Privacy Policy

Who we are and how to contact us

The Service is operated by kartclass.ai Pty Ltd ( “kartclass.ai Pty Ltd”, “we”, “us” or “our”). We are the entity responsible for your personal information — the data controller, in the language of European law.

• Email: info@kartclass.ai
• ABN: 72 703 277 356
• Postal address: 5A Hartnett Close, Mulgrave VIC 3170, Australia

We are based in Victoria, Australia. This policy is framed around the Privacy Act 1988 (Cth) and the Australian Privacy Principles (the “APPs”), with the additional rights described below for people outside Australia.

What this policy covers

This policy covers the Apex AI web application, the trackside interface, our public pages and the systems behind them. It does not cover the separate services you may reach from the Service — for example a data-logger manufacturer’s own software, or a circuit’s timing system. Those are governed by their own policies.

Where this policy says something is not collected, sold or shared, that statement is about the Service as it works today. If that changes, this policy changes with it — see Changes to this policy.

Information we collect

We collect the following categories of personal information.

• Account information — managed through our authentication provider, Clerk. This includes your name, email address and, depending on how you sign in, a profile photo and the identifiers issued by your chosen sign-in method.
• Driver profile — the details you choose to add: display name, racing number, date of birth, racing class, club membership, home track, a short biography, profile and banner images, a helmet design, favourite team and driver, and links to your social media. Only your display name is required; the rest is optional and you can remove any of it at any time.
• Google account information — if you choose “Sign in with Google”, we receive your name, email address, profile picture and Google account identifier from Google so we can create and secure your account. We request only the basic, non-sensitive scopes (openid, email and profile).
• Telemetry and performance data — the data files you upload from your data logger (for example XRK or CSV files) and everything derived from them: sessions, laps, sectors and segments, GPS traces, speed, engine and temperature channels, and the summaries and analyses built on top of them.
• Session video — the video files you choose to upload so they can be played in sync with your telemetry, together with their file names, sizes and synchronisation offsets. See Session video and other people.
• Kart, setup and event data — kart configurations, setup profiles, tracks, events, tyre records and tyre-pressure calculations you create.
• AI coaching content — the questions you ask, the driver and session context assembled to answer them, and the responses generated for you. Conversations are saved to your account so you can return to them.
• Subscription and usage information — your plan, billing status, credit balance and a record of the AI requests you make and what they cost. Card and payment details are handled by our payment processor, Stripe, and are never stored on our servers.
• Feedback and support correspondence — what you write when you send feedback or contact us, together with the technical context captured alongside it: the page you were on, your browser and its version, your window size, your selected theme and the application version.
• Technical and diagnostic data — server and request logs, IP address, device and browser information, and error and performance diagnostics used to keep the Service reliable and secure.

Sensitive information. We do not ask for, and the Service has no field for, health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record or biometric identifiers. Please do not put information of that kind into a free-text field such as a biography, a feedback message or a question to the AI coach.

How we collect it

• Directly from you — when you create an account, complete your profile, upload a file, build a setup, ask the AI coach a question, subscribe or contact us.
• From your sign-in provider — the account details described above, when you sign in with Google or Apple.
• Automatically as you use the Service — log, device and diagnostic data, and the browser storage described under Cookies, local storage and similar technologies.
• Derived from what you upload — lap times, sector splits, best-lap selection, consistency, cornering and braking analysis, and the other measures the platform computes from your telemetry.

We do not buy personal information, and we do not build profiles from data brokers or from your activity on other websites.

Why we use it, and our legal bases

Under the Australian Privacy Principles we may use your information for the purpose we collected it for and for directly related purposes you would reasonably expect. If the General Data Protection Regulation applies to you, we also need a legal basis under Article 6; the table below states which one we rely on for each purpose.

Where we rely on a legitimate interest, we have considered whether it is outweighed by your interests and rights, and you may object — see Your rights and choices.

AI features and what is sent to the model

The AI coach, the session and event analyses, and the in-app support assistant are produced by a large language model — the Claude family of models, operated by Anthropic. To answer a question we assemble a context and send it to Anthropic. It is worth being specific about what that context contains, because it is more than the question you typed.

Depending on the feature, the context may include:

• your question and the earlier messages in the same conversation;
• your driver profile — your name, your age (calculated from your date of birth if you have provided one), your racing number, your home track, your favourite team and driver, and your primary kart;
• session details: the track, the date, the conditions, your lap and sector times, your best and average laps, consistency measures, and the derived analysis for the session;
• your kart setup for the session, and the weather recorded against it;
• for the support assistant, the relevant parts of our own help documentation — and none of your telemetry.

Your data is not used to train AI models. Anthropic processes what we send under a commercial agreement that prohibits training on our inputs and outputs, and we do not train models on your information ourselves.

Your telemetry is not put into a shared search index. The AI coach draws on a library of general karting reference material. Your sessions, laps, setups and conversations are not added to it, and nothing you upload becomes available to another driver’s coaching.

AI output can be wrong. It is generated from patterns in text and data, not from an engineer inspecting your kart, and the Terms of Service explain the limits on relying on it.

