storage (Cloudflare R2, Section 4.1). Otherwise your original files and RAW files never leave your computer.
• Image Metadata: The desktop app reads EXIF/IPTC metadata from your photos (camera model, date taken, GPS if present) to support analysis. It also writes to your files: whenever an analysis recognizes a subject, the app adds what it found (the race number, the participant's name and related details such as team or category) to the photo, inside the file itself for JPEG and other non-RAW files and in an .xmp sidecar file next to the original for RAW files. This is part of the analysis; you do not have to ask for it. If you turn on Visual Tagging, its tags are added to your files in the same way unless you switch off "Embed tags as IPTC Keywords", and the date the photo was taken and, if present, its GPS position are also sent to our cloud as separate fields, so that the event and circuit can be recognized for the location tags.
• Analysis Results and Photo Details: Race numbers detected, confidence scores, participant matches, scene classifications, and visual tags are stored in our database linked to your account. For every photo we also store details that the app read from the file's metadata, as separate fields: the date and time taken; camera make and model; lens and focal length; shutter speed, aperture and ISO; orientation; subject distance; drive mode; the autofocus point; and, if the photo carries them, its GPS position (latitude, longitude, altitude and direction). The camera model is copied into the tags of the images you add to a gallery in Delivery, to feed the gallery's filters. RaceTagger administrators can access all of these details through our management portal, whose analysis view draws the autofocus point on the photo, to diagnose analysis problems. A weekly automated job also reads the date taken of a sample of the photos of each analysis, to work out which sporting event they belong to (see "Event Matching" below). All of these details are kept for as long as the analysis result, that is for the duration of your account (Section 5): deleting the stored copy of a photo does not delete them.
• Event Matching: Once a week an automated job of ours goes through the analyses it has not looked at yet, to work out which sporting event each one belongs to, which events and championships our users photograph, and to keep our event calendar complete. For each analysis it reads the name of the participant list you used, the names of the last folders of the path you analyzed and, for a sample of the photos, the sponsors, teams and driver names found by the analysis and the date taken. It stores its conclusion in our database, linked to your account and to the analysis: the event it chose (or that it found none), the dates, how it decided and the evidence above. If the event is not yet in our calendar, the job can add an entry for it, named after that evidence and carrying the dates; the entry does not carry your account identifier and is not shown on our public calendar. When several analyses point to a championship that our list does not have, the job can also add a suggestion to add it, which can include the names of the participant lists used, with counts and without account identifiers. We do this on the basis of our legitimate interest (Section 3.1); there is no switch for it in the app, and you can object to it (Section 6.6). How long these records are kept is in Section 5.
• Participant Lists: The participant lists you create or import as presets are stored in our database linked to your account, until you delete them or delete your account. When you analyze with a preset (or with an imported start list), the app sends the list to our cloud infrastructure with each photo: the details stored for each participant, such as race number, name, co-driver, team, sponsor, category, car model, plate number and the drivers' details. The instructions we send to Google Cloud Vertex AI (Gemini) (Section 4.1) contain only the race number, name, co-driver, team and sponsor of each participant. There is no setting in the app to analyze with a preset without sending its list. The analysis function does not keep a copy of the list or of those instructions; the matches are stored with the analysis results. When you import an entry list as a PDF, the PDF file is sent to Vertex AI (Gemini) to read its table. When you import a CSV start list whose columns the app does not recognize, its header row and first two data rows are sent in the same way, to propose a column mapping that you confirm before anything is imported. Neither the PDF nor the CSV rows are stored by these two functions. All of this is processed in the EU (Section 4.1).
• Uploaded image storage: Downscaled copies you submit for cloud analysis are stored in our Storage under a non-guessable file path. After 90 days (14 days if "AI Training Contribution" is off for your account, Section 3.3) a copy is marked for deletion, and the stored file is permanently deleted 30 days after that (exceptions and details in Section 5). Anyone who obtains the exact path to a file can read it directly, without signing in — we do not currently restrict access with a signed, expiring URL. We are evaluating moving this bucket to private access with signed URLs.

2.4 Biometric Data (Face Recognition)

For selected professional championships and other sport categories where it is enabled, our Service includes a face recognition feature that identifies participants from facial features in photographs. Under GDPR Article 9, facial recognition data constitutes special category (biometric) data.

