Privacy Policy

The controller of your personal data is NOT A COMPETITION, headquartered at 34 rue Marcel-Cachin, 55240 Bouligny.

For any question about your data, write to us at contact@optimal-lap.gg.

We only collect the data needed to run Optimal Lap:

• Account: email address, username, password (stored only as a bcrypt hash), language, plus your avatar, bio and country if you provide them.
• iRacing profile: if you link your account through OAuth2 (PKCE), your iRacing customer ID, licences, ratings and linked account data. The iRacing access and refresh tokens are encrypted (AES-256-GCM) in our database.
• Subscription and billing: payment is handled by Stripe (Stripe Checkout, Stripe Tax and the billing portal). We never see or store your card numbers; we only keep the Stripe customer ID and the history of your subscriptions and invoices.
• Published content: setups (with their .ibt telemetry files, where provided), reviews, messages and reports that you publish or send on the platform.
• Proof of acceptance of terms: the date, the version of the terms accepted, where the acceptance came from (sign-up, payment, update banner), your IP address and your browser.
• Launch waiting list: email address, language, chosen profiles and series (see the “Launch waiting list” section).
• Optimal Sync: name of the linked computer and usage dates (see the “Optimal Sync” section).
• Technical data: IP address, browser, session cookie, server logs and error reports.
• Audience measurement: pages viewed, referring site or campaign (utm parameters), device type, browser, operating system, language, country and city derived from the IP address, and steps completed (sign-up, waiting list, checkout start, subscription, seller activation, Optimal Sync download). No cookie is set and the IP address is not stored: visits are grouped by an identifier computed from the IP address and the browser, which changes every month. Page addresses are sent without their parameters, except utm parameters.

Each processing activity relies on one of these legal bases:

• Performance of a contract: creating and managing your account, managing your subscription, keeping evidence of the terms you accepted, giving you access to setup downloads, enabling messaging and reviews, linking the Optimal Sync app, showing your public profile, sending transactional emails (confirmations, password resets, invoices).
• Legal obligation: issuing invoices, keeping accounting records and applying tax rules.
• Legitimate interest: securing the platform, preventing fraud and abuse, moderating reported content and resolving technical incidents, and establishing proof of acceptance of the terms in case of a dispute. It also covers measuring site traffic and how well our campaigns perform, as aggregated statistics; you can object by turning on “Global Privacy Control” or “Do Not Track” in your browser.
• Consent: the launch waiting list emails, which you accept by ticking the box on the sign-up form. The cookies we use are all necessary for the site to work and do not require consent.

We do not sell your data and we use no advertising tools.

Before the opening, you can join the waiting list from the launch page.

• Data: your email address, your language, the profiles you chose (driver, setup creator, coach), the iRacing series you selected, the confirmation and unsubscribe dates, and the history of your sign-up (sign-up, confirmation, emails sent, unsubscribe).
• Purpose and legal basis: sending you the launch emails for your profiles (early access, opening, reminders, season start, launch announcements) and, where applicable, the launch offer. This relies on your consent, given by ticking the box on the form and then confirmed through the link sent by email, valid for 7 days. Without this confirmation, you receive no launch email.
• Link to your account: if you have or create an account with the same email address, your confirmed sign-up is attached to it and the series you chose are added to your “My iRacing season” favourites.
• Unsubscribe and erasure: every email has a one-click unsubscribe link. If your sign-up is not attached to an account, unsubscribing counts as an erasure request: the sign-up is deleted 30 days later. A sign-up that is never confirmed is kept with no time limit until you unsubscribe; the link is also in the confirmation email. If it is attached to an account, you stop receiving launch emails and the sign-up is deleted with your account.

Optimal Sync is the Windows app that installs the setups you download into iRacing.

• Linking a computer: to link the app to your account, we store the computer name given by Windows, so you can recognise the device on the linking page and in your profile, along with the link date, the date it was last used and a fingerprint of the device token. You are told by email and by notification when a computer is linked.
• Use: the app sends the list of setups already installed to find out whether a new version exists, and fetches the current week for your favourite series and cars. Downloads made through the app are recorded like the ones made on the site.
• On your computer: the location of your iRacing folder and the device token stay on your computer.
• Unlinking: you can unlink a computer at any time from the app or your profile; it then loses all access to your account. Linked computers are deleted with your account.

Every account has a public profile page that anyone can see, including people without an account. It shows your username, avatar, country, sign-up date, roles (seller, coach) and badges and, depending on your settings:

• Bio;
• iRacing stats, if you linked your iRacing account: your iRacing display name (usually your real name), your iRacing customer ID, your iRacing member-since date, your club, your licences, your iRating and your safety rating;
• Optimal Lap stats: number of published setups, downloads and average rating if you are a seller, number of sessions and average rating if you are a coach.

