This policy explains what personal data Outlap collects, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.
Who we are
Data controller: Outlap, Dublin, Ireland.
Contact: hello@outlap.xyz
Outlap operates the website at outlap.xyz and the application at app.outlap.xyz. References to "Outlap", "we", "us", or "our" in this policy refer to the data controller above.
We are not required to appoint a Data Protection Officer under Article 37 GDPR, but any data protection queries should be directed to the contact address above.
Data we collect
Account and identity data
- Email address — collected when you create an account
- Password — stored in hashed form by our authentication provider; we never see your plaintext password
- Display name — optional, provided by you
Garage and setup data
- Vehicle details you enter: make, model, category, modifications, tyre sets
- AI-generated setup sheets and any notes you attach to them
- Session and event history linked to your garage
Event and club data
- Event registrations, including the event, your car, and run group
- Digital waiver acceptance records (timestamp, event, and your account reference)
- Club membership, role, and season participation records
- Payments — processed by Stripe; we receive transaction confirmation but do not store card details
Usage and technical data
- Pages visited, features used, and interactions with the app
- Device type, browser, operating system, and IP address
- Session identifiers and authentication tokens
Communications
- Messages you send us via email or support chat
- Feedback you submit through the platform
Legal basis for processing
| Activity | Legal basis |
|---|---|
| Creating and managing your account | Performance of a contract (Article 6(1)(b)) |
| Generating AI setups for your car | Performance of a contract (Article 6(1)(b)) |
| Processing event registrations and payments | Performance of a contract (Article 6(1)(b)) |
| Collecting and storing digital waivers | Legitimate interests — legal protection of event organisers (Article 6(1)(f)) |
| Security, fraud prevention, abuse detection | Legitimate interests (Article 6(1)(f)) |
| Product improvement and analytics | Legitimate interests (Article 6(1)(f)) |
| Email communications about your account or events | Performance of a contract / Legitimate interests |
| Marketing communications (if opted in) | Consent (Article 6(1)(a)) |
How we use your data
- To operate your account and provide the features you use
- To generate AI-powered setup recommendations based on your car and the circuit you select
- To process event registrations, collect waivers, and manage group assignments
- To enable club committees to manage their membership and seasons
- To process payments via Stripe Connect on behalf of event organisers
- To communicate with you about your account, events you've registered for, or clubs you belong to
- To detect and prevent fraud, abuse, or violations of our terms
- To improve the platform based on how it's used
Third-party services and data processors
We use the following third-party services to operate Outlap. Each acts as a data processor under a data processing agreement, or as an independent data controller as noted.
| Service | Purpose | Location |
|---|---|---|
| Supabase | Authentication, database, and file storage | EU (AWS eu-west-1) |
| Stripe | Payment processing (independent controller for payment data) | EU / US |
| Cloudflare | CDN, DDoS protection, security | EU / US |
| Netlify | Hosting of the marketing website (outlap.xyz) | US |
| Crisp | Live chat and support communications | France (EU) |
Where data is transferred outside the European Economic Area (EEA) — for example, to Stripe or Netlify infrastructure in the US — we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the transfer mechanism.
Data retention
- Account data: retained while your account is active and for 12 months after deletion, then permanently erased
- Garage and setup data: retained while your account is active; deleted when you delete your account
- Event and waiver records: retained for 6 years after the event date for legal and insurance purposes, even if your account is deleted
- Payment records: retained for 7 years in line with Irish financial record-keeping obligations
- Support communications: retained for 2 years
Your rights
Under GDPR, you have the following rights:
- Access: request a copy of the personal data we hold about you
- Rectification: ask us to correct inaccurate or incomplete data
- Erasure: request deletion of your data where there is no legitimate reason for us to continue processing it
- Restriction: ask us to restrict processing of your data in certain circumstances
- Portability: receive your data in a structured, machine-readable format
- Object: object to processing based on legitimate interests
- Withdraw consent: where processing is based on consent, withdraw it at any time
To exercise any of these rights, email hello@outlap.xyz. We will respond within 30 days. We may need to verify your identity before acting on the request.
You also have the right to lodge a complaint with the Data Protection Commission (DPC), the Irish supervisory authority: dataprotection.ie
Cookies
We use cookies and similar technologies on outlap.xyz and app.outlap.xyz. For a full breakdown of the cookies we set, what they do, and how to manage them, see our Cookie Policy.
Children
Outlap is not directed at children under 16 and we do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data without appropriate consent, please contact us at hello@outlap.xyz.
Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. Significant changes will be communicated to registered users by email. Continued use of Outlap after changes are posted constitutes acceptance of the updated policy.
Contact
For any questions about this policy or how we handle your data:
hello@outlap.xyz
Outlap, Dublin, Ireland