Race numbers are the primary identifier. Face recognition is used only as a supplementary method, on scenes where a race number is not visible or not legible (portraits, pit garage, podium). It is active only for sport categories where the feature is enabled, and only when the preset being used contains at least one reference photo; there is no separate switch to turn it off for an individual analysis — you control it by not adding reference photos to a preset, or by removing them.

Three distinct data flows exist, and they are treated differently:

(a) Photos you analyse. Face detection and matching run locally on your device using on-device ONNX models. The facial feature vectors computed from the photographs you analyse are kept only on your device, for the duration of the analysis, and are deleted when the analysis is complete. They are never transmitted to our servers.

(b) Reference photos you upload to a preset. When you add a reference photo of a known participant to one of your own presets, the photograph is stored on our servers (Supabase, EU region) until you delete it, so that the same preset can be reused across analyses and devices. The app can also add one for you: if face recognition is enabled for your account and you give a name to a face in the review gallery, and the name matches a participant in the preset in use, the app saves a crop of that face as a reference photo of that participant and tells you so with a notification. As of desktop app version 1.1.14, the facial feature vector computed from a newly uploaded or newly updated reference photo is no longer sent to or stored on our servers — it is computed and kept only in a local cache on your device. Reference photos uploaded before that version, and not modified since, may still have a legacy vector stored in our database; any such vector is deleted together with its database record when you delete the photo or the preset. You can delete the photograph (and any residual vector) at any time by removing it from the preset. For this flow, you are the data controller for the person depicted, and RaceTagger processes the reference photo — and, for as long as any legacy vector persists, that vector — as your processor: you must have a valid legal basis under Article 9(2) GDPR before uploading it. Ordinarily this is the explicit consent of the person photographed (Article 9(2)(a)). If instead you use the photo for journalistic or editorial purposes in the course of your work as a press photographer, you may be able to rely on the basis available under Article 85 GDPR and, in Italy, Article 137 of the Privacy Code (D.Lgs. 196/2003) — this depends on your jurisdiction and activity, and we do not verify it. If the event takes place in Illinois, Texas or Washington (USA), you must in addition hold the written consent of the person depicted. RaceTagger does not collect, verify or store any consent form or declaration on your behalf — you are responsible for keeping your own record of the basis you relied on. See our Data Processing Agreement for the details of this relationship.

Storage, access and deletion of reference photos (flow (b)). Each reference photo is saved as two files: the file exactly as you chose it, with whatever metadata it carries (for a photo from a camera, for example the camera model and serial number, the date taken and, if present, the GPS position), and a reduced copy of at most 1024 pixels on the long side, without that metadata, which your devices use to compute the facial feature vector locally. Both files are kept in our Storage (Supabase, EU region) under a path that contains random identifiers, but in a storage area that is not private: anyone who obtains the exact path to a file can read it directly, without signing in. Besides you, RaceTagger administrators can view the reference photos of any account and manage them in our management portal, for example to help set up or fix a preset. When you remove a photo you added from a preset in the app, the app deletes both of its files from Storage. When you instead remove a participant or a driver from a preset, delete a whole preset or delete your account, the database records (and any legacy vector) are deleted, but the photo files are not yet deleted from Storage automatically: email privacy@racetagger.cloud and we will delete them.

(c) Official presets maintained by RaceTagger. Official presets for professional championships (driver name, team, race number, livery, sponsors) do not include a reference photograph or a facial feature vector of the driver: RaceTagger does not maintain a database of drivers' faces. If a photographer wants face matching for a driver in an official preset, they add a reference photograph to their own copy of the preset under flow (b) above, on their own lawful basis. If you believe we still hold a reference photo or facial feature vector you did not upload yourself, write to privacy@racetagger.cloud and we will investigate and remove it.

