Privacy
Policy.

Last updated: 27 September 2026

Who we are

Hotlap ("Hotlap", "we", "us") runs the Hotlap website (hotlap.racing) and the Hotlap mobile app (together, the "Services"). Hotlap's company registration is in progress; we will update this section with our licensing details once it is complete. For privacy questions, contact us at privacy@hotlap.racing.

This policy explains what personal data we collect, why, and the choices you have. We process personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and other applicable laws.

What we collect

• Account information: name, email address, and (if you choose) phone number. If you sign in with Google, we receive your name, email and profile picture from Google.
• Racer interest information: if you fill in the racer form, your name, email, phone number, motorsport discipline, and experience level.
• Verification documents (when this feature launches): racing licence or ID uploads that racers submit for verification. These are stored securely, accessed only by authorised staff for verification, and never shown publicly.
• Usage information: pages and screens viewed, activities you open, and "Book" links you tap, along with device type, operating system, app version, approximate location derived from IP address, and crash reports.
• Communications: messages you send us and your marketing preferences.

We do not knowingly collect data from anyone under 18.

Why we use it

• To create and manage your account and provide the Services (performance of our agreement with you).
• To show you activities, events and venues, and to measure which booking links are used so we can operate partnerships with venues (our legitimate interest in running and improving Hotlap).
• To contact you about racer features, events and offers — only where you have opted in (your consent, which you can withdraw at any time).
• To verify racer credentials, when that feature launches (your consent and our legitimate interest in keeping rankings genuine).
• To keep the Services secure, prevent fraud, and meet legal obligations.

Who we share it with

We do not sell your personal data. We share it only with:

• Service providers who process it for us under contract: Supabase (database, authentication and storage), Vercel (website hosting), Expo (app delivery and notifications), Resend (delivering sign-in codes and other account emails, processed in Ireland), and Google (if you use Google sign-in).
• Venues and event partners: we may tell a venue that a booking came through Hotlap (e.g. a referral code). We do not share your contact details with a venue unless you ask us to or explicitly agree.
• Authorities: where required by law.

Where your data is stored

Our main database is hosted in India (Mumbai region). Some service providers may process data in other countries — for example, Resend processes account emails in Ireland. When we transfer data outside the UAE, we rely on the safeguards permitted under the PDPL, such as contractual protections with our providers.

How long we keep it

• Account data: while your account is active, and deleted within 30 days after you delete your account (except where the law requires us to keep it longer).
• Racer interest data: until you ask us to remove it, or 24 months after our last contact with you.
• Verification documents: only as long as needed to complete verification, then deleted or kept in restricted storage for no more than 90 days.
• Usage and click data: up to 24 months, then deleted or anonymised.

Your rights

Subject to the PDPL, you can ask to: access your data; correct it; delete it; restrict or object to certain processing; receive a copy in a portable format; and withdraw consent at any time (for example, unsubscribing from marketing). You can delete your account in the app under Settings → Delete account or by emailing privacy@hotlap.racing. We will reply within 30 days. If you are unhappy with how we handle your data, you can also contact the UAE Data Office.

Security

We use encryption in transit, access controls and database security rules to protect your data. No system is completely secure, so please use a strong password and let us know about any suspicious activity.

Changes

We will post updates here and change the "Last updated" date. For significant changes, we will notify you in the app or by email.