Privacy Policy.

• We collect what we need to make PaddockPro work for you
• Location data is only used to identify your circuit and record session data — never for advertising
• Lap timing (coming soon) and GPS session data stays yours — we process it to power your analysis
• Message content is encrypted — we can't casually read it
• You can upload telemetry from other apps — we process it only for your benefit
• PaddockPro Workshop garages have additional data provisions covered in Section 12
• You can ask us to delete your data anytime
• That's basically it

1. Who We Are

PaddockPro is operated by GARAGE MAX SOFTWARE LTD, a company run by actual motorsport and track day people who got fed up with guessing alignment specs.

Garage Max Software Ltd is the data controller for PaddockPro.

We do not have a formal Data Protection Officer — we are a small team. For any privacy queries, contact our data lead at hello@paddock-pro.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — though we would rather sort things out directly if we can.

2. Who This Policy Applies To

This policy covers two types of PaddockPro user:

Consumer users — individuals using PaddockPro for personal track day and performance driving purposes (Rookie, Clubman, Pro, and Team tiers).

Workshop users — performance garages and motorsport businesses using PaddockPro as a professional alignment and session management tool. Additional provisions applying to Workshop users are set out in Section 12.

3. What We Collect

Account Information

• Your name and email address
• Phone number (if you provide it)
• Business name and address (Workshop users)
• Password — stored as a one-way hash; we cannot see it

Early-Access List

If you join the early-access list on paddock-pro.com, we collect:

• Your email address
• What you drive, and your home circuit if you tell us
• Where you came from (the page or advert that brought you, from standard campaign tags), so we know which of our channels work
• The date you agreed to hear from us, and the wording you agreed to

We use this only to tell you about PaddockPro early access and launch, and to invite you in when your place is ready. We do not sell it or share it for anyone else's marketing.

Vehicle & Setup Data

• Vehicle specifications (make, model, year, modifications)
• Alignment setups you create or save
• Track and condition preferences
• Setup notes and tuning adjustments
• Tyre specifications and related performance data

Session & Lap Timing Data

Lap timing is coming soon. This section describes what it will collect once it launches.

When you use the lap timer (coming soon) or session logger, we collect:

• GPS trace data — latitude, longitude, speed, bearing, altitude, and accuracy at each fix
• Session timestamps and duration
• Lap times and sector times derived from GPS data
• G-force data derived from GPS (longitudinal and lateral acceleration)
• Raw accelerometer data from your device (where enabled and where your device supports it)
• Track conditions you log (weather, temperature, surface notes)
• Session notes and observations

GPS and timing data is only collected when you actively start a session. We do not collect background location data when PaddockPro is not in active use.

Device Location (Circuit Detection)

Where you grant location permission, PaddockPro may use your device's GPS to automatically identify which circuit you are at, pre-populate weather data, and streamline session setup. This is optional — you can select your circuit manually if you prefer not to grant location access.

Location permission is requested only when relevant and is not used for advertising, profiling unrelated to your sessions, or any purpose beyond making PaddockPro work better for you at the track.

Accelerometer Data

Where your device supports it and you have enabled high-accuracy session recording, PaddockPro may collect raw accelerometer data to supplement GPS-derived G-force calculations. This data is associated with your session record and processed solely for session analysis purposes.

External Sensor Data

Where you connect a compatible external GPS or sensor device (such as RaceBox) via Bluetooth, data from that device is collected and processed in the same way as device GPS data. We do not retain raw Bluetooth connection data beyond what is necessary to deliver the session record.

Uploaded Telemetry

Where you upload session or telemetry files exported from compatible third-party applications (such as Harry's LapTimer or RaceChrono), we collect and store the data contained in those files solely to provide session analysis within PaddockPro. Uploaded telemetry may include GPS traces, lap times, sector times, speed data, and other performance metrics generated by the third-party application.

We process uploaded telemetry only for your benefit. We do not use it to build profiles of other individuals, other vehicles, or venue operators beyond what is necessary to display your session data to you.

Messages

When you use PaddockPro's messaging feature, we collect message content and metadata (sender, recipient, conversation ID, timestamps). Message content is encrypted at rest — see Section 8 for full details.

Usage Data

• Which features and tools you use and how often
• Circuit Visualiser sessions and preferences
• Knowledge Hub articles accessed
• Social features activity (leaderboards, sharing)
• Session and activity timestamps

Payment Information

We use Stripe for payment processing. We never see or store your full card details. We receive confirmation of payment and retain billing records for legal compliance.

Technical Data

IP address, browser type, device information, and session data. This helps us keep PaddockPro secure and fix bugs.

What We Don't Collect

We do not collect sensitive personal data such as health information, ethnicity, or political views. We do not collect background location data outside of active sessions. We do not access your device camera, microphone, or contacts.

4. Why We Collect It — Our Legal Basis

Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You can object to processing based on legitimate interests at any time — see Section 10.

5. Who We Share Your Data With

We do not sell data that identifies you or your vehicle.

