Privacy Policy

Privacy policy for Track Engine

Last updated: 10 October 2026

This privacy policy explains which personal data we process when you use Track Engine, why we need it and what rights you have.

Controller and contact

The controller is Dipl.-Ing. aer Mark Erik Prinz, trading as Software Vertrieb Prinz (sole proprietorship), Hermann-Löns-Straße 6c, 63322 Rödermark, Germany. For privacy questions or to exercise your rights, you can contact us at support@trackengine.de.

Website, Help Center and hosting

The website and Help Center are provided at trackengine.de and www.trackengine.de, and the WebApp at app.trackengine.de. We use IONOS SE for technical delivery. When a page is accessed, data arising include, in particular, the IP address, time, requested address, browser information and technical response information. Technical logs may be processed for secure operation, troubleshooting and investigating abuse. Processing for provision of the service is based on Article 6(1)(b) GDPR, and processing to secure the service on Article 6(1)(f) GDPR. Our legitimate interest is a secure and available service.

User account, login and permissions

For registration and login, we process your email address, login data, confirmation and recovery information, and technical information about devices and active sessions. Profile information you provide may also be included. Invitations and Workspace memberships determine which shared data you may access. This processing serves to provide and secure your account and the subscribed scope of services under Article 6(1)(b) GDPR; security measures are additionally based on Article 6(1)(f) GDPR.

Supabase: authentication, database, files and server-side functions

We use Supabase for login, database, file storage, server-side functions and data exchange between Race Control and Driver Displays. The Production database is located in Frankfurt. According to the published data processing agreement, the provider is Supabase Pte. Ltd. Supabase processes the data provided for these services as a processor.

Data that may be stored include account and Workspace data, roles, invitations, layouts, segments, drivers, vehicles, vehicle images, track references, events, series, results and recovery states, as well as subscription and contract records. Storage depends on the feature you use. Authorised Workspace members can see content shared for collaboration. Vehicle images are provided in private Supabase file storage; time-limited access links and permission checks restrict access.

Article 6(1)(b) GDPR applies to providing your stored content; Article 6(1)(c) GDPR applies to legally required records, and Article 6(1)(f) GDPR to necessary security measures.

Community and publications

If you submit a layout or segment for publication, we process the submitted content, the publication details you enter, and the information required for review and moderation. Approved publications are visible to the recipients provided for in the product. Authorised users can use the copy feature to transfer approved Community content into their own Workspace. This creates separately saved content in that Workspace. Removing the original publication does not automatically remove copies already transferred in this way. Private Workspace content does not become a Community publication merely by being saved. Do not publish information about other people unless you have the necessary authorisation. Processing to carry out the publication feature you use is based on Article 6(1)(b) GDPR; preventing abuse and moderation records are based on Article 6(1)(f) GDPR.

Race Control, hardware and Driver Display

Depending on the feature, Race Control processes laps, times, race events, driver/vehicle and controller assignments, pit service, tyre and weather states, and technical connection information. Current working states may be stored locally or for the session; explicitly saved results, events and recovery states may be held in the database.

A Driver Display receives access through an access authorisation bound to the respective display. Technical access details serve connection and permission checks and must not be shared. New Driver Display links contain the access authorisation in the address fragment, after the # character. This part is not transmitted to the hosting web server when the page is accessed; the application reads it and immediately cleans up the address. Older links with the access authorisation in a query parameter remain compatible. With such links, the access authorisation may already appear in the first HTTP request and therefore in hosting logs; subsequent address cleanup does not remove a log entry already created. Display access is limited to the assigned race session and participant and does not grant general Workspace access. Processing serves to provide Race Control features under Article 6(1)(b) GDPR and to secure them under Article 6(1)(f) GDPR.

Subscriptions, Stripe and tax information

For paid subscriptions we use Stripe Checkout, subscription management, invoices, refunds and the billing portal. In particular, Stripe Payments Europe, Limited and Stripe Technology Europe, Limited are named for services assigned under the German Stripe agreement. Stripe processes certain payment data as an independent controller and other data as a processor; the allocation depends on the respective service.