2.5 Desktop Application Telemetry

Our desktop application collects the following technical data to improve performance and diagnose issues:

• Application usage: Every time the app starts it records a launch: the date and time, the application version and the Electron and Node versions, the operating system, processor, number of cores and memory, the device identifier, hostname and operating system username described below, a launch counter for the device, and a session identifier. If the app cannot tell who you are at that moment, for example before you sign in, the record carries no account identifier. After an analysis, the app also records the actions you take on the Results page (for example opening a dialog, configuring or starting an export or "Write to Originals", organizing photos into folders, sending a delivery, leaving the page), each with its time, the analysis it belongs to, your account and a few details such as counts and options. Our administrators read these records in the management portal, to see how the app is used (for example whether people who install it go on to run an analysis), to detect abuse (Section 3.4) and to diagnose problems you report, on the basis of our legitimate interest (Section 3.1). There is no switch in the app to turn them off; you can object to them (Section 6.6).
• System information: CPU architecture, available RAM, hostname, and operating system username. For anti-abuse device checks specifically, your username is truncated to 15 characters server-side before being stored or used. As of desktop app version 1.1.13, the app itself also truncates your OS username (15 characters) and hostname (20 characters) before sending them, for every payload that carries them — device checks, application-launch logs, and execution telemetry — in addition to the server-side truncation described above. Server-side, that same 15/20-character cap currently applies only to anti-abuse device checks; for application-launch logs (see "Application usage" above) it exists as a database-level rule not yet deployed — until it is, those records keep whatever the app already truncated to before sending, per the previous sentence.
• Device identifier: A SHA-256 hashed machine ID derived from your hardware. We do not store the raw hardware identifier.
• Font loading: The main window of the desktop app loads its monospace font (JetBrains Mono) from Google Fonts instead of from your computer. When it does, Google (Google LLC) receives your IP address and the technical details that every web request carries, such as your operating system. We add no account data to that request (Section 4.1).
• Error reports: When something serious goes wrong in the app (for example a crash, a photo it cannot convert, a failed analysis request or a PDF it cannot read), it sends a report to our servers, linked to your account. A report contains the type and severity of the error, the error message and stack trace (up to 500 and 1,000 characters), the step of the analysis where it happened, the position of the photo in the batch, the identifier of the analysis, the app version, your operating system and version, processor and free memory, the sport category of the analysis or, for errors on the participants page, the name of the preset, and an excerpt of the app's recent diagnostic log (up to 100 lines), which can contain file names. If the AI's reply to a PDF entry list cannot be read, the report can contain the first 200 characters of that reply, which can include names from the list. We use reports to find and fix bugs. You can turn this off in Settings → Privacy & AI ("Automatic Error Reporting"), with the limits described in the note at the end of this section.
• What is removed from error reports, and where they go: Before sending a report, the app replaces email addresses and the user-name part of paths in your home folder. This is a partial filter. It does not remove file and folder names (on Windows only the user name in a path is replaced; on macOS and Linux a path is removed only up to its first space), paths outside your home folder, such as on external drives and network shares, or other identifiers, such as an account identifier, that can appear in the log excerpt. We store each report in our database (Section 4.1), where it stays linked to your account. For each new kind of error we also open an issue in a private GitHub repository (Section 4.1), with the error details, your operating system, processor and free memory, and a log excerpt of up to 3,000 characters; the issue has no field for your account identifier. When the same error is reported again, by you or by someone else, a comment is added to that issue with the app version, the system, the step and a log excerpt of up to 2,000 characters.
• Execution telemetry: Analysis settings, model selected, number of images processed, processing duration, and token consumption per execution. Every analysis also records the full path of the folder you analyzed (the app uses it to show the folder name next to your results and to find your originals when you start an HD upload) and details of the computer and connection used: processor, memory, graphics card, disk type and free space, network type and measured upload speed, operating system, app version, time zone and language, plus the hostname, username and hashed machine ID described above. We use the device details to diagnose issues and to detect abuse (Section 3.4), including several accounts on one computer and one account shared across computers. This is recorded for every analysis, including when analysis log upload is turned off.
• Analysis log files (JSONL): Every time you run an analysis, a JSONL log of that run is uploaded to our servers to support troubleshooting. The retention period is 12 months from upload, but these files are not yet deleted automatically (Section 5). As of desktop app version 1.1.13, you can turn this off in Settings → Privacy & AI ("Upload analysis logs for troubleshooting", on by default) — turning it off keeps every analysis log on your computer only, nothing is sent. When upload is on, the log is sanitized before it leaves your device: fields that identify your computer (hostname, OS username, and similar) are redacted outright rather than truncated, and most file paths are rewritten to a path relative to the folder you selected for that analysis, or to just the file name when the file is outside that folder. Not every path is rewritten: paths on external drives (for example under /Volumes on a Mac) and on network shares are not, and inside a free-text message a path is cut at its first space, so what follows the space is not rewritten either. Those paths can reach us in full. This is different from error reports: it happens on every run, not only when the app sends an error report. Some log lines also contain a reduced copy of the photo they describe: those of photos that the app skips as crowd scenes. It is the same downscaled copy that the app uploads to our servers (Section 2.3), up to about 500 KB, with the metadata it carries. The sanitization described above does not touch these copies, and they stay in the log file for as long as the file is kept (Section 5), not on the schedule that applies to uploaded images.

