Legal
Privacy
Courtesy translation: only the Italian text is legally binding. Read the Italian original
Last updated: 21 October 2026
In the event of any discrepancy, the Italian text prevails.
Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") for visitors to this website and for users of RoadBookAI: the online Studio for creating and reviewing rally raid roadbooks, the RoadBookAI apps for Android and iOS, events, live tracking, classifications, replays and training with tutors.
1. Data controller
The data controller is M@trix s.r.l., a single-member company, Via Pianette 61, 25064 Gussago (BS), Italy, entered in the Brescia Companies Register under no. 04069100982, VAT no. IT04069100982. Rally POV is a trademark of M@trix s.r.l.; RoadBookAI is a Rally POV project. Privacy contact: info@rallypov.it. No Data Protection Officer (DPO) has been appointed, as the conditions of Article 37 do not apply.
Events and races. For race data (entry, position and tracks during the stage, live tracking, classifications, replays, reports), M@trix and the event organiser, named on the event page and in the app, are joint controllers (Article 26 GDPR): the organiser decides on the event, the rules, what is published and the sporting decisions; M@trix decides on the technical means of the platform and its security. The essence of their agreement is summarised in the annex at the bottom of this page. You may exercise your rights against either of them: if you write to info@rallypov.it, we will reply, coordinating with the organiser.
2. What data we process
| Category | Examples |
|---|---|
| Visits to the website | IP address, date and time, page requested and browser type, in the server's technical logs. The website does not use profiling cookies, analytics tools, or fonts or services loaded from third parties. |
| Account | Email address, name, organisation (optional), language, password hash (argon2id), encrypted two-step verification secret and hashes of the recovery codes, sessions and connected devices (model, operating system, app version, IP address, dates), log of sign-ins and security changes (12 months), app preferences synchronised to your profile. |
| Roadbooks | Uploaded GPX tracks, map data used, notes, waypoints, versions, name of the reviewer recorded against each decision; the radius and rule profiles you save. |
| Reconnaissance | Voice notes (audio with your voice), position and time, transcriptions, written notes, photos, decisions on proposals. |
| Public roadbooks | The listing of the roadbook you publish (title, description, photos, licence), with the author's name; photos are re-encoded and stripped of their metadata (EXIF, location where the photo was taken). |
| Rides with the app (training) | During a ride that you start: GPS position (about one point per second), speed, heading, accuracy, time, actions on the RoadBook (notes, odometer, waypoints, scrolling), alerts (off course, speed, LateNote), GPS and battery status. They stay on the phone; they reach the service only if you are signed in with an account, and the tutor only if you belong to one of their groups (rides after you have accepted, or those you share yourself). |
| Races (events) | Entry uploaded by the organiser (name, email address, race number, class, team, RoadBook/GPX type, any request to appear with your initials). During the stage: GPS position and actions as above, waypoint validations, unlocks, retirements, neutralisations, speeding, LateNote; integrity checks on the device (modified phone, discrepancy between the phone's time and GPS time, data signature); times, penalties, classifications, decisions and comments of race control, rider report. |
| Notifications | Device identifier for push notifications (Firebase Cloud Messaging for Android, Apple Push Notification service for iOS), to alert you to unlocked stages or changes to the roadbook. |
| Requests and contacts | Name, email address, topic and text of messages; for the form, we keep in the security log only the date, email address, topic and IP address. |
We do not ask for special categories of data (Article 9). The position recorded by the app is personal data but not special category data; we do not record health data. Please do not record data of this kind in your voice notes.
3. Purposes, legal bases and retention
| Purpose | Legal basis (Article 6) | Retention |
|---|---|---|
| Displaying the website and protecting it | Legitimate interest in security, point (f) | Logs: 12 months |
| Account, sign-in, security, synchronisation of preferences | Contract, point (b) | For as long as the account exists |
| Roadbooks, reconnaissance, exports, profiles | Contract, point (b) | Until the roadbook or the account is deleted |
| Public roadbooks | Contract, point (b) | For as long as it remains published; thereafter as for roadbooks |
| Training rides, personal replay, reports, groups with tutors | Contract, point (b) | Until the ride or the account is deleted; the tutor sees the rides for as long as you are in their group |
| Races, as joint controller with the organiser: collection of position during the stage, live tracking for race control, calculation of times and penalties, classifications, replays, reports | Contract between rider and organiser (race regulations), point (b); safety of participants and rescue, point (f) | Tracks, replays, reports and decision log: 3 years from the end of the event (protests, sporting appeals, historical record), then deleted; classifications for as long as the event remains published |
| Public event pages (classifications, delayed live map, public replays), if the organiser enables them | Legitimate interest of the organiser in publishing sporting results, point (f) | As above |
| Push notifications | Contract, point (b) | For as long as the device is connected |
| Messages and requests | Pre-contractual measures and contract, point (b) | For the time needed to deal with them |
| Legal obligations | Point (c) | For the period required by law |
4. How position, races and checks work
- When the app records your position. Only during a ride or a stage that you start yourself (including with the screen off, so as not to lose the track): never in the background outside a ride. The operating system shows when the app is using your position.
- Live tracking. During a race stage, your position reaches race control every few seconds, when there is network coverage, for safety and rescue purposes. If the organiser enables the public map, it shows positions with a delay (10 minutes by default) and a short trail, never the race route.
- Public classifications. If the organiser publishes them, they show only your name (or initials, if you ask), number, class, team and results: never your email address, age or gender.
