LapViz - Privacy Policy
Last updated: October 31, 2026
This policy explains which personal data LapViz processes, why, on which legal basis, who receives it, how long it is kept and how You exercise Your rights under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).
Who is responsible
The controller of Your personal data is Mengal SRL, Rue de la Haie Monseu 3, 4550 Nandrin, Belgium, enterprise number BE 0477.515.459 ("LapViz", "We", "Us"). For any question about Your data or to exercise Your rights, write to support@lapviz.com. Mengal SRL has not appointed a data protection officer: it is not required to.
This policy covers the website lapviz.com (with LapViz Studio, the 3D replay, the API and the import by e-mail) and the LapViz mobile apps ("the Service"). Open Live Timing has its own privacy policy.
The data We process
| Category | What | Where it comes from |
|---|---|---|
| Account | E-mail address, name, password (stored hashed), language, nationality, birth date (optional, used to protect minors), profile picture, driver details (category, number, team, licence country), Your sharing and communication choices. With Google, Facebook or Apple sign-in: the identifier and the e-mail address that provider gives. | You |
| Sessions and telemetry | The files You send and what they contain: GPS positions, speeds and trajectories, lap and sector times, the other channels of the logger (engine speed, temperatures, accelerations), the vehicle, the setup, notes, links to videos, the logger (brand, serial). The weather of a session is found from its place and time. The heart rate, health data, is not kept: it is removed from the session when it is imported. | You, Your apps and loggers, a coach or team member who imports for You |
| Mobile apps | The precise location of the phone while the lap timer runs (also when the screen is off, if You allow it), its motion sensors, the data of the Bluetooth devices You connect (GPS receivers, OBD-II adapters), the token of the push notifications. Recorded sessions stay on the phone until they are sent to Your library. | Your phone |
| Coaching and teams | Coaching requests, answers, voice memos, coach profiles, team memberships, requests and invitations. | You and the other members |
| AI coach | Your questions, the conversations, the debriefs and the notes the coach keeps. | You |
| Subscription | For LapViz Pro: the Stripe customer and subscription identifiers, the plan, its status and dates. Never Your card details. | Stripe |
| Messages | The e-mails You send to support and to import@lapviz.com, with their attachments. | You |
| Technical data | IP address, browser, pages requested, date and time (server logs), security events (failed sign-ins, blocked requests). | Your device |
Why We use them, and on which legal basis
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Provide the Service: Your account, the import and timing of Your sessions, the analysis, the sharing You choose, the rankings of the sessions whose lap times You share, the sync of the apps, coaching and teams | Contract (6(1)(b)) |
| The LapViz Pro subscription and its benefits | Contract (6(1)(b)) |
| The AI coach | Your consent, given in the coach (6(1)(a)), and the contract |
| Security: sign-in protection, lockout, rate limits, logs, prevention of abuse | Legitimate interest in a secure Service (6(1)(f)) |
| The circuit database built from GPS data (see Circuit database) | Legitimate interest (6(1)(f)); You can object |
| The e-mails about Your activity (see E-mails) | Legitimate interest (6(1)(f)); You can turn them off |
| The newsletters | Your consent (6(1)(a)) |
| Audience measurement without cookie (Umami) | Legitimate interest (6(1)(f)) |
| Advertising measurement (Meta pixel and Conversions API) | Your consent (6(1)(a)) |
| Hiding the profile of minors | Legitimate interest in protecting minors (6(1)(f)) |
| Legal obligations and requests of authorities | Legal obligation (6(1)(c)) |
Where the basis is Your consent, You can withdraw it at any time; this does not affect what was done before. Where it is Our legitimate interest, You can object (see Your rights).
Cookies
Cookies used by LapViz
The Website sets the necessary cookies below. They need no consent and cannot be turned off from the Website.