Automated processing and decisions

Much of the Service is automatic: telemetry is parsed and classified without a person looking at it, laps are graded and best laps chosen, tyre pressures are calculated from your inputs, coaching text is generated by a model, and your session is placed against a distribution of other sessions.

None of this makes a decision that produces a legal effect for you, or that similarly significantly affects you. Automated processing here produces advice, measurements and comparisons. It does not decide whether you may hold an account, what you pay, whether you receive a refund, or anything about your rights. Decisions of that kind are made by a person.

If an automated result looks wrong to you, tell us and a person will look at it. You can also ask us to explain, in general terms, how a particular figure was produced.

Benchmarking and de-identified information

Some features tell you how a session compares with others — for example, where your performance on a given measure sits within the range of sessions recorded on the platform. To produce that we compute a statistical distribution across many drivers’ sessions and place yours within it.

What you see is your own position. You are never shown another driver’s name, session, lap times or telemetry through this feature, and no other driver is shown yours. A comparison is only produced where the group is large enough that an individual cannot be picked out of it.

We also use aggregated and de-identified information — figures that no longer identify anyone and that we do not attempt to re-identify — to understand how the Service is used, to size our infrastructure and to decide what to build. Information handled that way is no longer personal information, and this policy does not restrict what we do with it.

Session video and other people

If you upload session video, it is stored with a third-party object storage provider and played back through short-lived links generated for you. The storage location is never exposed publicly, and video is not indexed by search engines or listed anywhere another user can browse.

Video is different from the rest of the Service in one important way: it routinely records people other than you — other drivers, marshals, mechanics, family members in the paddock — and it may capture their faces, their voices and their kart numbers.

Before uploading, please make sure you are entitled to do so: that you recorded the footage, that recording was permitted at that circuit and event, and that anyone clearly identifiable in it would not object. If someone appears in video you have uploaded and asks for it to be removed, contact us at info@kartclass.ai and we will act on the request.

Access to your device

Two features work on your own device rather than on our servers, and both are optional.

• Automatic telemetry upload. If you turn it on and choose a folder, your browser gives the Service permission to read that folder so new logger files can be uploaded without you selecting them each time. We see only the telemetry files that are actually uploaded. Your browser records which folder you chose and which files have already been sent; we do not receive a listing of the rest of your device, and you can withdraw the permission at any time in your browser or by disconnecting the folder in the app.
• In-browser video processing. When you add a SmartyCam video, the telemetry embedded in the file is extracted in your browser before anything is sent. The processing happens locally; only the result and the video you chose to upload leave your device.

Cookies, local storage and similar technologies

We use a small number of cookies and browser-storage items. They are there to sign you in and to remember your preferences. We set no advertising cookies, no cross-site tracking cookies and no third-party analytics cookies, and we do not participate in any advertising network.

Blocking the essential items will stop you signing in. Blocking or clearing the preference items is harmless — the Service falls back to its defaults. Our payment and anti-abuse providers may also set their own cookies when you reach a checkout or a sign-in challenge; those are described in their own policies.

Who we share information with

We do not sell your personal information, and we do not disclose it for anyone else’s marketing. We share it with the service providers that help us run the Service, only to the extent each of them needs, and only under terms that require them to protect it and to use it for no other purpose.

The table below describes those providers by the function they perform. We publish it this way rather than as a list of company names so that it stays accurate: a named list goes out of date silently, and the function a provider performs is what actually tells you what happens to your information. The AI model provider is named, because that is the one where withholding the name would tell you less — your question, your session data and your name and age are sent to it, and you should be able to go and read that company’s own commitments. If you would like the current list of the individual providers we use, ask us at info@kartclass.ai and we will send it to you.

Three further providers are named elsewhere in this policy, for the same reason in a different form: Clerk, whose interface you sign in through; Stripe, which appears on your card statement; and Google, where you sign in with a Google account — see Google user data.

We may also disclose personal information:

• where we are required or authorised to by law, or in response to a valid request from a court, regulator or law-enforcement agency;
• where it is necessary to protect our rights, our property, or the safety of any person;
• to our professional advisers, under obligations of confidentiality;
• in connection with a sale, merger or reorganisation of our business — in which case the recipient will be bound to handle it consistently with this policy, and we will tell you before it becomes subject to a different one.

Google user data

Apex AI’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google account data only to provide and improve the sign-in and account features described in this policy.
• We do not sell Google user data, and we do not use it for advertising.
• We do not transfer Google user data to third parties except as necessary to provide or improve the Service, to comply with applicable law, or as part of a merger or acquisition.
• We do not allow humans to read your Google user data unless we have your consent, it is necessary for security or to comply with the law, or the data has been aggregated and anonymised.

Overseas disclosure

We are based in Australia, and several of the providers described above process information outside it — principally in the United States, Singapore and the European Union, as set out in the table.