We share limited data with the following trusted third parties, all of whom are bound by appropriate data protection agreements:

• Stripe — payment processing. Your card details never touch our servers.
• OpenAI — AI processing for alignment recommendations and related features. Your vehicle specs and setup preferences are sent to OpenAI's API. OpenAI does not use API data to train their models. OpenAI retains request logs for up to 30 days for abuse monitoring, then deletes them. GPS and raw session telemetry data is not sent to OpenAI.
• Hetzner (Helsinki, Finland & Falkenstein, Germany) — our servers and databases (Helsinki) and nightly encrypted backups (Falkenstein), all in the EU.
• Backblaze (Amsterdam, Netherlands) — an encrypted offsite copy of our backups. Backblaze is a US company; the data stays in its EU region.
• SMTP2GO — email delivery, including early-access emails.
• Cloudflare — delivers and protects the website, and runs Turnstile, which checks that forms are used by a person, not a bot. Turnstile processes your IP address and browser signals for that check only. In the PaddockPro app, Cloudflare R2 stores profile pictures, activity photos and badge images, in Cloudflare's European region.
• Sentry — error reports from our servers, so we can find and fix faults. Stored in Sentry's EU region.
• PostHog — in the PaddockPro app, records which features are used, keyed by your account ID, so we can improve the product. It runs on our servers, sets no cookie, and stores data in PostHog's EU region. You can switch it off with “Share Usage Data” in the app's privacy settings.
• UK Vehicle Data — looks up a vehicle's details from its registration number, in PaddockPro Workshop and the PaddockPro app. A UK company.
• Microsoft 365 — our email: messages you send to hello@ or support@paddock-pro.com arrive there.
• Google Maps — shows the map on our Find a Workshop page. Google receives your IP address when the map loads.
• GoHighLevel — our marketing tool, used to send updates to people who have confirmed their place on the early-access list. It is a US company; see Section 6.

We will also disclose data where required to do so by law, court order, or regulatory authority, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of PaddockPro, our users, or others.

6. International Data Transfers

Your data is stored in the EU: our servers and databases are in Helsinki, Finland; nightly encrypted backups are in Falkenstein, Germany; and an encrypted offsite copy is in Amsterdam, Netherlands. Two services process data outside the EU. OpenAI, for AI processing, is covered by Standard Contractual Clauses, an approved international transfer mechanism under UK GDPR. GoHighLevel (United States) receives the email address and early-access details of people who have confirmed their place. That transfer is covered by GoHighLevel's data processing agreement, which includes Standard Contractual Clauses with the UK International Data Transfer Addendum. GPS and raw session telemetry is not transferred outside the EU.

7. Location Data — How We Use It

We take location privacy seriously. Here is exactly how location data is used in PaddockPro:

Circuit detection — where you grant permission, your device location is used to identify which circuit you are at. This is a one-time check at session start, not continuous tracking.

Active session recording — when you start a lap timing session (coming soon), GPS data is recorded continuously for the duration of the session to generate lap times, sector times, speed traces, and G-force data. Recording stops when you end the session.

What we do not do with location data:

• We do not track your location outside of active PaddockPro sessions
• We do not use location data for advertising or behavioural profiling
• We do not share precise location data with third parties beyond the infrastructure providers listed above
• We do not use location data to identify where you live, work, or travel outside of motorsport venues

You can use PaddockPro's manual session logger at any time without granting location permission. Circuit selection and session logging are fully functional without GPS.

8. Messaging & Encryption

PaddockPro includes a messaging feature for communication between users. Here is exactly how it works:

What is encrypted at rest:

• Message content — every message is encrypted with AES-256-GCM before being written to the database, and decrypted only when retrieved by the API for delivery to the intended recipient
• Message previews stored in inbox views — also encrypted

What is not encrypted at rest:

• Metadata — sender ID, conversation ID, timestamps, message type. This is standard practice and necessary for the platform to function
• Participant data — who is in which conversation, read receipts, mute status

In transit: All data including messages travels over encrypted HTTPS/WSS connections. Real-time message delivery is ephemeral — it is not stored in the real-time layer.

Encryption key management: Encryption keys are stored in the container runtime only, not in the database. If the database were compromised, message content would be unreadable without the key.

Our access: We retain the technical ability to decrypt message content where required for legal compliance, to respond to a lawful authority request, or to investigate a reported breach of our Terms & Conditions. We do not routinely read user messages.

Notifications: Push and email notifications contain no message content — only a generic new message alert.

9. How Long We Keep Your Data

Why We Retain Session and Setup Data

We retain vehicle, alignment, and session data beyond the active period because it is essential to the quality of PaddockPro's AI and analysis features. Understanding alignment and performance patterns across vehicle platforms, modifications, track conditions, and tyre combinations requires historical data. This processing is based on our legitimate interests in maintaining and improving the service for all users.