- .AspNetCore.Identity.Application, .AspNetCore.Cookies, Identity.External: Your sign-in (session, or 14 days with "Remember me")
- .AspNetCore.Antiforgery.*: protection of the forms against forged requests (session)
- .AspNetCore.Culture: the language You chose (1 year)
- .AspNetCore.Mvc.CookieTempDataProvider, .Filter.Selection: a message or a filter kept from one page to the next (session)
- lv_app, lv_feed_seen: the Website opened in the LapViz app, the activity of the dashboard You have seen
- lapviz_consent: Your choice in the cookie banner (6 months)
Marketing cookies, set only if You accept them in the cookie banner (see Advertising measurement):
- _fbp: identifier of the browser set by the Meta pixel (90 days)
- _fbc: the click on a LapViz ad on Facebook or Instagram that brought You to the Website (90 days)
The audience measurement works without cookie (see Analytics).
Third-party content is loaded only when You ask for it: the comments of the sessions (Disqus, which sets its own cookies) appear after a click. The weather forecast of the circuit pages is fetched by the server of LapViz: Your browser calls no third party for it. The videos are played from youtube-nocookie.com, and the maps of the Website come from Mapbox, which receives Your IP address and the area shown.
Who receives Your data
Other users see what You choose to share (see Sharing of Your sessions). The administrators of LapViz can access the data for the support and the security of the Service. Besides, these service providers process data on Our behalf, or as independent controllers where stated:
| Recipient | For | Location |
|---|---|---|
| OVH SAS | Hosting of the website, of the stored files and of the mailboxes | France |
| RavenDB Ltd (RavenDB Cloud, on Amazon Web Services) | The database of the Service: accounts, sessions, and all the data above | United States (Virginia) |
| Resend, Inc. | Sending the e-mails | United States |
| Stripe Payments Europe, Ltd. (with Stripe, Inc.) | Sale of LapViz Pro as reseller: payment, invoices, taxes and fraud prevention, as independent controller (Stripe privacy policy) | Ireland, United States |
| Anthropic PBC | The answers of the AI coach | United States |
| Umami Software, Inc. | Audience measurement without cookie | United States |
| Meta Platforms Ireland Limited | Facebook sign-in; advertising measurement, only with Your consent | Ireland, United States |
| Google (Google Ireland Limited, Google LLC) | Google sign-in, push notifications of the Android app, maps of the Android app, videos (youtube-nocookie.com) | Ireland, United States |
| Apple Distribution International | Sign in with Apple, push notifications of the iPhone app | Ireland, United States |
| Mapbox, Inc. | Maps of the Website | United States |
| Visual Crossing Corporation | The weather of a session, from its place and time only, and the forecast of a circuit, from its place only (never Your identity) | United States |
| OpenStreetMap Foundation (Nominatim) | The name of a new circuit, from its coordinates only | United Kingdom |
| Disqus, Inc. | The comments of the sessions, only after You click to show them | United States |
The picture of an account without one of its own is its initials, drawn by LapViz: no third party receives anything to show it.
We may also disclose data when the law requires it (a court or an authority), to defend Our rights, or to the buyer of the Service if it is sold, which would be announced before.
Transfers outside the European Union
The database of the Service is hosted in the United States (its move to the European Union is planned), and several providers above are based there; RavenDB Ltd, which runs the database, is based in Israel, covered by an adequacy decision. These transfers rely on the EU-U.S. Data Privacy Framework for the certified providers, or on the standard contractual clauses of the European Commission (Article 46 GDPR); the transfer to the United Kingdom relies on an adequacy decision. You can ask Us for a copy of these safeguards.
How long We keep Your data
| Data | Kept |
|---|---|
| Your account and its data (sessions, files, coaching, AI coach, teams, preferences) | Until You delete Your account; then deleted. The teams You own go to another member. |
| A session You delete | Out of Your library at once, deleted for good with its files about two minutes later |
| Files uploaded but not imported yet | 7 days (1 day for a conversion) |
| Files that cannot be read yet | Until LapViz reads their format, at the latest until Your account is deleted; ask Us to delete them sooner |
| The export of Your data | 7 days after it is ready |
| Server logs | 20 days |
| Backups of the database | 1 month, then overwritten: deleted data leaves the backups within a month |
| Subscription | With Your account; Stripe keeps the invoices as long as the law requires |
Your rights
You have the right to:
- access Your data and receive a copy: Personal data in Your settings gives an export of all Your data, files included;
- rectify it: most of it in Your profile and Your sessions;
- erase it: delete a session at any time, or Your account and all its data in Personal data;
- restrict its processing, or receive it in a portable format (portability: the export above);
- object to the processing based on Our legitimate interest, for instance the use of Your GPS data for the circuit database or the e-mails about Your activity;
- withdraw Your consent at any time: the AI coach, the newsletters, the marketing cookies ("Cookie settings").
