Privacy Policy
Last updated: 30 May 2026
1. Introduction
RaceIntel ("we," "our," or "us") is committed to protecting your privacy. This policy explains how we collect, use, store, share, and protect your personal data when you use our website, mobile applications, and services (collectively, the "Platform").
RaceIntel is a trading name operated from Ireland. For data protection purposes, we act as the Data Controller. If you have questions about this policy, contact us at privacy@raceintel.com.
This policy is governed by the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018, and the UK GDPR / Data Protection Act 2018 where applicable.
2. Data We Collect
2.1 Account Data (Required)
When you create an account, we collect:
- Email address — used for authentication, account recovery, subscription management, and service announcements
- Authentication credentials — stored securely by Supabase Auth; we never see your raw password
- Display name (optional) — shown on your profile within the Platform
- Date of birth — used solely to verify you are 18+; stored but not shared
2.2 Platform Usage Data
When you use RaceIntel, we collect:
- Racing preferences — favourite tracks, followed horses/trainers/jockeys ("My Stables")
- Bet tracking data — bets you manually log (P&L, ROI, strike rate, bookmaker, odds)
- Notification preferences — which alerts you want, quiet hours, channels (push/email)
- Subscription data — plan type, status, trial dates, payment method type (not full card details)
⚠️ Bet tracking data is private by default. It is stored in your personal account and is never shared with other users, third parties, or used for marketing purposes. It exists solely for your own performance analysis.
2.3 Technical Data (Automatic)
- IP address — logged temporarily for security, rate-limiting, and geolocation (country-level only)
- Device information — browser type, OS, device model (for push notification routing and error debugging)
- Push notification tokens — stored when you enable notifications (platform: iOS/Android/Web)
- Usage analytics — anonymised page views, feature usage, and error tracking via Supabase analytics
- Cookies — strictly necessary session cookies for authentication; analytics cookies (if you consent)
2.4 Payment Data
Payment processing is handled entirely by Stripe, our payment processor. We never receive, store, or have access to your full credit card number, CVC, or bank details. Stripe provides us with:
- A customer ID
- Last 4 digits of your card (for display in your account)
- Card brand (Visa, Mastercard, etc.)
- Subscription status and expiry dates
Stripe's privacy policy: stripe.com/privacy
3. How We Use Your Data
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Account creation & authentication | Email, credentials | Contractual necessity |
| Subscription management & billing | Stripe customer ID, subscription status | Contractual necessity |
| Delivering AI predictions & form analysis | Racing preferences, followed entities | Contractual necessity |
| Push notifications & alerts | Push tokens, notification preferences | Consent (opt-in) |
| Bet tracking & P&L analytics | Manually logged bet data | Consent (you choose to log bets) |
| Platform improvement & debugging | Anonymised usage analytics, error logs | Legitimate interest |
| Security, fraud prevention & legal compliance | IP address, account activity | Legal obligation / legitimate interest |
| Marketing (only with consent) | Email address | Consent (opt-in) |
4. Data We Do NOT Collect, Share, or Sell
- We do not sell your data. Ever. To anyone. We have no ad network, no data broker relationships, and no third-party analytics providers that monetise user data.
- We do not share your betting history with other users, third parties, bookmakers, or any external entity. Your bet log is fully private to your account.
- We do not run targeted advertising. RaceIntel is subscription-funded. We do not display ads or use tracking pixels for ad retargeting.
- We do not profile you for automated decisions that have legal or similarly significant effects. Our AI provides racing predictions; it does not make credit, employment, or insurance decisions about you.
- We do not share data with bookmakers or gambling operators. RaceIntel is an independent analysis platform with no commercial relationships with any bookmaker.
5. Third-Party Data Processors
We use the following processors to operate the Platform. Each is GDPR-compliant and contractually bound:
| Processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database hosting, authentication, storage | All account & platform data | EU (eu-west-1) |
| Stripe | Payment processing | Email, payment method type, transaction metadata | Global (EU data centres available) |
| Vercel | Website hosting & edge functions | IP address (logs), request data | Global edge network |
| OpenRouter | AI model inference | No user data — only race data & anonymised prompts | US (model routing only) |
⚠️ Important: When we send race data to OpenRouter for AI analysis, we send only anonymised horse racing data (runner names, form figures, odds). No user-identifiable information is included in AI prompts. OpenRouter does not train on API-submitted data.
6. Data Retention
- Account data: Retained for the lifetime of your account. Deleted within 30 days of account deletion request.
- Bet tracking data: Retained while your account is active. Deleted with your account.
- Push notification tokens: Retained until you disable notifications or delete your account.
- IP address logs: Retained for a maximum of 90 days for security purposes.
- Payment records: Retained for 7 years as required by Irish tax law. Payment method details are handled by Stripe, not stored by us.
- Anonymised analytics: Retained indefinitely in aggregate form (cannot be linked to you).
7. Your Rights Under GDPR
As a data subject in the EU/EEA or UK, you have the following rights:
Request a copy of all personal data we hold about you. We respond within 30 days.
Correct inaccurate or incomplete personal data. You can update most information directly in your account settings.
Request deletion of your personal data. We will delete your account and all associated data within 30 days, except data we are legally required to retain (e.g., tax records).
Receive your data in a structured, machine-readable format (JSON/CSV). You can export your bet tracking data, followed entities, and account data on request.
Object to processing based on legitimate interests or restrict processing in certain circumstances.
Withdraw consent for optional processing (marketing, push notifications) at any time via your account settings or by contacting us.
To exercise any of these rights, email privacy@raceintel.com. We will verify your identity before processing your request. You also have the right to lodge a complaint with the Irish Data Protection Commission or your local supervisory authority.
8. Data Security
- All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
- Authentication is handled by Supabase Auth with bcrypt-hashed passwords.
- Database access is governed by Row-Level Security (RLS) policies — users can only access their own data.
- Service role keys are never exposed to the client; all sensitive operations use server-side API routes.
- We conduct regular security reviews of our infrastructure and dependencies.
9. Age Restriction
RaceIntel is intended for users aged 18 years or older. We collect date of birth during registration specifically to verify this. We do not knowingly collect data from individuals under 18. If we discover an account belonging to a minor, we will delete it immediately.
10. Changes to This Policy
We will notify you of material changes to this policy via email and/or an in-app notice at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revisions.
11. Contact
For privacy-related inquiries or to exercise your data rights:
Email: privacy@raceintel.com
Data Controller: RaceIntel, Ireland
You may also contact our EU Representative or your local Data Protection Authority. The lead supervisory authority for RaceIntel is the Irish Data Protection Commission (DPC).