There is no switch in the desktop app for the application usage records described above; you can object to them (Section 6.6). As of desktop app version 1.1.13, automatic error reporting and analysis log upload can be turned off from Settings → Privacy & AI — each is on by default, and each is a separate toggle from the AI training consent described in Section 3.3. The analysis log switch is saved on your computer. The error reporting switch is not: it lasts until you close the app, it is back on the next time you start it, and a report that was already waiting to be sent when you turned it off is still sent.

2.6 Website Analytics and Cookies

Our website uses the following analytics and tracking technologies, subject to your consent:

• Google Analytics 4: Page views, sessions, and user engagement metrics. Configured with IP anonymization enabled and ad personalization signals disabled.
• Microsoft Clarity: Session recordings, heatmaps, and click tracking for UX improvement. May record mouse movements, scrolls, and clicks on our website.
• Meta Pixel and Conversions API: Conversion tracking for advertising campaigns, both from your browser (Pixel) and, for certain conversion events, from our servers directly to Meta (Conversions API). We apply PII sanitization to the Pixel to prevent transmission of personal data (emails, phone numbers, names) to Meta in the clear; the server-side Conversions API instead sends a SHA-256 cryptographic hash of your email address and account identifier. A hashed email is still personal data under GDPR even though it is not human-readable.

Our website loads fonts (Inter, Roboto Mono, JetBrains Mono, Barlow Condensed) via Next.js' font system: they are downloaded once at build time and served from our own domain, not from Google's servers, so visiting our website does not connect your browser to Google Fonts regardless of your cookie choices.

The analytics and marketing technologies above are loaded only after you provide consent through our cookie banner. You can change your preferences at any time via the cookie settings on our website. See our Cookie Policy for full details, including how a change to this policy causes the consent banner to reappear.

2.7 Marketing and Communication Data

If you give explicit marketing consent (an unchecked-by-default checkbox at signup, separate from accepting this Privacy Policy and the Terms of Service), we collect:

• Your email address and marketing consent status
• Email engagement metrics (opens, clicks) via our email service provider, Brevo
• UTM parameters from your signup (source, medium, campaign) for attribution purposes

Marketing consent defaults to declined and is not retroactive: if you registered before this consent field existed, we treat you as not consenting to marketing until you actively opt in, even if you were previously receiving our newsletter. Your account is always synced to our email platform (Brevo) for service and transactional email regardless of marketing consent; you are only added to the marketing/newsletter list, and only receive newsletter broadcasts, if you have given marketing consent. You can withdraw consent at any time via the unsubscribe link in any marketing email, or by contacting us; an unsubscribe or complaint is also recorded in our suppression list and honored across future sends.

3. How We Use Your Information

3.1 Legal Bases for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

3.2 Service Delivery

We use your data to provide, maintain, and improve the Service, including: analyzing your photographs using AI models, matching detected race numbers to participant databases, generating analysis results and visual tags, managing your token balance and purchase history, and delivering email notifications about your analysis results.

3.3 AI Model Improvement

By default, we may use analysis data (such as the race numbers read and the corrections you make) and the downscaled copies of your photos that we store (Section 2.3) to train and improve our AI models for race number detection, scene classification, and related features, on the basis of our legitimate interest in improving the Service. A copy used for training is the file as stored, with the metadata it carries (Section 2.3); crops are not stored, so they are not used. Today, only images that an admin has reviewed and approved for a training dataset are used for training.

You may object at any time. In the desktop app, open Settings, find the "Privacy & AI" section and switch off "AI Training Contribution" (it is on by default). While it is off for your account, none of your photos is offered to our admins as training material or used in the datasets, exports and tests we use to train and evaluate our AI models, including photos uploaded before you switched it off: these tools check your current choice each time they use a photo. The stored copies of your uploads are also deleted sooner (Section 5). You can also object by email to privacy@racetagger.cloud, and we will switch it off for your account. Neither step undoes the training of models already built or removes copies already packaged into training-dataset archives; for those archives, see Section 5.