For anything You cannot do in Your settings, write to support@lapviz.com from the address of Your account. We answer within one month, and may ask You to prove Your identity. You can also lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be) or with the authority of Your country.
Children
The Service is not meant for children under 13. From 13 to 18, use it with the agreement of a parent; the profile of a driver under 18 whose birth date is known is never shown to the other visitors. A parent who finds an account of a child under 13 can write to Us to have it deleted.
Automated decisions
LapViz takes no decision with legal or similarly significant effects on You by automated means. The lap detection, the circuit detection and the AI coach produce information only.
Security of Your data
The Service uses encrypted connections (HTTPS), stores passwords hashed, offers two-factor authentication, locks an account after repeated failed sign-ins, limits the requests of each client, and limits the access to the data to the administrators of LapViz. No system is perfectly secure: We will tell You, and the authority, of a breach that puts Your data at risk, as the GDPR requires.
Detailed information on the processing of Your data
Analytics
We measure the audience of the Website with Umami, a cookie-free web analytics service.
-
Umami
LapViz uses "Umami Cloud", provided by Umami Software, Inc. (United States), to count the visits of the Website and understand how it is used. Umami sets no cookie, stores nothing on Your Device and does not follow You across other websites. It needs no consent.
The following data is collected and processed:
- Pages visited and the referrer URL (including the campaign parameters of a shared link)
- Browser, operating system, device type, screen size and language
- Country and region, derived from the IP address; the IP address itself is not stored
- Date and time of the visit
- Some actions on the Website: sharing a session, clicking a sign-up button, creating an account
Visits are grouped with an anonymous identifier computed from technical data and renewed regularly: it does not identify You, is never linked to Your account and is not used for advertising. Only aggregated statistics are shown to LapViz.
For more information on the privacy practices of Umami, please visit: https://umami.is/privacy
Advertising measurement (Meta)
LapViz advertises on Facebook and Instagram. To know which ads bring new users, LapViz may use the Meta pixel and the Conversions API of Meta Platforms Ireland Limited, only if You accept the marketing cookies in the cookie banner. Without this consent, nothing is loaded from Meta and nothing is sent to Meta. The legal basis is Your consent (Article 6(1)(a) GDPR).
- Meta pixel (in Your browser, after Your consent): it records the pages You visit on the Website and sets the _fbp and _fbc cookies. Meta receives Your IP address, the browser and the page.
- Conversions API (from the server of LapViz, only if You accepted the marketing cookies at that time): when You create an account (CompleteRegistration), submit a coach profile for review (Lead) or subscribe to LapViz Pro (Subscribe), LapViz sends to Meta the name of the event, its date, the page, Your IP address, the user agent of Your browser, the _fbp and _fbc cookies and Your e-mail address hashed with SHA-256 (Meta compares this hash with its own users; the address itself is never sent). For a subscription, its price and currency are added. The same event sent by the pixel carries the same identifier, so that Meta counts it once.
LapViz sees only aggregated results in Meta Events Manager (how many sign-ups came from an ad), never who You are on Facebook or Instagram. The events are sent right away and not stored by LapViz. Meta acts as joint controller for the collection by the pixel; its processing is described at https://www.facebook.com/privacy/policy/. Meta may transfer the data to the United States under the EU-U.S. Data Privacy Framework.
You can withdraw Your consent at any time with "Cookie settings" at the bottom of the pages or in the Cookies section above: the pixel is no longer loaded, its cookies are deleted and no event is sent anymore. Your choice is asked again after 6 months.