- Calculation of results. Times and penalties are calculated by the server from the recorded track, according to the rules published by the organiser. They are proposals for race control, which checks them and may amend them, cancel them or add others manually (each correction remains in the log with the reason) before making the classification final; every sporting decision (penalties, exclusions, protests) remains with race control. Device integrity checks and LateNote (how many times the RoadBook falls behind your position) produce flags or penalties provided for in the race regulations, always subject to the same review: there is no decision based solely on automated processing (Article 22). You may ask for clarification and challenge a result through the protests provided for in the race regulations.
- Replays, comments and reports. The organiser and their team see the race replays; other riders see them only if the organiser so decides (at the end of the event, with a delay or via a public link). The PDF report of the stage can be downloaded by the organiser and, if the organiser allows it, by the rider concerned (their own report only).
- AI. For reconnaissance notes and for the analysis of errors in the replay, we send the artificial intelligence provider (Anthropic) text only: transcriptions and the context of the notes in the first case, a summary and list of errors in the second. Never audio, coordinates, email addresses or names. Proposals must always be accepted by a person.
- Track and audio. The uploaded GPX is not modified; voice notes are transcribed on our server.
5. Who we share the data with
| Provider | Service | Location |
|---|---|---|
| Shellrent S.r.l., Via dell'Edilizia 19, 36100 Vicenza, Italy, VAT no. 04617280245 | Server (VPS) hosting the website, the Studio, the app service, accounts, roadbooks, race data and backups; sending service emails | Italy |
| Anthropic, PBC, San Francisco (USA) | Interpretation of reconnaissance notes and analysis of replay errors, text only; does not use the data to train its models | USA, standard contractual clauses (Article 46) |
| Mapbox, Inc. (USA) | Satellite and street map in the Studio (the browser requests the images with your IP address). The maps in the apps are hosted on our server | USA, standard contractual clauses (Article 46) |
| Google Ireland Ltd / Google LLC (Firebase Cloud Messaging) | Push notifications to the Android apps: device identifier and an alert containing no race data | EU/USA, Data Privacy Framework and standard clauses |
| Apple Distribution International Ltd / Apple Inc. (APNs) | Push notifications to the iOS apps: as above | EU/USA, Data Privacy Framework and standard clauses |
| Organisers of the events you are entered in and their team (clerk of the course, timekeepers, marshals) | Race data, as joint controllers | As determined by the organiser |
| Tutors of the training groups you accept | Your training rides and their reports | — |
| Other users and the public | Public roadbooks with the author's name; classifications, delayed live tracking and public replays if the organiser enables them | — |
The apps are downloaded from Google Play and the App Store: the privacy notices of Google and Apple apply to those services. The data is not sold or transferred for marketing purposes; it may be disclosed to advisers bound by professional secrecy and to public authorities only to comply with legal obligations or to defend a right.
6. Security
Encrypted HTTPS connection; personal accounts with passwords stored as an argon2id hash and two-step verification (mandatory for administrators) with a secret encrypted with AES-256-GCM; revocable sessions and devices; limits on sign-in attempts with email alerts; access log; data kept separate by account and by event; race RoadBooks encrypted and opened on the phone only at the start time; race data signed by the device; access to systems restricted to authorised persons; signed service updates with a backup. On deletion, the data is removed from live systems; the backups containing it are overwritten within 30 days.
7. Your rights
Access, rectification, erasure, restriction of processing, portability and objection (Articles 15–22). From Account › My data you can download your data and your roadbooks at any time; in the app you can delete your training rides. For race data, erasure may be restricted for as long as the organiser needs the data for the classification, protests and the obligations of the sporting regulations. Write to info@rallypov.it: we reply within one month. You may lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority, garanteprivacy.it).
8. Minors
Accounts are reserved for adults. A minor holding a sporting licence may take part in an event only if entered by the organiser, who collects the consent of the holders of parental responsibility and is responsible for it. If we become aware that an account has been created by a minor outside this case, we close it and delete the data.
9. Cookies
Information on technical cookies and on the browser's local storage is on the Cookies page.
10. Changes
This notice changes as the service changes. The version in force is published on this page with the date of the last update; for important changes, we notify you by email and in the app.
Annex — Essence of the joint controllership agreement with the organiser (Article 26 GDPR)
Made available to data subjects. The organiser accepts the full agreement in the Studio when creating their first event; the date, time and version of the acceptance are recorded.
- Joint controllers: M@trix s.r.l. and the event organiser, for the data of races organised with RoadBookAI.
- Who decides what: the organiser decides on the event, the entrants, the rules and penalties, what to publish (delayed live tracking, classifications, replays, reports to the rider) and every sporting decision, including manual corrections; M@trix decides on and manages the platform, the technical means, security, providers and retention.
- Information notice: this Privacy notice applies to both; the organiser informs the entrants and refers them to this page.
- Data subjects' rights: these may be exercised against either party; the single point of contact is info@rallypov.it; M@trix replies, coordinating with the organiser, within one month.
- Personal data breaches: M@trix informs the organiser without undue delay (within 48 hours) and manages the notifications to the Garante and to data subjects in agreement with the organiser.
- Platform providers: Shellrent (hosting, Italy), Anthropic (text only, for the analysis of replay errors, if used), Google FCM and Apple APNs (push notifications); prior notice for new providers.
- Minors: the organiser collects the consent of the holders of parental responsibility.
- Retention: 3 years from the end of the event for tracks, replays, reports and the decision log; then erasure, unless disputes are pending; full export to the organiser on request.