3.4 Security and Abuse Prevention

We monitor for abusive use of our Service, including device fingerprinting for rate limiting and fraud prevention. This processing is based on our legitimate interest in maintaining service integrity and protecting our users.

4. Data Sharing and Third-Party Processors

We do not sell, rent, or trade your personal data. We share data with the following categories of processors, each bound by data processing agreements:

4.1 Sub-Processors

4.2 International Data Transfers

Where data is transferred outside the European Economic Area (EEA) — for example billing data to Stripe or an admin's test prompt to Google AI Studio, both as described in Section 4.1 — we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, the Data Privacy Framework (DPF) where the recipient participates in it, or the data processor's adherence to an adequate level of protection as determined by the Commission. Most of your photographs and analysis data are not part of this: for the sport categories configured to use Google Cloud Vertex AI, your photos are processed exclusively in the EU (Section 4.1), so they are not transferred outside the EEA in the first place. You may request a copy of the applicable safeguards by contacting us.

4.3 Legal Disclosures

We may disclose your data if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of RaceTagger, our users, or the public.

5. Data Retention

We retain your data for the following periods:

• Account data: For the duration of your account, plus 30 days after deletion request to allow for recovery, plus up to a further 7 days for the data to age out of routine database backups.
• Analysis results (with the photo details in Section 2.3, GPS position included) and execution logs: For the duration of your account. Deleted upon account deletion.
• Analysis log files (JSONL, Section 2.5): 12 months from upload. We do not yet delete these files automatically: files older than 12 months are still in storage today, and we delete them on request (email privacy@racetagger.cloud). The reduced photo copies that some log lines contain (Section 2.5) are kept as long as the log file; the schedule for uploaded images below does not apply to them.
• Payment and transaction records: 10 years from the date of transaction, as required by Italian tax law (D.P.R. 600/1973).
• Individual error report records and telemetry (Section 2.5): 12 months from the date of collection. We are rolling out a scheduled database job to delete data past this period automatically; until it is fully live for your data, older records are deleted manually on request.
• Error report summaries and GitHub issues (Section 2.5): No fixed end date. For each distinct error we keep one summary record (message, stack trace, counters and the list of the accounts it affected) and one GitHub issue, and the 12-month job in the previous item does not reach them. Closing an issue does not delete it. Deleting your account deletes the individual records of your reports; your account identifier may remain in the summary record (Section 6.3), and the GitHub issue is not touched.
• Application launch records and Results-page actions (Section 2.5): The records linked to your account are kept for as long as the account exists and are deleted with it; we do not delete them earlier automatically. Launch records that carry no account identifier (made when the app could not tell who you were, for example before you sign in) are not linked to any account: deleting your account does not remove them, and they have no fixed end date.
• Event matching records (Section 2.3): For the duration of your account; they are deleted with it, and we do not delete them earlier automatically. The calendar entries and championship suggestions that the job may have added carry no account identifier, so deleting your account does not remove them, and they have no fixed end date.
• Uploaded images for AI analysis (Section 2.3): 90 days from upload while "AI Training Contribution" is on for your account, 14 days while it is off (Section 3.3). After that, the copy is marked for deletion at the next daily clean-up and the stored file is permanently deleted 30 days later. With contribution off, that is about 44 days after upload; a copy that is already older than 14 days when you switch it off is marked at the next daily clean-up and deleted about 31 days after you switched it off. Whatever your choice, we do not mark a copy while its analysis run is part of a project or feeds a published gallery that has not expired; once that stops being the case, the copy is marked at the next daily clean-up. Before deleting a marked copy we check again: if its analysis run has become part of one of these services, or you have switched contribution back on and the copy is less than 90 days old, we do not delete it and the mark is removed at the next daily clean-up. Copies kept for AI training are treated separately ("Photos kept for AI training" below). This process runs automatically. Marking started on September 25, 2026 and the first permanent deletions are due from October 25, 2026; until they have run, older files may still be in storage, and you can ask us to delete them sooner by emailing privacy@racetagger.cloud.
• Facial feature vectors and reference photos (Section 2.4): for reference photos in your own presets, until you remove the photo from the preset, which deletes both of its files and any legacy vector. If you instead remove a participant or a driver from a preset, delete a whole preset or delete your account, the records and any legacy vector are deleted, but the photo files are not yet deleted from Storage automatically: email privacy@racetagger.cloud to have them deleted.
• Website analytics data: up to 14 months (Google Analytics), up to 1 year (Microsoft Clarity cookies — see the Cookie Policy for the duration of each individual cookie).
• Marketing consent records: For the duration of your subscription, plus 3 years as proof of consent.
• Photos kept for AI training (Section 3.3): Beyond the 90 days above, we keep the stored copies of photos whose results you corrected by hand, photos you sent us feedback on, photos that have been labelled or added to a training dataset or to a test set we use to evaluate our models, and photos of an analysis run we have exported as training material, but only while "AI Training Contribution" is on for your account (it is on by default). There is no fixed end date. If you switch it off, these copies follow the schedule above for contribution off: if they are already older than 14 days, they are marked for deletion at the next daily clean-up and permanently deleted 30 days later. If you switch it back on before they are deleted, they are kept again. Deleting your account removes them with the rest of your data. Neither account deletion nor the schedule above reaches copies we have already packaged into training-dataset archives (zip files); to have your photos taken out of those archives, email privacy@racetagger.cloud. Switching it off does not undo the training of models already built.
• Platform infrastructure logs (Vercel, Supabase): governed by each provider's own log retention, up to 30 days under their standard configuration. RaceTagger does not extend or separately archive these logs.

