Privacy Policy

1. Who Is Responsible for Your Data

The controller of your personal data is GIALOVA LLC, a Florida limited liability company doing business as "Wayra Racing" ("Wayra", "we", "us").

• Address: 8128 Natures Way, Unit 17, Lakewood Ranch, FL 34202, USA
• Privacy contact: info@wayraracing.com (subject "Privacy")

2. What We Collect

2.1 Data that stays on your device

When you record a session, the app processes on your device: precise location (GPS, up to the rate your phone or datalogger supports), motion sensors (accelerometer, gyroscope), data from Bluetooth devices you connect (OBD2/ELM327 adapters, compatible dataloggers, tire-pressure sensors), and, if you use it, the camera and microphone for session video and voice notes. This data is stored on your device and is not sent to us unless you choose to share it (sections below). Location is used only while you are recording, with a visible notification; the app does not track you in the background when you are not recording. The only exception is the ad software of the free mobile app, which may read the device's location while the app is in use if you have granted location permission (Section 2.9).

Voice notes transcription. If you dictate a session note, your speech is turned into text by speech recognition that Wayra does not control: on the website in Chrome or Edge, the browser sends the audio to its provider (Google or Microsoft) to recognize it; in the Android and iOS apps, the phone's own speech recognition is used, which, depending on the device and its settings, may process the audio on the device or send it to Google or Apple. Wayra does not receive or store the audio: only the resulting text is saved in the session notes.

2.2 Account data

Email address, password (stored hashed by our authentication provider) or the identifier and email that Google or Apple give us if you sign in with them (with Apple you may use a relay email), your public username, an optional profile photo, your year of birth (asked once in the app; used only to keep ads non-personalized for racers who may be under 18, never shown to anyone), the date you accepted the Terms and the version accepted, and your plan. If you have a paid plan, we also keep, for each kind of device (phone, tablet, computer), the one currently using it: a random identifier of the app installation (not a hardware identifier), the platform and the device model, and a log of when the plan moves between devices, to apply the one-device-per-kind rule of the Terms (Section 2.2).

2.3 What you share in Community and events

When you upload a session to Community: the file you choose and the details you enter (name, track, country, vehicle, category, description). Session files keep their full content, including the GPS trace with dates and times, unless you trim or edit the file before uploading. When you submit a result to an event: username, vehicle, best lap or run, number of laps, maximum speed and lean. Comments you post. We also log downloads of Community files (who and when) to apply daily limits.

2.4 AI features

When you use the AI Chief, "Explain this" or the AI narrative of PRO MAP: the text you write, the recent conversation, and a summary of the session or chart you ask about (for example lap times, speeds, lean angles, channel statistics, setup values, PRO MAP tables). We do not send your name, email or GPS coordinates to the AI provider. We count how many AI requests each account makes per day to apply plan limits.

2.5 Purchases

On our website. Web subscriptions are sold through our online reseller Paddle (Paddle.com Market Ltd), which is the Merchant of Record for those orders. At checkout Paddle collects your name, email address, billing country and postcode, payment details and, if you give it, your tax ID; we never see your full card number. As Merchant of Record, Paddle acts as an independent controller of the payment and tax data it processes, under its own privacy notice. We receive and store your Paddle customer and subscription identifiers, plan, status and renewal or expiry date.

In the mobile apps. Subscriptions bought inside the iOS app are sold and billed by Apple through the App Store, and those bought inside the Android app by Google through Google Play. Apple and Google collect and process your payment method, billing details and tax data under their own privacy policies, acting as independent controllers of that data; we never receive your card number or other payment details. To activate your plan, Apple and Google send purchase information to RevenueCat, our subscription-infrastructure provider, which verifies it and passes it to us: the product (plan and billing period), the store, the environment (production or test), the purchase, renewal and expiry dates, the renewal, cancellation, billing-issue and refund status, the price and currency or country of the purchase, and the store's transaction identifiers. RevenueCat links this information to your Wayra account ID (a pseudonymous identifier; the app does not send it your name or email). We store this information with your account to give you access to your plan, prevent duplicate subscriptions, and handle support and refund requests.

