Join the waitlist

Privacy policy

Last updated: 28 September 2026

1. Who is responsible

The controller of your personal data is Dataheroes s.r.o., Malženice 418, Malženice, 919 29, Slovakia, IČO 56117094, registered in the Obchodný register Okresného súdu Trnava, oddiel Sro, vložka č. 56264/T. Email: matej@dataheroes.dev.

We have not appointed a data protection officer. Use the email above for any privacy question or request.

2. What we process, why, and for how long

Account

  • Data: username, email, password (stored only as an Argon2 hash), optional real name, language, units and theme preferences, two-factor secret if you turn it on, registration date.
  • Purpose: create and run your account, log you in, secure it, send account emails (password reset, confirmations).
  • Legal basis: contract (Art. 6(1)(b) GDPR). Security of the account: legitimate interest (Art. 6(1)(f)).
  • Kept: until you delete your account. Deletion removes it immediately from the live database. Backups are kept for 30 days, then deleted, so your data can remain in them for up to 30 days after you delete your account.
  • Providing this data is required to have an account. Without it, we cannot give you one.

Profile, cars and sessions

  • Data: what you add: bio, birthday, driving since, avatar and cover photos, social links, cars and their setup, uploaded .vbo files (GPS position, speed, time and other recorded channels), laps and sector times, notes, video links, weather at the time and place of the session, and the visibility you choose.
  • Purpose: provide the Service: analyse and show your sessions, compare laps, show public profiles, feeds and leaderboards, and, for public content, make it findable by search engines.
  • Legal basis: contract (Art. 6(1)(b)). Optional profile details are voluntary and shown only if you add them.
  • Public content: public sessions, cars and profiles are visible to anyone on the internet and can be indexed by search engines. GPS data can show where you drive, and may show where you live or park if a recording starts there. Use private sessions (Pro) or trim your files if that matters to you.
  • Kept: until you delete the content or your account.

Friends, comments and notifications

  • Data: friend requests and friendships, who you shared sessions with, your comments, in-app notifications.
  • Purpose and basis: provide these features (contract). A friend request also sends one email to the other person.
  • Kept: until deleted by you or the account is deleted. If you unfriend someone, they lose access to sessions shared between you.

Payments and Pro

  • Data: your email, name and billing address, tax ID if you enter one, subscription status and dates. Stripe collects card details. We never see them. We store your Stripe customer ID.
  • Purpose: take payment, manage the subscription, issue invoices, calculate VAT.
  • Legal basis: contract (Art. 6(1)(b)) and legal obligation for accounting and tax (Art. 6(1)(c)).
  • Kept: accounting records for the period set by Slovak law, which is currently 10 years.
  • Providing this data is required to buy Pro.

Newsletter and waitlist

  • Data: your email, language, and the confirmation status.
  • Purpose: send you product news (newsletter) or tell you when the Service opens (waitlist).
  • Legal basis: your consent (Art. 6(1)(a)). We use double opt-in for the newsletter. You can unsubscribe at any time with the link in every email. This does not affect earlier processing.
  • Kept: until you unsubscribe or ask us to delete it.
  • This is voluntary.

Logs and security

  • Data: for each request: time, page (route), result, duration, and a short one-way hash of your CSRF cookie to follow one visit, plus your username if you are logged in. We do not write IP addresses, user agents, query strings or form contents to our application logs. The server briefly keeps your IP address in memory to limit the number of requests (rate limiting) on login, registration, comments, newsletter, waitlist and the demo. The web server in front of the Service (nginx) keeps standard access logs with your IP address, time, requested address, result and browser (user agent). They are kept for 1 month and then deleted.
  • Purpose: keep the Service secure and working, find and fix errors, prevent abuse.
  • Legal basis: legitimate interest (Art. 6(1)(f)).
  • Kept: application logs are kept for 1 month.

Landing page demo

If you try the demo with a .vbo file without an account, the file is analysed in memory, shown to you once, and not stored.

Contact by email

If you write to us, we use your message and email address to answer you (legitimate interest, or contract if it is about your account) and keep it as long as needed for the matter and any related claims.

3. Who receives your data

We share data only with providers that help us run the Service, under data processing agreements, and with authorities when the law requires.

  • Hosting: Hetzner Online GmbH. Servers located in Germany. Stores the database and uploaded files.
  • Payments: Stripe Payments Europe, Ltd. (Ireland), and Stripe, Inc. (USA). Receives email, name, address, tax ID and payment details when you subscribe. Stripe is an independent controller for its own legal duties, such as fraud prevention and financial regulation.
  • Email: Brevo (Sendinblue SAS, France). Sends our transactional emails and newsletters, and stores newsletter and waitlist contacts. It receives your email, and message content.
  • Weather data: Open-Meteo (Switzerland). To get the weather, we send only the date and hour of a session and the location where its recording starts (coordinates rounded to 4 decimals, about 10 metres), never your name or account. This is the first GPS point of your file, so it can be a place other than the track.
  • Public content: anyone on the internet, for anything you make public.

We do not use analytics, advertising or tracking services, and we do not sell your data.

4. Transfers outside the EU/EEA

Stripe may process data in the USA. The transfer is covered by the EU-US Data Privacy Framework and standard contractual clauses. Switzerland has an EU adequacy decision. We do not knowingly transfer data anywhere else.

5. Cookies and similar storage

We use only what is needed to run the Service. Because of this, we do not show a cookie banner. Stripe may set its own cookies on its checkout page, which are described by Stripe.

  • stintdelta_session: keeps you logged in. Set at login, expires after at most 30 days, or 7 days without activity. Strictly necessary.
  • stintdelta_csrf: protects forms against forged requests. Browser session. Strictly necessary.
  • A short-lived cookie during two-factor login (5 minutes): remembers that your password was accepted. Strictly necessary.
  • stintdelta_locale: remembers the language you chose. 1 year. Set only when you pick a language.
  • stintdelta_theme and stintdelta_sidebar_collapsed (local storage in your browser, never sent to us): remember light or dark theme and whether the sidebar is collapsed. Kept until you clear your browser data.

6. Your rights

You have the right to access your data, correct it, delete it, restrict its processing, receive it in a portable format, and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time.

  • Export: in Settings, you can download all your sessions as original .vbo files. For anything else, write to us.
  • Deletion: in Settings, you can delete your account and all your data yourself.
  • Other requests: matej@dataheroes.dev. We answer within one month.

You can complain to the Slovak supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky, Budova Ex Ministerstva vnútra SR, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk. You can also complain to the authority in your own EU country.

7. Automated decisions

We do not make decisions based only on automated processing that have legal or similarly significant effects on you, and we do not do profiling. Lap detection and analysis are calculations on your own data.

8. Security

Passwords are stored as Argon2 hashes. Two-factor login is available. Connections use HTTPS. Access to servers is limited to us.

9. Children

The Service is not meant for people under 16. If you think a child has given us data, write to us and we will delete it.

10. Changes

We will update this page when our processing changes, and change the date at the top. For important changes, we will tell you by email or in the Service.