Privacy policy

Corsalo ("we", "us") provides a platform that track day organizers use to run their events: a web admin, a staff app and a rider app. Corsalo is operated by PAVLE RALIĆ PR AVEDOC, Palmira Toljatije 46/24, Belgrade, Serbia, registration number 66397220, tax ID (PIB) 112852591.

Questions about privacy: info@corsalo.com.

Website and organizer accounts. For this website, contact requests and the accounts of organizers and their staff, we decide how data is used and act as the controller.

Rider data at an event. When an organizer imports riders or approves a walk-in registration, the organizer is the controller of that data and we process it on their behalf as a processor, under a data processing agreement. If you are a rider, the organizer of your event is your first point of contact for questions about your data.

Website visitors. When you use the contact form: your name, email, company and message. We don't use tracking or advertising cookies.

Organizers and staff. Name, email, sign-in details (email and password, or Google or Apple sign-in), company details, role, and a log of actions such as scans, group changes and published regroups.

Riders, as provided by the organizer or entered at walk-in registration:

• name, email, phone, race number, bike, class, emergency contact and group;
• checkpoint status (registration, transponder, tech inspection, briefing, sticker), group history and transponder assignment;
• lap times and timing data linked to the rider's transponder;
• a nickname and leaderboard privacy choices set by the rider;
• chat messages with the organizer, including photos and voice messages the rider chooses to attach;
• location, only if the rider turns on the transponder return reminder: the app watches, also in the background, whether the phone leaves the track area while the rider still has a rental transponder, and then sends that position and time to the organizer so staff can get the transponder back. The app doesn't track the rider's route, and the reminder ends after the event;
• camera, only to scan QR codes (passes, registration codes, rider identity) on the phone; the camera image isn't stored or sent;
• device data needed to run the app: a device identifier, a public signing key for the identity QR, the app version and a push notification token.

Riders don't create an account. Access to an event comes from the pass issued by the organizer.

• To provide the platform to organizers and their riders (performance of a contract with the organizer; for riders, the organizer's basis).
• To answer contact requests and prepare demos (our legitimate interest in replying to you).
• To send push notifications about the event, such as schedule alerts, group changes and transponder reminders (part of the service the organizer runs).
• To remind riders to return a rental transponder and tell the organizer where a rider left the track with one, when the rider has turned that reminder on (consent, which the rider can withdraw in the app or the phone settings at any time).
• To keep the platform secure, prevent abuse and keep an audit log of sensitive actions (legitimate interest and legal obligations).
• To invoice organizers and meet accounting obligations (contract and legal obligation).

• Rider access to an event on our servers ends 7 days after the event. The rider app keeps a read-only copy on the phone until 31 December of that year, then deletes it.
• Event data on our servers is kept for as long as the organizer's account is active, or deleted earlier at the organizer's request, subject to the organizer's retention settings.
• Contact form messages and data deletion requests: up to 24 months after our last exchange.
• Invoices and billing records: as long as accounting law requires.

We don't sell personal data. We use these service providers to run Corsalo:

• Supabase: database, authentication and file storage, hosted in the EU (Frankfurt);
• Google Firebase Cloud Messaging and Apple Push Notification service: push notifications;
• Vercel: website hosting;
• Web3Forms: delivery of contact form messages;
• Cal.com: scheduling demo calls, when you book one;
• Resend: transactional emails;
• Microsoft Azure (EU): translating organizer posts into riders' languages and reading announcements aloud, without rider personal data;

Within an event, other riders can see leaderboard entries (name or nickname, race number, bike and lap times) unless the rider has chosen to hide them. Organizers and their staff always see full rider data for their own events.

Our main data is stored in the EU. Where a provider processes data outside the EEA, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.

Access to data is enforced in the database itself, not only in the apps: organizers and staff only see their own company's events, and riders only see events they hold a pass for. Identity QR codes are signed on the device and refresh every 30 seconds. Sensitive actions are written to an audit log.

You can ask to access, correct, delete or export your data, to restrict or object to its use, and to withdraw consent where we rely on it. You can also complain to your data protection authority.

Riders: please contact the organizer of your event first, since they control your event data. We will help them answer your request. You can also remove an event from your phone at any time in the app's settings.

Corsalo is not intended for children under 16 without the involvement of a parent or guardian. Organizers who admit younger riders are responsible for obtaining any required consent.

We will update this page when our practices change and change the date at the top. Organizers will be told about material changes by email.