Data controller
The controller is the owner of PitStop (XMAS Software, Spain), with the identification details in the legal notice. Contact for any privacy matter: info@xmassoftware.com.
We process your data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). No data protection officer is appointed.
Data we process
- Account: nickname, email address, language, sign-up date, version and date of the terms and policy you accepted, confirmation that you are at least 14, role, verification and sanction status, and failed sign-in attempts. For your password we only store an irreversible hash, never the password.
- Game: your teams (name, short name and colours), their solo careers and leagues, the management state (in-game money, ledger, car, drivers, sponsors, market offers), the setup and strategy you prepare, the orders you give on the pit wall, results, standings, honours and achievements.
- Replays: every grand prix is stored compressed (car positions and race events) so it can be watched again.
- Social: friendships, requests, blocks, league invitations, text messages between friends, predefined quick messages on the pit wall, your status (in the office or on the pit wall) shown to your friends, reports with their outcome and appeals against a sanction.
- Notifications and preferences: the bell notifications, which notification types you have on and whether you hide yourself from the public ranking.
- Market anti-cheat: in leagues, when you join and when you make market operations we store an irreversible tag of your (grouped) IP address and of your browser, never the IP or fingerprint in clear, to detect several accounts of the same person in the same league and rigged transfers. We also store automatic moderation flags (for example, too many orders in a race or an IP shared in the same league).
- Security: sessions (we store fingerprints of the tokens and their expiry, not the tokens), the one-time passes the game uses to open your session and join a race, and the administration log.
- IP address: used on each request to limit abuse, sent to Cloudflare Turnstile when validating forms, and present in the technical logs of the API and the race server, which are deleted after 48 hours.
We ask for no sensitive or payment data. Email addresses and messages between friends are stored encrypted in the database.
What others see: anyone, even without an account, can see your nickname and score on the ranking, unless you hide yourself from My account. Members of your leagues see your nickname, team, results and market operations in that league, and anyone watching a race as a spectator or replay sees your team on track. Any player with an account can open your profile and see your nickname and public division; the full profile (statistics, teams, honours and achievements) is only visible to your friends.
In your browser, the website stores your chosen theme, the active world of the office and a flag saying you signed in, with no account data; the pit wall game stores its settings in its own site’s storage (see the cookie policy).
Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account, verify your email and recover your password | Performance of the terms of use, art. 6(1)(b) |
| Provide the game: teams, leagues, live races, replays, ranking, achievements, friends, messages and notifications | Performance of the terms of use, art. 6(1)(b) |
| Security, abuse prevention (Turnstile, per-IP and per-account limits), market anti-cheat and moderation | Legitimate interest, art. 6(1)(f) (protecting fair play and the service) |
| Aggregated, cookieless visit analytics | Legitimate interest, art. 6(1)(f) |
| Complying with legal requests | Legal obligation, art. 6(1)(c), where applicable |
Email is only used to verify your account and recover your password: we send no newsletters, advertising or game notifications by email. There is no commercial profiling and no automated decision-making with legal effects: a person reviews anti-cheat flags before any sanction. We do not sell data.
Minimum age
You must be at least 14 to register, the age from which you can consent to the processing of your data under article 7 of the LOPDGDD. Registration asks you to tick a box confirming it; it is your own declaration and we do not verify age with documents. If we learn that an account belongs to someone under 14, we will delete it.
Retention
| Data | Period |
|---|---|
| Account, teams, game data, friendships, blocks, achievements and preferences | While the account exists |
| Unverified accounts | 7 days from registration |
| Grand prix replays | 7 days from the race |
| Messages between friends | 12 months from each message, or until either account is deleted |
| Bell notifications | 30 days after you read them and 90 days at most |
| Anti-cheat IP and browser tags | 180 days since they were last recorded |
| Moderation flags | 180 days |
| Resolved reports and appeals | 180 days after resolution |
| Per-race results for the weekly ranking | 30 days |
| Sessions | Up to 1 day after they expire |
| One-time passes for the game and races | Expire in 60 seconds |
| Administration log | 1 year |
| Technical logs of the API and the race server (including the IP) | 48 hours |
| Database backups | Expire after 8 days at most |
| Rights requests and messages to info@ | Up to 3 months after they are resolved; a record without personal data (date, right and outcome), 3 years |
When you close your account, deletion is immediate: your account and all your personal data are erased. Your solo careers are deleted entirely. Your league teams pass to the AI so leagues can go on (with the name you gave them and their points) and your nickname is removed from the grands prix already played and their replays; reports made against you are kept without your account. If a backup had to be restored, accounts deleted after it was made are deleted again.
Data processors
We do not share your data with third parties unless legally required. These providers process it on our behalf:
| Provider | Service | Location |
|---|---|---|
| Contabo GmbH | Server hosting (managed with Coolify) for the API, the race server, the database and local backups | European Union |
| Cloudflare, Inc. | Hosting and network for the website, the API and the race server (CDN, DNS, firewall), R2 storage for the game and backups, anti-abuse protection (Turnstile), cookieless analytics (Web Analytics) and contact email forwarding (Email Routing) | Global network; US company |
| Resend | Sending the verification and password recovery emails (receives your email, nickname and the link) | United States |
Messages you write to info@xmassoftware.com go through Cloudflare’s forwarding and reach the owner’s mailbox, hosted with another email provider that processes them as part of its service.
International transfers
Cloudflare and Resend may process data in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider participates and, in any case, on the European Commission’s standard contractual clauses, with measures such as encryption in transit.
Your rights
Under the GDPR (articles 15 to 22) and the LOPDGDD, you can exercise at any time and free of charge your rights of access, rectification, erasure, objection, restriction of processing and portability, and the right not to be subject to automated decisions (we make none).
- From My account: export all your data as a JSON file (access and portability), correct your nickname (rectification), hide yourself from the ranking, turn notification types off or close your account by deleting it (erasure). Deletion is immediate and irreversible.
- By email, for any right (also without an account or if you cannot sign in): write to info@xmassoftware.com with the subject “Data protection”, stating the right you exercise, your nickname and, if you can, writing from the account’s address. We reply within one month, free of charge; if the request is complex we may extend it by two months and will tell you within the first.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
How we handle your requests
- Identification: we check the message comes from the account’s email. If you cannot write from it, we will ask for something only you would know (for example, your nickname, your team’s name and approximate sign-up date). We never ask for identity documents.
- Access and portability: we send you the same JSON file you get from My account.
- Rectification: we correct your nickname or email and confirm it at the new address.
- Erasure: we delete the account with the same scope as the delete button.
- Objection and restriction: we suspend the account, keeping the data without using it, or delete it if you prefer.
- If we cannot do what you ask, we explain why and remind you that you can complain to the AEPD.
Security
We use encrypted connections (HTTPS and secure WebSocket) with the website, the API and the race server, strongly hashed passwords, email and messages encrypted in the database, the session in an HttpOnly cookie the website’s JavaScript cannot read, short-lived one-time passes for the game, private backups with an expiry and role-based access control for administration, with every action logged.
Changes to this policy
If we change this policy we will show it here with a new date and, for relevant changes, ask you to accept the new version when you sign in.
Contact: info@xmassoftware.com