Account Deletion Options

When you close your account, we offer two options:

• Anonymised retention (recommended) — We remove your name, email address, and all information that identifies you personally, while retaining anonymised technical data (vehicle specs, setup parameters, session performance patterns). Your MX-5 ND setup at Brands Hatch still contributes to patterns that help other drivers — they just will not know it came from you. This is our preferred approach as it preserves the collective value of the platform while fully protecting your privacy.
• Full deletion — We delete everything from our active database and cold storage. Please note that data will persist in our 30-day backup rotation for disaster recovery purposes, and in OpenAI's 30-day request logs (which we do not control). After 30 days, it is completely gone.

Payment records are retained for 7 years regardless of which option you choose — this is a legal requirement.

10. Your Rights

Under UK GDPR, you have the following rights:

• Right of access — you can ask us what personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate data
• Right to erasure — you can ask us to delete your personal data, subject to legal retention requirements
• Right to data portability — you can ask for a copy of your data in a portable format
• Right to object — you can object to processing based on legitimate interests, including direct marketing
• Right to restrict processing — you can ask us to restrict how we use your data in certain circumstances
• Right to withdraw consent — where processing is based on consent (such as location permission or marketing), you can withdraw it at any time without affecting the lawfulness of prior processing. Withdrawing location permission will disable GPS-based features but will not affect your ability to use PaddockPro manually.

To exercise any of these rights, email hello@paddock-pro.com. We will respond within 30 days, usually sooner. We may ask you to verify your identity before acting on a request.

11. Security

Our security measures include:

• AES-256-GCM encryption of message content at rest
• Encryption in transit via HTTPS/WSS (TLS)
• Multi-factor authentication available for all accounts
• Row-level security — your data is isolated from other users at the database level
• Role-based access controls limiting internal access to data
• Automated nightly backups with 30-day retention
• EU-hosted servers in Helsinki, with encrypted backups in Germany and the Netherlands
• Regular security reviews
• Container-based secrets management — encryption keys and credentials are never stored in the database
• GPS and session telemetry stored in the EU only and not passed to AI processing providers

No system is completely secure. If we become aware of a data breach that affects your rights and freedoms, we will notify you and the ICO in accordance with our legal obligations.

12. Workshop Users — Additional Provisions

This section applies to PaddockPro Workshop users only.

You as Data Controller

Where you input personal data relating to your own customers into PaddockPro — for example customer names, contact details, or vehicle information in setup or session records — you remain the data controller for that information. Garage Max Software Ltd acts as a data processor on your behalf.

This means:

• We process your customers' data only to provide the PaddockPro service to you
• We do not use your customers' data for any other purpose
• Your customers' data is subject to the same security, retention, and deletion policies as all data on the platform

Your Obligations

By inputting your customers' personal data into PaddockPro, you confirm that:

• You have a lawful basis under UK GDPR to share that data with us as a processor
• You have provided appropriate privacy notices to your customers covering this processing
• You will handle data subject requests from your customers relating to data held in PaddockPro promptly and appropriately

Data Processing Agreement

As a data processor handling your customers' personal data, we are required under UK GDPR to have a Data Processing Agreement (DPA) in place with you. Our Data Processing Agreement is available online and forms part of your PaddockPro Workshop agreement. By using the PaddockPro Workshop service, you agree to the terms of the DPA.

Certified Garage Directory

If you hold a PaddockPro Certified badge, your business name, location, and relevant details will be listed in our public certified garage directory. This is a business listing — we do not display personal data of individual employees without their knowledge. You are responsible for ensuring the information provided for your listing is accurate.

13. Cookies

Essential cookies — required for the platform to function. These keep you logged in and remember your preferences. You cannot opt out of essential cookies without affecting your ability to use PaddockPro.

Analytics cookies (Google Analytics, Microsoft Clarity) — help us understand how the website is used so we can improve it. They are set only if you choose “Accept all” or allow analytics.

Marketing cookies (the Meta Pixel) — measure whether our adverts on Facebook and Instagram work. Set only if you allow marketing.

Nothing in these two groups loads until you choose, and you can change your mind at any time with “Cookie settings” at the foot of every page. Google, Microsoft and Meta are US companies, so data these tools collect is transferred to the United States under their own data processing terms.

14. Aggregated Data & Industry Insights

We may use fully anonymised, aggregated data from PaddockPro usage to improve the platform and generate insights. Examples include:

• Common alignment configurations by vehicle platform and modification level
• Track-specific setup and performance trends
• Session patterns and circuit popularity
• Handling characteristic patterns across tyre and suspension combinations

This data is fully anonymised. It cannot identify you, your vehicle, or your business. We do not sell data that identifies you or your vehicle. Any insights shared externally are statistical summaries only.

15. Children's Data

PaddockPro is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, please contact us at hello@paddock-pro.com and we will delete the account promptly.

16. Changes to This Policy

If we make significant changes to this policy, we will notify you by email before the changes take effect. For minor updates such as corrections or clarifications, we will update this page and the date at the top.

17. Questions?

Email: hello@paddock-pro.com

If you are not satisfied with our response, you can contact the ICO at ico.org.uk or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.