2.6 Moderation and safety records

If our automatic filter blocks or masks a word in something you post, we record the category, the matched term, a short fragment of the text, and the date, linked to your account, together with strikes and temporary mutes. We also record reports you make or receive. When you confirm the PRO MAP competition-use conditions, we record the confirmation (account, version, app version, platform and date).

2.7 Ambassador program applications

If you apply: name, email, country, profiles, disciplines, social networks and approximate followers, team, your answer, language, date of birth (the program is open from age 13) and a hashed version of your IP address (to limit abuse). If you are 13 to 17, also the name and email of your parent or legal guardian, who authorizes the application and receives a copy of the confirmation.

2.8 Website and technical data

Our hosting and backend providers process your IP address, browser and device type and request logs to deliver the Services and keep them secure. The website uses Vercel Web Analytics, which counts page views without cookies and without identifying you across sites. Cloudflare Turnstile checks that a human is using certain forms. We do not use crash-reporting SDKs. The only advertising SDKs are the ones in the free plan of the mobile apps (Section 2.9); the website has none.

2.9 Ads in the free mobile app

On the free plan of the iOS and Android apps we show ads to fund the free service: a banner at the bottom of the main screens (never while you are recording a session) and, only when you ask for it, a rewarded video that unlocks a tool once. We do not show full-screen interstitial ads. Ads are served by Appodeal (Appodeal, Inc.), a mediation platform that runs an auction among partner ad networks, including Meta Audience Network (Meta Platforms), AppLovin, Unity Ads, ironSource, Liftoff (Vungle), InMobi, Mintegral, BIGO Ads, Digital Turbine (DT Exchange) and BidMachine. The ad software in the app and these partners receive: your device's advertising identifier (Google Advertising ID on Android; Apple IDFA on iOS only if you allow tracking), your IP address and the approximate location derived from it, the device's location (approximate or precise) if you have granted the app location permission (the ad software reads it from the phone's operating system while the app is in use; the app cannot turn this off), device model, operating system, language, app version, ad interaction data (impressions, clicks, videos watched), and your consent and opt-out choices. We never sell or give advertisers your name, email, account or the sessions you record (the GPS traces of your sessions, telemetry or video). They use this data to choose, deliver, measure and limit ads and to prevent ad fraud and, where you allow it, to personalize ads, under their own privacy policies. The ad software is not started for members, on the website or on the desktop app, nor in the European Economic Area, the United Kingdom or Switzerland: to decide this, the app asks our website for the country of your IP address (which we do not store), and if the country cannot be determined, no ads are shown. You can control ad personalization as explained in Section 8.

2.10 Messages to us

If you email us, we keep your message and our reply.

3. Why We Use It and Legal Bases

We use personal data only for the purposes below. For users in the EEA, UK, Switzerland and other places that require it, the legal basis is shown in brackets.

• Provide the Services you ask for: account, sign-in, sync of your plan, Community, events, AI answers [performance of a contract].
• Publish what you choose to share in Community and events [performance of a contract; you decide what to share and can delete it].
• Payments, invoices and refunds [contract; legal obligations for tax and accounting].
• Security, abuse prevention and moderation (filters, strikes, reports, rate limits, CAPTCHA) [legitimate interest in a safe service; legal obligations where they apply].
• Cookieless website statistics to understand which pages are used [legitimate interest].
• Ads in the free mobile app (Section 2.9) to fund the free plan [legitimate interest for non-personalized ads and fraud prevention; consent for personalized ads and for access to your device's advertising identifier where the law requires it; device location only with the location permission you grant on your phone. No ads are shown in the EEA, UK and Switzerland].
• Service emails (receipts, renewal reminders, security, changes to the Terms) [contract; legal obligation].
• Marketing emails and ambassador program contact only if you agreed [consent, which you can withdraw at any time].
• Legal claims and compliance (for example, keeping acceptance records) [legal obligation; legitimate interest in defending legal claims].

Apart from the ads in the free mobile app described in Section 2.9, we do not use personal data for advertising and we do not build advertising profiles ourselves. We do not sell personal data for money, do not train AI models with your data, and do not make decisions with legal or similarly significant effects based solely on automated processing. The moderation filter acts automatically on text; you can ask for human review (Section 9).

