Legal

Privacy Policy

Last updated: October 27, 2026

BROAD TESTING CONSORT S.R.L., trading as GitGud Racing Academy ("we", "us", "our"), respects your privacy. This policy explains what data we collect, why, and how you can request deletion or export.

It covers gitgudracingacademy.com whether you only visit, hold an account, buy from us, book 1-on-1 coaching, ask for a free guide or take part in the Academy Trials. If anything here is unclear, write to us and we will answer in plain words.

Who we are

The data controller for gitgudracingacademy.com and for the GitGud Racing store at gitgudracing.com is BROAD TESTING CONSORT S.R.L., a limited-liability company registered in Romania (Trade Register J29/3199/2022, fiscal code CUI 47143880, VAT no. RO47143880), registered office Sat Scorțeni, Comuna Scorțeni, Str. Unirii nr. 18, 107525 Prahova, Romania. GitGud Racing and GitGud Racing Academy are its trading names.

GitGud Racing Academy is a private training platform for sim racers, accessed at gitgudracingacademy.com. Memberships and courses are sold on this site's checkout and through the GitGud Racing store at gitgudracing.com; both are run by the same company. For anything about your data write to support@gitgudracing.com or call +40 724 963 908.

We sell all 1-on-1 coaching ourselves. Our coaches are Marian Barbieru, our founder, and Adrian Kulleseid, a coach based in Norway who coaches for us as a contractor. We have not appointed a data protection officer: privacy questions, requests and complaints go to the same mailbox as everything else, support@gitgudracing.com, so nothing gets lost.

This policy in short

We use your data to run the Academy: your account, what you bought, your lap reviews, the Academy Trials and the emails that go with them.
In the European Union, the rest of the European Economic Area, the United Kingdom and Switzerland, no optional cookie is used until you choose; elsewhere they are on until you switch them off. "Cookie settings" changes your choice at any time.
Every email with news or offers has a one-click unsubscribe link, and customers can say no to them at our checkout; who receives them is under "The emails we send".
Recordings you upload for a lap review are private to you and your coach and are deleted 90 days after the review is completed.
Your account stays until you delete it. You can download your data or delete your account yourself in Account → Settings, and can ask us for a copy, a correction or a deletion at any time, and complain to the Romanian data protection authority (ANSPDCP).
Our services are not for anyone under 16, and we never sell personal data.

What we collect

We collect only what each situation needs. An email address is the one thing an account cannot work without, and a purchase needs the billing details its payment method asks for; everything else on your profile is up to you.