You can hide each of these three sections in your profile, under “Profile visibility”. A page that shows at least one of them can be indexed by search engines. Your downloads and booked sessions as a subscriber are only visible to you.

We rely on the following providers, which process data on our behalf:

• Railway: hosting of the API, the website, the database and the cache.
• Stripe: payments, invoicing and tax calculation. When payouts to sellers open, Stripe Connect will be used to make them.
• Resend: sending transactional emails.
• Cloudflare R2: file storage (setup files, images).
• Sentry: when enabled, technical error monitoring; email addresses, IP addresses, cookies and payment identifiers are removed from reports before they are sent.
• Umami: cookieless audience measurement, as aggregated statistics.
• iRacing: the OAuth2 sign-in that you explicitly authorise, and retrieval of your iRacing profile data (licences, ratings).

We use no advertising tools, and we never sell or rent your data to third parties.

Some of our providers are based, in whole or in part, in the United States. When your data is transferred outside the European Union, the transfer is covered by appropriate safeguards: the European Commission’s standard contractual clauses and/or the EU–US Data Privacy Framework where the provider is certified.

• Account data: kept while your account is active. After an account deletion, it is anonymised or deleted as described in the “Your rights” section.
• Invoices and accounting records: 10 years, in line with the French legal obligation to keep accounting documents.
• Proof of acceptance of the terms and of the withdrawal waiver: the date, the version of the terms, where the acceptance came from (sign-up, payment, re-acceptance), your IP address and your browser, together with the record of the waiver given when you paid for the subscription, are kept for as long as needed to evidence your agreement. When your account is deleted, the IP address and browser are erased; the date and version are kept.
• Account deletion: the confirmation link is valid for 24 hours and the deletion takes place 30 days after confirmation.
• Notifications: shown for 30 days, then deleted after 90 days.
• Launch waiting list: the confirmation link is valid for 7 days. A sign-up that is never confirmed is kept with no time limit until you unsubscribe or ask for its erasure. A sign-up not attached to an account is deleted 30 days after you unsubscribe; a sign-up attached to an account is deleted with that account.
• Computers linked to Optimal Sync: kept until your account is deleted, including the ones you unlinked, which no longer have any access.
• Sellers’ Stripe Connect payout account: its identifier is kept after the account is deleted, together with the payout history, for our accounting obligations.
• Technical logs and error reports: for a limited period needed for security and troubleshooting.

Under the GDPR, you have the right to access, rectify, erase, restrict and object to the processing of your data, and the right to data portability.

• Export: you can download your data yourself from your profile, privacy tab.
• Deletion: you can request it from the same tab. You receive a confirmation email whose link is valid for 24 hours. Once confirmed, the deletion takes place after a 30-day period during which you can cancel it. An active subscription must end before deletion.

On deletion, your account is anonymised: your email and name are replaced and your password is made unusable. Your favourites, notifications, iRacing data and ratings, your waiting list sign-up and the computers linked to Optimal Sync are deleted. Your avatar is erased from our storage, the text of your reviews, messages and reports is redacted, and your name is removed from the review notifications sellers received. Billing records are kept, without the Stripe customer ID, to meet our legal obligations. Setups you have already published stay online and are attached to the anonymised account: they no longer carry your name.

At Stripe, your customer record (name, email address, billing address, payment method) and your payment history are kept: they are needed to process payments and to meet legal retention obligations (invoices, accounting). On our side, the link between this record and your account is erased, and a new account opened with the same email address does not reuse it. A subscription whose first payment never went through is cancelled. If you are a seller, earnings not yet paid out to you on the deletion date are no longer paid; a payout already in progress must complete first.

For any other request, write to us at contact@optimal-lap.gg. If you believe your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr).

We protect your data with appropriate technical and organisational measures:

• passwords hashed with bcrypt;
• sessions protected by an HTTP-only cookie;
• iRacing tokens encrypted (AES-256-GCM) in our database;
• payments handled exclusively by Stripe;
• rate limiting and authentication checks on the API.

We only use cookies that are necessary for the site to work, such as the session cookie. No analytics or advertising cookies are set: audience measurement works without cookies. For details and ways to manage them, see our cookie policy.

We may update this policy. The date of the last update appears at the top of the page; for any significant change, we will inform you by email or through a notice on the platform.

For any question about this policy or your personal data, write to us at contact@optimal-lap.gg.