AI coach
The AI coach is optional: it is only used after your consent, given in the coach itself. It answers with Claude, an artificial intelligence model provided by Anthropic PBC (United States).
Data sent: your questions, the context of the page (the session on screen) and the data the coach reads to answer, with your access rights (lap and sector times, telemetry summaries such as corner speeds, setups, weather, public leaderboards, notes you asked it to remember). The raw telemetry files are not sent.
Use by Anthropic: only to produce the answer; under its commercial terms, this data is not used to train its models and is deleted after a short retention period. Transfers outside the European Union rely on the standard contractual clauses.
Retention at LapViz: your conversations, the debriefs of your sessions and the notes kept by the coach are stored with your account. You can delete a conversation, erase what the coach remembers about you, and everything is deleted with your account.
AI answers may contain mistakes: check the important information.
Sharing of Your sessions
You choose who sees each of Your sessions (lap times, telemetry, GPS trace). The site asks You for this choice when You create Your account, or before You first send files, and records its date; it applies to Your new sessions and can be changed at any time in Your profile, for all Your sessions or for each of them. Until You have chosen, the sessions sent by e-mail, by an application or by a coach get the Lap times sharing, and the site asks You to choose.
Public: everyone sees the session, its lap times and its telemetry, GPS trace included. It counts in the rankings and the records of the circuits, may serve as a ghost to the other drivers and can appear in search engines.
Lap times: everyone sees the lap times, which count in the rankings and the records and can appear in search engines. The telemetry stays for You and Your coaches.
Restricted: only You, Your coaches and the people You choose see the session.
Private: only You and Your coaches see the session.
Coaching requests: when You send sessions to a coach (Coaching), that coach sees them (lap times, telemetry, GPS trace, coaching notes) for two weeks, or a week after the next session You gave when later, or until You cancel the request. The request, the answer and the voice memo the coach may record are kept with Your account and deleted with Your account or with the coach's.
Coach profile: if You coach, You may write a coach profile (disciplines, categories, circuits, languages, bio, experience, website, price, payment link); Your name and the picture of Your profile go with it. It is reviewed by the administrators of LapViz, who may add a note to You. Once approved, drivers looking for a coach can find You by Your name and ask You (unless You turn off new drivers); the details of the profile are meant to be shown to them. You can edit it or stop coaching at any time; it is part of the export of Your data and is deleted with Your account.
Open coaching request: if You ask "any coach", a summary of Your request (circuit, discipline, category, date, best lap, number of sessions, question, goal, deadline, languages and maximum price, without Your name, telemetry or notes) is shown to the coaches approved by LapViz who match it; only the coach who takes it, or whose proposal You accept, then sees its sessions. The price You agree is paid by You directly to the coach: LapViz does not handle the payment.
Your coaches are the coaches of Your teams, only if You share Your sessions with them on the page of the team (see Teams). A session You import for a driver You coach gets the sharing chosen by that driver. The administrators of LapViz can access every session for the support and the security of the Service.
When You join a competition, Your best lap time on its circuit during its period appears in its standings, whatever the sharing of the session; the session itself stays visible according to its sharing. Your public profile only counts Your sessions whose lap times are public.
LapViz counts how many times the other drivers race against a lap of Your sessions (3D replay) or compare it, and shows You this number on the session and in Your feed, as well as the total of the community. These counters do not keep who used Your sessions.
The files You replay in 3D without adding them to Your sessions are not stored, except a file recorded on a circuit LapViz does not know yet: it is kept, with where it was recorded, so that LapViz can find and add this circuit from its GPS trace. A file that cannot be read (by the 3D replay, the studio or the import) is kept so that LapViz can support it.
Circuit database
LapViz uses the GPS data of the sessions and files it receives (positions, speeds and trajectories) to create and improve its circuit database: to place and correct the timing lines, the sectors and the outline of the circuits, and to find the circuits it does not know yet. This use rests on the legitimate interest of LapViz and of its users in a circuit database that times every session correctly (as allowed by the Terms and Conditions).