Account data. Email address and display name, and any racing handle, country, iRacing customer ID or profile photo you choose to add to your profile. If we created your account for you, the email address and name come from the order, free-course enrollment or pass that created it (see "Accounts we create for you" below).
Settings and activity. Your password (stored only in scrambled, hashed form), the site language you chose, your time zone (read from your browser, so race times show in your local time), your notification and email choices, whether you want your name shown in public lists ("Show my name + avatar in public standings and race signup lists"), and when you were last active on the site, which shows you as online to other signed-in members for five minutes after it.
Authentication data. If you sign in with Discord, we keep four things from your Discord account: your Discord user ID, your username, your display name and, if your account still has one, its old four-digit tag. At each sign-in we also read the list of Discord servers you belong to, only to check that you are a member of ours; we don't store that list. We don't keep your Discord email address, avatar or any other Discord detail, or Discord's access tokens: the email address Discord sends us is used only during the sign-in, to find or confirm your account here. If you disconnect Discord, we delete the link and clear your Discord user ID and username from your account; your display name stays, because it is your name on the site, and you can change it. If you sign in with Google, we keep your Google account ID, the email address of that account and whether Google has verified it, your name and the address of your Google profile picture.
Purchases. Payments for a membership, a course, the book or a pass are taken by our store at gitgudracing.com, also when you pay on this site's checkout. When an order is placed, the store sends us its details: your billing email address, name and country, the customer ID the store gives you, the order and subscription numbers, what you bought and, for a membership, its plan, its status, the date it is paid up to and how it is paid (card or PayPal). We use them to link the purchase to your account automatically and to keep your access in step with it, and your billing country to show you our prices with the VAT that applies where you are. If you buy a membership directly at our store rather than on this site's checkout, we email you an access code instead; when you redeem it here, we link that membership to the account you redeem it on. The email after a checkout on this site can carry such a code too, for putting the purchase on an account with a different email address. We do not receive your payment card details.
What you accept at checkout. When you pay on this site's checkout we record that you placed the order under our Terms, the version of the wording you saw, whether you ticked the box asking to start your membership, course or book straight away, whether you ticked "Don't send me offers.", the language of the page, the time and the IP address you ordered from. If you start a free trial, we keep the wording you agreed to, when, the IP address you agreed from and a fingerprint of your card from Stripe (never its number), which lets each card have one trial.
Accounts we create for you. If you buy a membership on this site's checkout, or a course or the book on this site's checkout or at our store, if you enroll in a free course at our store, or if an access pass or a gift pass is issued to your email address, we create an Academy account for that address, if it doesn't have one yet, so that what you bought or enrolled in is ready for you. For it we hold the email address, the name given with the order or enrollment, if there is one (as your display name until you change it), the order or enrollment and the access it gives you. We then email you a link to sign in (for a gift pass, the claim link we send you), and the first time you sign in we ask you to choose a password. If you did not expect the account or don't want it, reply to that email or write to support@gitgudracing.com and we delete it.
Usage data. Pages visited, lessons watched, drills completed, and lap-review submissions. This is used to render your progress page and to generate aggregate statistics for the platform. Your scores in our training tools and games, your XP and your daily check-ins are kept too; a score on one of the tools' leaderboards is shown to other members under your name, or as "Anonymous Driver" if you switched off "Show my name + avatar in public standings and race signup lists" in Account → Settings.
Lap and racecraft reviews. When you send a lap for review you give us a video (a YouTube link you control, or a file you upload to us) or, for a racecraft review, an iRacing replay, with the track, the car and your notes. Files you upload are kept in private storage and shown to you and your coach only through links that expire. How long they are kept is under "How long we keep data".
Driver's Log images. The screenshots you attach to a Driver's Log session, and the timing screenshots saved with a Lap Consistency Analyzer stint, are kept in private storage and shown only on your own Driver's Log pages, through links that stop working an hour after the page was opened. Earlier copies of these images that were stored at a public web address are being removed.
Academy Trials. If you join our team on Garage 61 for the Academy Trials, we match your laps to your account through the iRacing customer ID you saved on your profile, and show your best laps to other members on the leaderboards. What we read from Garage 61 is under "Information we receive from others".
Community content. Race sign-ups, Driver's Log entries and anything you post on the community pages, such as Stewarding posts and comments. What you post on the community pages can be seen by the other signed-in members who use them; your Driver's Log is not shown to other members.
Security records. When a sign-in link from a purchase email or a gift pass is used, we record the IP address it was used from. An issue report you send carries your browser type, and an application form the IP address and browser type it was sent from. These are removed after the period under "How long we keep data".
Checkout details. If you start a checkout, the email address you use there and the plan you chose, even if you don't finish. If you're signed in, that's your account email and first name, and opening a membership checkout counts as starting one.
How you reached a checkout. When you open a checkout page we record how you got there: the name of the website that sent you (for example youtube.com, never the full address), the page on our site you came from, any campaign tags in the link (utm_source and similar), whether the link came from an ad click (never the click ID itself), and a creator referral if there was one. We don't record your IP address for this; repeat visits close together are counted once using a one-way scrambled visitor code. If you buy, the same details are kept with your order.
Pages opened from our ads. When you open one of our pages from an ad link, we count the page, the link's campaign tags, whether it came from an ad click (never the click ID itself) and your device type (phone, tablet or computer), by the hour and in totals only. No IP address, cookie or visitor code is kept, and the counts are deleted after 90 days.
Creator referral links. If you follow a creator's referral link, we record the visit: which creator's link it was, an anonymous visitor code (a one-way scrambled code made from your IP address and browser type, kept in the "gg_vid" cookie so your later clicks reuse it), a scrambled copy of your IP address (never the address itself), the page you landed on (its path and the referral tag only), the website that sent you (its name only, for example https://www.youtube.com), the time, and whether the visit led to a purchase. The creator sees the page, the sending website, the time and whether it led to a purchase, never the visitor code.
Free guides. If you ask for one of our free guides by email, we keep your email address, which guide and which kind of page you asked from, the language of that page, and when we sent you the guide and any follow-up emails. If you ticked the box asking for the follow-up emails, we also keep which wording you agreed to, when, and the IP address you sent the form from, as the record of that agreement.
Our partner programme. If you join our affiliate programme: your referral link and partner code, the visits and purchases credited to you, your commissions and payouts, your payout details (the account holder's name with an IBAN and SWIFT/BIC, or a PayPal email address), and which version of the Affiliate Programme Agreement you accepted and when. The agreement itself sets the rest.
Withdrawals and cancellations. What you send through our withdrawal form (your name, email address, the purchase and its date, and your statement) or a request to cancel your membership from your account (with the reason, if you give one), and our confirmations.
Your cookie choice. When you press "Accept all", "Decline" or "Save choices" (see "Cookies" below), we keep a record of it: which button you pressed, whether analytics and advertising cookies were switched on or off, the date and time, whether you are somewhere we ask first or somewhere these cookies are on by default, where on the site you chose (the card, "Cookie settings", or the one time we asked again after an earlier "Decline"), which version of this policy applied, and whether your browser sent the Global Privacy Control signal. It is kept under a one-way scrambled visitor code, never your IP address or your email address, and linked to your account if you are signed in. Nothing is recorded when you make no choice.
Communications. Messages you send through any in-app inbox, lap reviews you submit to coaches, the questions you send through Ask a Coach, and emails you send to support.
Reports about content. If you report content (a review on our public Reviews page, a member's profile or name, or anything else on the website), through the "Report" link on a review or next to a member's name, the form at /report-content/ or an email, with or without an account, we keep your name and email address, the address of the content, the categories you ticked, your explanation, whether you are the person affected, and when you confirmed the good-faith statement. If content you posted is reported or moderated, we keep a copy of it, our decision, the facts and the rule of our Terms or the law it relied on, whether an automated filter flagged it, any complaint you or the person who reported it make, and its outcome.

