Privacy policy

Who we are

• Race Bureau is run by The A-Team trading as Race Bureau, based in New Zealand.
• We follow the Privacy Act 2020 and its Information Privacy Principles (IPPs).
• Our privacy officer is Arno, the founder.
• For anything about your information, email hello@racebureau.com.

What this policy covers

• This website, racebureau.com.
• The Race Bureau platform (app.racebureau.com and club sub-domains), where Race Bureau decides how information is used: club account holders, billing and support.
• Information a club keeps about its members and athletes is the club’s. See “Club and athlete data” below.

What we collect on this website

• Contact form: your name, email, club (optional) and message. It is emailed to us and not stored on the website.
• Demo booking: your name, email, club, country, what you need, your message, your time zone and the time you pick. It is saved as an event in our Google Calendar with a video link, and you are added as a guest. We email you a confirmation, a reminder and any changes.
• Launch list (“Tell me when it opens”): your email and when you signed up. It is kept in a private file in Vercel Blob storage. We email you once, when sign-ups open.
• To stop spam, our forms have a hidden trap field and a timing check, and the launch list limits sign-ups per IP address for 10 minutes. The limit is held in memory only.
• Like any website, our host (Vercel) handles your IP address and browser details to deliver pages and keep the site secure.
• Analytics and marketing data, only if you agree. See “Cookies” below.
• We do not take card payments on this website.

Cookies

Optional cookies stay off until you say yes in the cookie banner. You choose Analytics and Marketing separately.

• Necessary, always on: rb_consent remembers your choice for 6 months. It is set on .racebureau.com, so the Race Bureau platform respects the same choice.
• Analytics, only after you accept Analytics: PostHog records which pages you view, the buttons you click, where you came from (referrer, campaign tags, landing page) and your device and browser type. It sets ph_… cookies and browser storage.
• Session replay, part of Analytics: a recording of clicks, scrolling and page changes, so we can fix what is confusing. Everything you type and all text inside forms is hidden in your browser before anything is sent. We never put your name, email or message into analytics.
• PostHog never loads if your browser sends Do Not Track or Global Privacy Control.
• Marketing, only after you accept Marketing: the Meta pixel tells Meta which pages you visit and when you click Start free or Book a demo. It sets _fbp and _fbc cookies. Meta can use it to show you our ads on Facebook and Instagram, under Meta’s own privacy policy.
• Website to platform: with Analytics on, links into app.racebureau.com carry two random identifiers (rb_did and rb_sid), so the platform’s analytics continue the same visit. If you then create an account, your earlier website visits are linked to it.

Change your mind any time: choose Cookie settings at the foot of any page. Switch a category off and it stops, its cookies are removed and the page reloads. Data already sent stays with PostHog or Meta until it expires or you ask us to delete it.

Why we use it

• To answer your messages and run your demo.
• To tell you when sign-ups open.
• To see how the site is used and make it better.
• To measure our advertising and show our ads to people who have visited.
• To keep the site and platform secure.
• We do not sell personal information.

Where it is stored

We use these providers. Most are based overseas, so your information is sent outside New Zealand (IPP 12).

• Vercel: website hosting and the launch list (Vercel Blob). United States.
• Resend: sends our emails. United States.
• Google: calendar, video meetings and our email inbox (Google Workspace). United States and worldwide.
• PostHog: analytics and session replay, PostHog US cloud. United States.
• Meta Platforms: the Meta pixel. United States and Ireland.

We only use providers that protect information in ways comparable to the Privacy Act, and we rely on their published data-protection terms.

How long we keep it

• Contact messages and demo bookings: as long as we need to deal with you, then up to 2 years.
• Launch list: until we have sent the sign-ups-open email, then deleted within 30 days.
• Analytics events: up to 12 months. Session replays: up to 30 days.
• rb_consent cookie: 6 months, then the banner asks again.
• Meta pixel data: under Meta’s own retention rules.
• Platform account and billing records: while the account is open, then as set out in our Terms. Invoices are kept 7 years for tax.

Club and athlete data

• Clubs use the platform for members, entries, start lists, timing, results, volunteers and memberships.
• For that information the club decides what is collected and why, and the club is responsible for it. Race Bureau stores and processes it on the club’s behalf, only to run the service.
• Each club’s data is kept separate from every other club’s.
• Members and athletes: to see or correct your information, contact your club first. We help the club respond.
• Race results a club publishes (names, clubs, times) are public.
• Clubs connect their own payment provider (Stripe Connect). Payments go straight to the club’s own account. Race Bureau never holds club money and never stores card numbers.
• When a club leaves, it can export its data. We delete it 90 days after the account closes.
• Platform providers: Vercel (hosting, United States), Neon (database, Sydney), Fly.io (live timing, Sydney), Resend (email, Tokyo) and Stripe (payments, through each club’s own account).

Your rights

• Ask for a copy of the personal information we hold about you (IPP 6).
• Ask us to correct it (IPP 7).
• Ask us to delete it, or to stop emailing you.
• Email hello@racebureau.com. It is free. We reply within 20 working days and may need to check who you are first.
• Not happy with our answer? You can complain to the Office of the Privacy Commissioner at privacy.org.nz.
• Visitors in the EU or UK also have rights under the GDPR, including objecting to processing and data portability.

Security

• Everything is sent over an encrypted connection.
• Only the people who need it can see personal information.
• If a privacy breach is likely to cause serious harm, we tell the people affected and the Privacy Commissioner, as the Privacy Act requires.

Young athletes

• This website is not aimed at children.
• Many athletes on the platform are under 16. Their clubs enter and manage that information, and are responsible for any parent or guardian consent.

Changes to this policy

• We will post any change here with a new date. If a change is significant, we tell account holders by email first.