Platform privacy policy

_Last updated: 2026-10-30_

1. Who we are

Apexium Systems (Portugal) operates the RaceTeamHub platform. For platform accounts, team owners and billing we are the controller. For what each team stores about its members (drivers, results, iRacing statistics entered by the team, photos) the team is the controller and we are the processor — every team's own privacy page is linked from its site footer. Contact: privacy@apexiumsystems.com.

2. What we process

| Data | Source | Purpose | Legal basis | | --- | --- | --- | --- | | Discord account (id, name, avatar, e-mail) | Discord login | Authentication, team roles | Contract (art. 6(1)(b) GDPR) | | Teams created, plan, settings | The team owner | Providing the service | Contract | | Billing data (name, address, VAT id, card last digits) | The team owner, via Stripe | Subscriptions and invoices | Contract and legal obligations (art. 6(1)(c)) | | Technical logs (IP, user agent, time) | Automatic | Security, diagnostics, abuse prevention | Legitimate interest (art. 6(1)(f)) | | Transactional e-mail (invites, notices, invoices) | The platform | Running the service | Contract |

We do not sell data, run behavioural advertising or use tracking cookies.

3. iRacing data

The platform does not connect to iRacing's API or to drivers' iRacing accounts. The iRacing ID, iRacing name and statistics (iRating, Safety Rating, licence) on a profile are the ones the driver or the team enters, and results arrive by hand, by CSV, by webhook or from the team's Discord results bot. Every driver can hide the statistics from the public site, unlink their ID or delete their account. We never ask for iRacing passwords.

4. Sub-processors and transfers

Hosting and storage in the European Union (Apexium Systems' own infrastructure, Portugal); e-mail (Resend); payments (Stripe); login (Discord). Stripe, Discord and Resend may process data outside the EU under standard contractual clauses.

5. Retention

Platform account: while it exists and up to 12 months after you delete it. Invoices: 10 years (tax law). Technical logs: 30 days. Backups: up to 35 days. A deleted team is removed with all its data.

6. Your rights

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent — in /conta on each team site (JSON export, consents, hiding iRacing statistics, deletion) or by e-mail to privacy@apexiumsystems.com. You may lodge a complaint with the Portuguese authority CNPD (cnpd.pt) or your local authority.

7. Cookies

Strictly necessary only: session (login), language and, for administrators, the site editor preview.