Stripe receives the information required for ordering, payment and tax classification, including, in particular, contact, billing and payment information and, where applicable, business and VAT information. Payment data are entered at Stripe. Track Engine does not store card credentials. Track Engine may store internal customer, subscription, invoice and event references, plan, term, amount, currency, payment status, actual tax results and country/jurisdiction evidence. The plan alone does not determine whether you are a private or business customer.

This processing serves performance of the subscription contract under Article 6(1)(b) GDPR and compliance with invoice, tax and record-keeping obligations under Article 6(1)(c) GDPR. Further information about Stripe's processing is available at https://stripe.com/de/privacy.

Contract confirmation, termination and withdrawal

We document the accepted version of the contractual documents, the order, the relevant successful payment and the agreed contractual data. Contract confirmation is provided by email with the corresponding PDF documents. The confirmed legal version and its technical checksum are assigned to the respective contract. Delivery attempts and handover to the mail relay are documented; such handover is not evidence that you have read the message.

For termination and withdrawal declarations, we process the information required for identification and handling, and the content and time of your declaration. Technical delivery and retry states help provide acknowledgements even in the event of temporary delivery problems. This processing is based on Article 6(1)(b) and (c) GDPR; preserving evidence and defending against unjustified claims may be based on Article 6(1)(f) GDPR.

Email and support

Registration, confirmation, recovery and invitation emails are sent through Supabase Auth and the configured IONOS SMTP service. Contract emails and emails concerning consumer declarations are sent by server-side functions through the same SMTP provider. The recipient address, necessary message content and delivery information are processed. Authentication links contain access details limited in time and purpose. Sending is based on the legal basis for the respective account, contractual or statutory communication.

If you contact us, we process your contact details, the content of your message and the information necessary to handle it. Depending on the matter, this is based on Article 6(1)(b), (c) or (f) GDPR. Our legitimate interest is handling general enquiries and securing our communications.

Browser storage and Room Planner

Track Engine uses functional storage on your device, including for login, language, settings, working states, recovery, checkout continuation, device/session coordination and Driver Display access. Room Planner stores its room plans in the browser on your device. This does not automatically make a room plan a cloud record stored in Supabase.

You can remove local data using the relevant product features or browser settings. Unsaved working states and locally stored room plans may be lost as a result. This storage serves the functionality you request and is not used for advertising profiling. Track Engine does not use product analytics or marketing tracking services.

Recipients and international processing

Our providers process data within their respective services and contractual arrangements. Supabase and Stripe may involve subprocessors and international access or processing. Selecting Frankfurt for the Supabase database does not exclude all such operations. The published data processing agreements contain provisions on subprocessors and international transfers, in particular applicable standard contractual clauses. The respective processing depends on the relevant agreement and the service offered.

Current provider information is available at https://supabase.com/legal/customer-resources/data-processing-addendum, https://supabase.com/legal/customer-resources/subprocessor-list, https://stripe.com/de/legal/dpa and https://stripe.com/de/legal/service-providers. Information about the IONOS data processing agreement is available at https://www.ionos.de/terms-gtc/avv/.

Retention and deletion

We store personal data for as long as needed for the respective feature, handling your request, performance of the contract or necessary security measures. Invoice, tax and contractual records subject to statutory retention are retained in accordance with the applicable obligations. A deletion request therefore does not necessarily result in immediate removal of all records concerning contracts already concluded.

When accounts or content are deleted, the corresponding product data are handled under the deletion procedures provided for that purpose. Shared Workspace data, publications and statutory records are assessed according to their respective purpose and existing permissions. Technical logs, backups and data that providers need for their own statutory obligations may be subject to other deletion procedures. Removing a record in the application does not automatically mean immediate physical removal of every backup copy. We do not claim a uniform fixed retention period for all services.

Your rights

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. Where processing is based on your consent, you may withdraw it at any time with effect for the future. This does not affect the lawfulness of processing carried out up to that time.

You can contact support@trackengine.de to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority, in particular at your habitual residence, workplace or the place of the alleged infringement. The Hessian Commissioner for Data Protection and Freedom of Information is responsible for the location of our business.