6. Your Rights Under GDPR

As a data subject, you have the following rights under GDPR. You may exercise these rights by contacting us at privacy@racetagger.cloud or through your account settings where applicable:

6.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and to receive a copy of that data. We will respond to your request within 30 days.

6.2 Right to Rectification (Article 16)

You may request correction of inaccurate personal data or completion of incomplete data. You can update your email and profile information directly in your account settings.

6.3 Right to Erasure (Article 17)

You may request deletion of your personal data. Upon receiving a valid erasure request, we will delete your account and associated data within 30 days, including the images and reference face photos you have uploaded to our Storage, except where retention is required by law (payment records, retained by our payment processor Stripe for tax compliance), or would break aggregate records shared with other users (your account identifier may remain in the affected-user list of a platform-wide error report, since removing it would corrupt the affected-user count for other, unrelated accounts). Deleted data may persist in routine backups for up to a further 7 days. Account deletion can be initiated through your account settings or by contacting us. When you delete your account yourself in your account settings, the files of your reference face photos are not yet deleted from our Storage automatically (Section 2.4): tell us at privacy@racetagger.cloud and we will delete them.

6.4 Right to Restriction of Processing (Article 18)

You may request that we restrict processing of your data in certain circumstances, such as while we verify the accuracy of contested data or assess whether our legitimate interests override your rights.

6.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON). You can export your data through your account settings; the export includes your account and subscriber profile, token balance and transactions, purchases, executions and analysis results, uploaded image metadata (file names and storage paths, not the image files themselves), application launch history, the metadata and URLs of reference face photos in your own presets (not the facial feature vectors used for matching — contact us if you need those), and your recent error reports. Token transactions, purchases, executions, analysis results, and uploaded images are capped at your 1,000 most recent each, error reports at your 500 most recent, and application launches at your 100 most recent; if you have more than that, the export response says so and you can contact privacy@racetagger.cloud for a complete export. RaceTagger Assistant conversations are not included in the export, because no such data is stored yet — the feature is still in development (see Section 14).

6.6 Right to Object (Article 21)

You may object to processing based on legitimate interests (such as telemetry collection or AI training). We will cease processing unless we demonstrate compelling legitimate grounds. You may also object to direct marketing at any time, and we will comply without exception.

6.7 Right to Withdraw Consent (Article 7)

Where processing is based on consent (analytics cookies, marketing emails, advertising tracking), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) at www.garanteprivacy.it, or with the supervisory authority in your EU Member State of residence.

7. Cookies and Tracking Technologies

7.1 Essential Cookies

These cookies are strictly necessary for the operation of our website and cannot be disabled:

• Authentication session cookies (Supabase Auth)
• Cookie consent preferences (racetagger_consent in localStorage), including the version of this Cookie Policy you consented to

7.2 Analytics Cookies (Require Consent)

These cookies help us understand how visitors interact with our website:

• Google Analytics (_ga, _ga_*): Measures page views, sessions, and user engagement. IP anonymization is enabled. Cookie duration: 2 years. Data retention within Google Analytics: up to 14 months.
• Microsoft Clarity (_clck, _clsk, CLID): Records session replays, heatmaps, and click behavior. Cookie durations range from 1 day (_clsk) to 1 year (_clck, CLID) — see the Cookie Policy for the duration of each cookie.