Before disclosing personal information overseas we take reasonable steps, as APP 8 requires, to ensure the recipient handles it consistently with the Australian Privacy Principles. In practice that means contractual commitments limiting each provider to the purpose we engaged it for, requiring appropriate security, and requiring it to notify us of any breach. Where information is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses, or the UK International Data Transfer Addendum, together with any additional measures the transfer needs.

How long we keep information

We keep personal information for as long as we need it for the purpose we collected it, and for as long as the law requires. When it is no longer needed we delete it or de-identify it.

A note on the telemetry rule. Detailed channel data — the high-frequency samples behind the charts — is by far the largest thing we store, and keeping every sample of every session for ever is not sustainable. So for older sessions we keep the full detail of your fastest valid laps and remove the rest. Your sessions, lap times, sector times and records are not affected — what changes is how much sample-by-sample detail you can chart on an old session. Sessions with a video attached are never reduced.

Backups are kept on a rolling basis for disaster recovery. Information you delete disappears from the Service immediately and works its way out of backups as they age out.

Security and data breaches

We take reasonable technical and organisational measures to protect your personal information from loss, misuse and unauthorised access. These include:

• encrypted transport for all traffic to and from the Service;
• credentials handled entirely by our authentication provider — we never see or store your password;
• every request for your data checked against your identity, so one account cannot read another’s sessions, setups or video;
• payment card details handled by our payment processor and never stored on our servers;
• administrative access limited to the small number of people who need it, and separately authenticated;
• video served only through short-lived links rather than public addresses.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If something goes wrong. If we suspect a data breach we will investigate promptly. Where a breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and the individuals at risk, as the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) requires. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of a notifiable breach, and affected individuals where the risk to them is high.

Your rights and choices

Under the Australian Privacy Principles you may ask us for access to the personal information we hold about you, and ask us to correct it if it is wrong. You may also ask us to delete your account and the information associated with it.

If you are in the European Economic Area, the United Kingdom, California or another region with specific data-protection laws, you may also have the right to erasure, to restrict or object to processing, to receive your information in a portable form, and to withdraw a consent you have given. We honour those rights where they apply to you.

Much of this you can do yourself, immediately:

• edit or clear any field on your driver profile;
• delete a session, an event, a setup or a saved conversation;
• remove a video you have uploaded;
• permanently purge everything you have archived, from the archive screen;
• cancel your subscription.

For anything else — a copy of your information, a correction we cannot make for you, or deletion of your whole account — email info@kartclass.ai. We will respond within 30 days. We may need to confirm your identity first, so that we are not handing your information to someone else. There is no charge; if a request is genuinely repetitive or excessive we will tell you before doing anything about it.

If we cannot give you access or make a correction, we will explain why in writing and tell you how to complain.

Junior drivers and guardian accounts

Karting starts young — cadet classes begin at around six years old — so junior drivers are a real part of who this Service is for. We handle that by making the adult the account holder.

• An account holder must be 18 or over (or the age of majority where they live). Only an adult can create an account, agree to the Terms and hold a subscription.
• A junior driver takes part through an account held by their parent or guardian. The guardian enters and controls the junior driver’s information, supervises their use of the Service, and can see and delete everything on the account.
• We do not knowingly allow anyone under 18 to create an account in their own name, and we do not knowingly collect personal information directly from a child.

A guardian may exercise every right in Your rights and choices on the junior driver’s behalf. If you believe a child has created an account without a guardian, or that we hold a child’s information without a guardian’s involvement, contact us at info@kartclass.ai and we will remove it.

Anonymity, pseudonymity and marketing

Using a name that is not your legal name. APP 2 gives you the option of dealing with us anonymously or under a pseudonym where that is lawful and practicable. Your driver profile is a display name, and you are welcome to use a racing name, a nickname or just a racing number. We do need a working email address to secure the account and contact you about it, and our payment processor needs real billing details to take a payment — but the name other parts of the Service show is yours to choose.

Email we send you. We send messages about your account: sign-in and security notices, receipts, changes to your plan and important service notices. You cannot opt out of those while you hold an account, because they are how we tell you things you need to know.

We may also send occasional messages about new features or karting content. Those are optional, every one carries an unsubscribe link, and opting out never affects your access to the Service. We do not give or sell your details to anyone else for marketing.

Changes to this policy

We may update this policy as the Service changes. When we do we will revise the version and effective date at the top and record what changed in Version history.

If a change materially affects how we handle your personal information — for example a new purpose, a new category of recipient, or a materially different retention period — we will tell you before it takes effect, by email or by a notice in the Service, and give you at least 30 days’ notice. Where the change requires your consent, we will ask for it rather than assume it.

Complaints

If you have a question, a concern or a complaint about this policy or about how we have handled your personal information, please contact us first at info@kartclass.ai. We will acknowledge your complaint promptly and respond within 30 days. We would much rather put something right than have you escalate it.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• Online: oaic.gov.au/privacy/privacy-complaints
• Telephone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001, Australia

If you are in the European Economic Area or the United Kingdom, you may instead complain to the supervisory authority for your country — in the United Kingdom, the Information Commissioner’s Office at ico.org.uk.

Version history