4. What Other Users and the Public Can See

• Public to anyone: your username and profile photo next to what you publish; the list of Community sessions and their details; comments; public events and their leaderboards (username, vehicle, best lap or run, laps, maximum speed and lean).
• Other signed-in users: can download the session files you upload to Community, including the full GPS trace with dates and times contained in them. Do not upload sessions that start or end at your home or reveal places you want to keep private, or trim them first.
• Private events: results are visible to the event's members and organizer.

Content that others have already downloaded cannot be recalled when you delete it.

5. Who We Share Data With

We share personal data only with the service providers below, which process it on our behalf and under our instructions (except where noted), with authorities when the law requires it, and with a buyer or successor if our business is transferred (you will be notified).

• Supabase, Inc. (USA): database, authentication, file storage and server functions for accounts, Community, events, AI proxy and moderation.
• RevenueCat, Inc. (USA): subscription infrastructure for the in-app subscriptions of the iOS and Android apps. It receives from Apple and Google the purchase information described in Section 2.5, together with your Wayra account ID and basic device and app information (such as platform and app version), verifies it and passes it to us, as our processor.
• Paddle.com Market Ltd (United Kingdom) and its affiliates: our online reseller and Merchant of Record for web subscriptions (checkout, payments, tax calculation and collection, invoices, refunds and the customer portal). As Merchant of Record, Paddle acts as an independent controller for payment and tax data, fraud prevention and its legal obligations (Paddle privacy notice).
• Anthropic, PBC (USA): the language model behind the AI features, only when you use them. It receives the text and data summary described in Section 2.4. Under Anthropic's commercial terms, API data is not used to train its models. If you use your own Anthropic API key, the request is made under your own agreement with Anthropic.
• Vercel, Inc. (USA): hosting of the website, cookieless web analytics, and the country lookup the mobile app uses to decide whether ads may be shown (receives your IP address, which we do not store).
• Cloudflare, Inc. (USA): DNS, network security and Turnstile human verification (processes your IP address and browser signals).
• Resend (USA): delivery of transactional emails (for example, ambassador application confirmations).
• Google LLC (USA): Google Sign-In if you choose it, and Google Maps in the Android app (receives the map area you view and your IP address). If you buy a subscription in the Android app, Google Play sells and bills it and acts as an independent controller of your payment data under its own privacy policy.
• Apple Inc. (USA): Sign in with Apple if you choose it, and Apple Maps in the iOS app. If you buy a subscription in the iOS app, the App Store sells and bills it and Apple acts as an independent controller of your payment data under its own privacy policy.
• Appodeal, Inc. (USA) and its partner ad networks, including Meta Platforms, Inc. / Meta Platforms Ireland Ltd. (Meta Audience Network), AppLovin, Unity, ironSource, Liftoff (Vungle), InMobi, Mintegral, BIGO Ads, Digital Turbine and BidMachine: ads in the free plan of the mobile apps only (Section 2.9). Appodeal and these networks receive the data described in Section 2.9 and act as independent controllers for their own advertising purposes, under their own privacy policies.
• Google Cloud Run (Google LLC, USA): hosts our satellite-imagery tile server; receives the map tiles requested and your IP address.
• OpenStreetMap Foundation (UK) and Copernicus / European Union imagery: map tiles and satellite imagery shown on the website and in the apps; the tile servers receive your IP address and the area viewed.

We do not sell personal data for money. The ads in the free mobile app (Section 2.9) may count as "sharing" for cross-context behavioral advertising, or as a "sale" or "targeted advertising", under some U.S. state laws; you can opt out at any time (Sections 8 and 10). We do not disclose personal data to third parties for their own direct marketing.

6. International Transfers

We are based in the United States and our providers mainly process data in the United States. If you live elsewhere, your data is transferred to the United States, which may not offer the same level of protection as your country. We are not certified under the EU-U.S. Data Privacy Framework. Where the law requires a transfer mechanism, we rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) included in our providers' data processing terms, and otherwise on the transfer being necessary to provide the service you request or on your consent. You can ask us for more information about these safeguards.