What is published: only the circuits (their name, place, timing lines, sectors and outline), under an open-source license (MIT) in LapViz.Telemetry, and possibly in other open circuit databases. Never Your name, Your lap times, Your sessions nor the files You sent.
Files without laps: a file recorded where LapViz does not know the circuit is kept with its position. LapViz finds the circuit in its GPS trace and adds it, marked provisional until an administrator of LapViz checks it (the administrators see the trace to check or draw the circuit). Once the circuit is added, the file is imported again into Your account and You are told by e-mail. These files are deleted with Your account.
You can object to this use by writing to support@lapviz.com: Your sessions and files will then no longer be used for the circuit database.
Teams
A team gathers drivers and their staff (coaches, mechanics, parents...). What the other members and the public see:
Members: the members of a team see the name, the picture and the role of the other members, and their public sessions. The coaches of the team also see the sessions a member chooses to share with them; this choice can be changed at any time on the page of the team.
Public page: when the administrators of a team make its page public, anyone can see the team (name, description, logo, country, categories, links), its roster (name, picture, role and dates of the members), the best lap times of the members taken from their public sessions, and their recent public sessions. Members under 18, members with a private profile and members who chose to hide themselves do not appear. Each member can hide himself from the public page at any time.
History: when a member leaves a team, his dates of membership stay in the history of the team, shown on its public page under the same conditions.
Requests and invitations: a request to join, with its optional message, is seen by the administrators of the team; an invitation is seen by the account invited and by the administrators.
Your teams, requests and invitations are part of the export of your data. When your account is deleted, you are removed from the teams and from their history, and the teams you own are given to another member (or deleted when nobody is left).
E-mails
Besides the messages needed for Your account (confirmation of Your address, password and security, Your imports and the session reports You asked for), LapViz sends a few e-mails about Your activity on the Service:
Getting started: two and seven days after You sign up, only while Your account has no session, how to import Your first session; a few days after Your first session, what You can do with it.
Monthly recap: early each month, only if You drove the month before: Your sessions, personal bests and ranks, and the public sessions of the drivers You follow.
Season recap: once a year, in December, Your season in numbers, with a link to a season page You may share. That page only counts the sessions whose lap times are public, and is not shown to the other visitors when Your profile is private.
Comeback reminder: at most once a year, when You have not driven for a few months: what is new on LapViz and Your personal bests.
These e-mails are built from the data of Your account (sessions, lap times, ranks, the drivers You follow), on the basis of our legitimate interest in helping You use the Service. They are only sent to a confirmed address, in the language You choose, and never more than one every two days. You can turn each of them off at any time in Your account (Notifications and newsletters), or with the link at the bottom of each e-mail, which works in one click without signing in. We keep a record of the e-mails sent (kind, date, address, language) so that the same e-mail is never sent twice; it is part of the export of Your data and is deleted with Your account. Their links carry the name of the e-mail (utm parameters) so that we can count the visits they bring; they do not identify You.
The newsletters (offers, product news, tips) are only sent if You opted in, on the same page.
-
Resend
The e-mails of LapViz are sent through Resend (Resend, Inc., United States), which processes Your e-mail address and the content of the messages on our behalf.
Resend’s Privacy Policy can be viewed at https://resend.com/legal/privacy-policy
Payments
LapViz Pro is sold through Stripe, Our reseller, which processes the payment, issues the invoices and collects the taxes as independent controller; its privacy policy is at stripe.com/privacy. LapViz never receives Your card details: We only keep the identifiers of Your Stripe customer and subscription, the plan, its status and its dates, to give You the benefits of Pro.
"Do Not Track"
The Website does not change its behaviour on a "Do Not Track" signal; it sets no advertising cookie without Your consent anyway.
Links to other websites
The Service links to websites that LapViz does not operate. Their own privacy policies apply.
Changes to this policy
We may update this policy. We tell You of an important change by e-mail or by a notice on the Service before it applies, and update the date at the top of this page.
Contact
Mengal SRL, Rue de la Haie Monseu 3, 4550 Nandrin, Belgium. E-mail: support@lapviz.com. See also the support page.