7.3 Marketing Cookies (Require Consent)

• Meta Pixel (_fbp, _fbc): Tracks conversions from Facebook/Instagram advertising. PII is sanitized before transmission. Duration: 90 days.

7.4 Managing Your Preferences

You can manage your cookie preferences at any time through the cookie settings banner on our website. The banner also reappears automatically if we update this Cookie Policy in a way that changes what it discloses (a new version number) — a consent recorded under an older version is treated as not decided. You may also configure your browser to block or delete cookies, although this may affect website functionality.

8. Desktop Application Specific Provisions

8.1 Local Data Storage

The desktop application stores the following data locally on your device:

• Authentication tokens for maintaining your login session
• Application settings and preferences
• Cached analysis configurations and participant presets
• JSONL log files for each analysis run — these are also uploaded to our servers, see Section 2.5

8.2 Network Communications

The desktop application communicates with our servers for the following purposes:

• User authentication and session management
• Token balance checks and consumption tracking
• Image analysis via cloud AI models (Section 2.3 and Section 4.1)
• Downloading sport category configurations and participant presets
• Application update checks
• Telemetry, error report, and analysis log submission (Section 2.5)

8.3 Offline Capability

Analysis always needs an internet connection. Even when local ONNX models do part of the work, the desktop app uploads a downscaled copy of each photo (Section 2.3), and token authorization and result storage also happen online. Offline, you can review and export results that were already analyzed.

9. Children's Privacy

Our Service is intended for professional and semi-professional photographers and is not directed to individuals under the age of 18. We do not perform age verification at signup beyond the account creation flow itself. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Row-Level Security (RLS) policies on customer-facing database tables
• SHA-256 hashing of device identifiers
• Partial removal of personal details before the desktop app sends error reports and analysis logs (Section 2.5 says what is and is not removed), truncation of the hostname and operating system username in launch records, device checks and execution telemetry, and partial redaction of email addresses in server-side logs (e.g. "f***@domain.com" — the domain remains visible)
• Role-based access control for account-facing and payment functions. A small number of internal administrative tools do not yet have this control fully applied — we are addressing this as a priority.
• Regular security reviews and dependency updates

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via email if the changes are significant
• Display a prominent notice on our website and/or desktop application

We encourage you to review this Privacy Policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Automated Decision-Making (Article 22)

The Service uses one form of fully automated decision-making with a direct effect on you: our device-limit check, run at login, can automatically deny access to your account if it determines you have exceeded the number of devices allowed. This decision is based on the device fingerprinting described in Section 3.4.

If you believe this decision was made in error, you can request human review by contacting info@racetagger.cloud. Beyond this device-limit check, we do not carry out profiling or automated decision-making that produces legal effects or similarly significantly affects you. Race number detection, participant matching, and scene classification (Sections 2.3–2.4) are analysis outputs you review and act on yourself; they are not decisions we make about you.

13. Customers Based Outside the EEA

If you use the Service as a photographer or business based outside the European Economic Area, you remain the data controller for the photographs you submit and the people depicted in them, under the law applicable to you. RaceTagger processes that data as your processor from our infrastructure in the EEA, under the Data Processing Agreement described in Section 4 and available at /dpa. This does not change the international-transfer safeguards described in Section 4.2 for the sub-processors we ourselves use.

14. RaceTagger Assistant

We are developing an in-app conversational assistant ("RaceTagger Assistant") that can answer questions about your account and, for subscribers, take actions on your behalf inside the Service. In line with Article 50 of the EU AI Act, you are informed that this feature is an artificial intelligence system: when you interact with it, you are talking to an AI, not a human.

This feature is still in development at the time of writing. Once live, conversations with the Assistant will be processed within the EU and retained for 90 days; database tables to store them do not exist yet, which is also why Assistant conversations are not currently part of the data export described in Section 6.5. We will update this section with any change to that design before the feature launches.

15. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or our data practices:

This Privacy Policy is effective as of October 10, 2026.