7. How Long We Keep Data

• Account, profile, Community uploads, comments, event entries, AI usage counters and moderation records: while your account exists. When you delete your account they are deleted immediately, except as listed below.
• Data on your device: until you delete it or uninstall the app; it never reached our servers.
• Backups: residual copies expire within 90 days.
• Payment, invoice and purchase records: kept by Paddle, Apple or Google (depending on where you bought), by RevenueCat and by us as long as tax and accounting law requires or as needed to handle refunds and disputes (generally up to 7 years), no longer linked to a Wayra account after deletion where possible.
• PRO MAP competition-use confirmations and Terms acceptance records: up to 5 years, to defend legal claims; unlinked from your account when you delete it where possible.
• Ambassador applications: up to 12 months after we decide on them, or until you ask us to delete them.
• Emails with us: up to 3 years after the last message.
• Server and security logs of our providers: for the short periods set by each provider.

8. Cookies and Similar Technologies

The website uses only strictly necessary browser storage: your sign-in session and your language choice (stored in local storage), plus the storage Cloudflare Turnstile needs to work on the forms that use it. We do not use advertising or marketing cookies and do not use third-party tracking. Vercel Web Analytics does not set cookies. Because of this, we do not show a cookie banner. You can clear this storage in your browser settings; you will be signed out.

The website has no ads. The free plan of the mobile apps contains the Appodeal ad software and its partners' (Section 2.9), which use your device's advertising identifier and similar device data. Members (Wayra Pro and Wayra AI) never see ads and the ad software is not started for them. How to control ads in the app:

• No ads in the EEA, UK and Switzerland: in these countries, and whenever the app cannot determine your country, the ad software is not started at all and no ads are shown.
• Personalized ads switch (everywhere): turn off Settings > Privacy > Personalized ads in the app. This is our "Do Not Sell or Share My Personal Information" control: it sends an opt-out signal to the ad networks and the app no longer asks for tracking permission. You will still see ads, but less relevant ones.
• iOS: the app asks for permission to track (App Tracking Transparency) and uses your advertising identifier (IDFA) only if you allow it. You can change it at any time in iPhone Settings > Privacy & Security > Tracking.
• Android: you can reset or delete your advertising ID in your phone's settings (Settings > Google > Ads, or Settings > Privacy > Ads, depending on the device).
• Location: if you have granted the app location permission, the ad software can read the device's location while the free app is in use. You can withdraw the permission at any time in your phone's settings (it is needed only to record GPS sessions), or become a member so the ad software never starts.
• Becoming a member (Wayra Pro or Wayra AI) removes all ads.

9. Your Rights and How to Use Them

Wherever you live, you can ask us to:

• Access the personal data we hold about you and receive a copy. We send the data held on our servers (account, profile, Community uploads, comments, event entries, subscription status) in a machine-readable format (JSON) within 30 days. Sessions stored only on your device are already in your possession.
• Correct inaccurate data (you can change your username and photo in the apps).
• Delete your data: delete individual Community sessions and comments yourself, or your whole account in the app (Settings > Delete account) or at wayraracing.com/delete-account.
• Object to processing based on legitimate interest, restrict processing, and withdraw consent at any time (this does not affect prior processing).
• Opt out of the sale or sharing of your personal data and of targeted advertising in the free mobile app, directly with the Personalized ads switch (Section 8), without having to write to us.
• Ask for human review of an automatic moderation decision, and appeal a decision on your request by replying to our answer.

To exercise any right, email info@wayraracing.com from your account email (subject "Privacy"). We may need to verify your identity. We answer within 30 days (45 days where U.S. state law allows, with notice) and free of charge. You may use an authorized agent, who must show your written authorization. We will not discriminate against you for exercising your rights.

You also have the right to lodge a complaint with your data protection authority (for example, in the EU the authority of your country, in the UK the ICO, in Brazil the ANPD, in Mexico INAI or its successor authority, in Argentina the AAIP, in Colombia the SIC).

