PRIVACY

We only collect what is necessary: email, city of origin, preferred sport, saved events, subscribed alerts, language preferences and aggregated usage data (analytics, with consent). We do not collect sensitive data within the meaning of Article 9 GDPR.

Data is used to: (a) personalise the experience and surface relevant events (legitimate interest); (b) send alerts and transactional emails requested by the user (performance of a contract); (c) comply with legal obligations (legal obligation); (d) measure product performance through anonymised analytics (consent). We do not sell data to third parties and we do not use the data for automated profiling with legal effects.

• Supabase — database and authentication, hosted in the European Union.

• Resend — transactional email delivery (verification, alerts).

• PostHog — anonymised product analytics, enabled only with consent.

• Booking / Travelpayouts — hotel, flight and travel affiliates; they receive only the parameters required to attribute the commission.

The user has the right to: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection and withdrawal of consent at any time, without affecting the lawfulness of prior processing. To exercise these rights, go to /profile → "Privacy and Data", where you can export or delete your account, or email partners@racetravel.app.

We retain data while the account is active. After account deletion, all personal data is erased within 30 days, except where legal retention obligations apply (billing, consent records). Affiliate click logs are anonymised after 12 months.

For any data protection enquiry contact: partners@racetravel.app. You also have the right to lodge a complaint with the Portuguese supervisory authority — CNPD (cnpd.pt).