10. Additional Information by Region

United States (California and other states)

In the last 12 months we collected these categories of personal information: identifiers (email, username, account IDs, IP address and, in the free mobile app, the device advertising identifier); commercial information (plan, subscription status, purchase records received from Paddle, Apple or Google); internet activity (request logs, cookieless page views and, in the free mobile app, ad interactions); precise geolocation (inside files you upload to Community and, in the free mobile app, the device location the ad software may read if you granted location permission); audio/visual information (profile photo); and inferences are not made. We collect them from you, your device and the providers in Section 5, for the purposes in Section 3, and disclose them to the providers in Section 5 for those business purposes. In the free plan of the mobile apps, the ad networks in Section 5 receive the advertising identifier, IP address, device information, ad interactions and, if you granted location permission, the device location (Section 2.9). This may be a "sale" or "sharing" of personal information for cross-context behavioral advertising (as those terms are defined in the California Consumer Privacy Act), or "targeted advertising" under other state laws. We do not sell or share any other personal information, and we do not knowingly sell or share personal information of consumers under 16 without the consent the law requires; the app asks for the year of birth and never shows personalized ads to a racer who may be under 18 (Section 12). To opt out, turn off Settings > Privacy > Personalized ads in the app (our "Do Not Sell or Share My Personal Information" control); members and website users are never included. We use sensitive personal information (account credentials, precise geolocation) only to provide the Services, except the device location that the ad software of the free mobile app may read if you granted location permission (Section 2.9). To limit that use, withdraw the location permission in your phone's settings when you are not recording, or become a member (the ad software never starts for members). We honor Global Privacy Control signals on the website, where there are no ads; in the app, use the Personalized ads switch. California residents may also request the "Shine the Light" information; we do not disclose data for third parties' direct marketing. Residents of other states with privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon) have the rights in Section 9, including the right to appeal.

European Economic Area, United Kingdom and Switzerland

The legal bases are listed in Section 3 and the transfer safeguards in Section 6. You have the rights of access, rectification, erasure, restriction, portability, objection and to withdraw consent, and to complain to a supervisory authority.

Brazil (LGPD)

You have the rights of article 18 of the LGPD, including confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and revocation of consent. Contact our privacy contact at the email above.

Mexico

This policy is our privacy notice. The primary purposes are those needed to provide the Services (Section 3); the only secondary purpose is marketing email, which requires your consent and which you can refuse at any time. You can exercise your ARCO rights (access, rectification, cancellation and opposition), revoke consent and limit use or disclosure by writing to the email above; we will answer within the legal time limits.

Argentina, Colombia, Chile and other Latin American countries

By using the Services you authorize the processing described here and the international transfer of your data to the United States (Section 6). You can exercise your rights of access, update, rectification and deletion at any time by writing to the email above.

Canada and Australia

You can access and correct your personal information and complain about how we handle it by writing to us; you may also contact the Office of the Privacy Commissioner of Canada or the Office of the Australian Information Commissioner.

11. Security

Data travels encrypted (HTTPS/TLS). Our database applies access rules so that each user can only reach their own private data, Community files are stored privately and downloaded through short-lived links, and only a small number of authorized people can access administrative tools. Our providers maintain their own security programs. No system is completely secure; if a breach affects your personal data, we will notify you and the authorities as the law requires. Please use a strong, unique password.

12. Children

Wayra is used by racers of all ages, on motorcycles, karts and cars. You must be at least 13 to have your own account. Racers from 13 to 17 (or up to the age of majority where they live) may have their own account only with the permission of a parent or legal guardian, who accepts the Terms on their behalf, agrees to the processing of the racer's data (such as telemetry, location and video) for the purposes in Section 3 and can review, correct or delete it at any time in the app or by writing to info@wayraracing.com. Children under 13 may not have their own account: a younger racer can use Wayra only through an account created and managed by their parent or guardian, and we do not knowingly collect personal data directly from children under 13. The free mobile app shows ads (Section 2.9). Racers who may be under 18, according to the year of birth given for the account, only get non-personalized ads and are never asked for tracking permission; the parent or guardian can become a member to remove ads. When sharing a young racer's sessions in Community, do not include their full name or other information that identifies them. If you believe a minor is using Wayra without a parent's or guardian's permission, write to info@wayraracing.com and we will delete the data and close the account.

13. Changes to This Policy

We will update this policy when our practices change and change the "Last updated" date. If the changes are material we will notify you by email or in the Services before they take effect and, where the law requires it, ask for your consent.

14. Contact

GIALOVA LLC, dba Wayra Racing, 8128 Natures Way, Unit 17, Lakewood Ranch, FL 34202, USA

Email: info@wayraracing.com (subject "Privacy")

See also our Terms of Service, Community Guidelines and the account deletion page.