Information we receive from others

Most of what we hold comes from you. These sources do not, and some of them concern people who have no account with us:

Garage 61 (the Academy Trials). For the Academy Trials we read, every half hour, the roster of our team on Garage 61 (garage61.net): each team member's first and last name, Garage 61 name and iRacing customer ID. We also read the team's laps on the Trials tracks: the time, the car, the track, the conditions and when it was driven. Your best laps show on the leaderboards to other members as the first name and the initial of the last name Garage 61 lists, or as "Anonymous Driver" if you switched off "Show my name + avatar in public standings and race signup lists"; a team member with no account here is shown by that first name and initial too. A team member no account here is linked to (because no account saved their iRacing customer ID) is deleted, with their lap times, once they have been out of the team and have not driven a Trials lap for 90 days; until then their laps stay on the leaderboards. To appear as "Anonymous Driver", switch off that setting in Account → Settings; to have your laps taken off the leaderboards, write to us. Leaving the Garage 61 team stops us reading your new laps and, for a driver no account here is linked to, starts the deletion period above; it does not by itself take your earlier laps off the leaderboards.
iRacing (league and race results). When the result of a league round is imported into this site from iRacing, we receive iRacing's official result of the session for every driver in it, including drivers who have no account here: iRacing customer ID and display name, finishing and starting position, laps, incidents, lap times and the change in iRating and Safety Rating, plus the whole result row iRacing sends, which we keep for checking. Each round's page shows signed-in members every driver's name (for a driver with no account here, their iRacing display name and customer ID), starting and finishing position, laps, incidents, best lap, change in iRating and Safety Rating, and points; the league standings list members' points. For a driver with no account here, that whole row is deleted 90 days after the round; the result itself stays with the league's results.
Our store at gitgudracing.com. The order details listed under "Purchases" above. The store and this site are run by the same company.
Discord and Google. The sign-in details listed under "Authentication data" above.
People named by other members. A report, a Stewarding post or a coach question can mention another driver by name, car number or video. We hold that because a member posted it. If you are named and object, write to us: we remove or anonymise the mention unless a decision on that report or post needs it.

1-on-1 coaching bookings

1-on-1 coaching is booked on booking pages run by Cal.com: cal.com for sessions with Marian Barbieru and cal.eu for sessions with Adrian Kulleseid. When you book, you give the booking page your name, your email address and whatever else its form asks for, such as notes for your coach, and you pay by card through Stripe on the same page; your card details go to Stripe and never reach us. We sell every session, so we are responsible for your booking, and the coach you booked sees it.

Sessions take place live on Discord, where you share your screen while you drive. We do not record a session unless you ask us to; a recording you ask for is sent to you and then deleted. Payment records of a booking are kept as accounting law requires. If you delete your account or ask us, we also delete your bookings from the booking pages, except what that law makes us keep.

Why we collect it

To run the service. Authentication, gating subscriber-only content, displaying personalised dashboards, fulfilling lap-review requests.
To keep accounts secure. Rate limiting, abuse detection, and verifying community-server membership.
To improve the product. Aggregate analytics (which lessons resonate, which drills get completed) inform our content roadmap. Aggregates are never tied to individual users in any analytics dashboards.
To learn what brings members. How people reach a checkout, and which of those visits become purchases, tells us which of our videos, guides and pages are worth making more of. It is reported per channel and per sale on an internal page only our team can open.
To show our ads to people who visited. Only while advertising cookies are on for you (see "Cookies" below for when that is): the Meta pixel tells Meta (Facebook and Instagram) which of our pages you open and which buttons you click, which sections of our homepage you scroll to, and, on a checkout page, when you choose a payment method, when you press pay and whether the payment went through, so we can show our ads on Facebook and Instagram to people who visited us and leave out people who already joined. Meta recognises you from its own cookies if you use Facebook or Instagram in the same browser. If you type your email address, name, phone number or address into a form on our site, or they are already filled in there for you, the pixel can also send Meta a hashed (scrambled) copy of them; Meta calls this automatic advanced matching.
To show our ads on YouTube and Google. Only while advertising cookies are on for you: the Google Ads tag tells Google which of our pages you open and, after you buy, the order number, the amount and the currency, so Google can count the purchase and show our ads on YouTube and Google to people who visited us. Google recognises you from its own cookies if you use YouTube or Google in the same browser, and you can manage the ads Google shows you in My Ad Center.
To show our ads on TikTok. Only while advertising cookies are on for you: the TikTok pixel tells TikTok which of our pages you open and which buttons you click, when you open a membership checkout and, after you join, the order number, the plan, the amount and the currency, so TikTok can count the membership and show our ads on TikTok to people who visited us. TikTok recognises you from its own cookies if you use TikTok in the same browser. If you type your email address, name, phone number or address into a form on our site, or they are already filled in or shown there for you, the pixel can also send TikTok a hashed (scrambled) copy of them; TikTok calls this automatic advanced matching.
To measure our ads. Only if you switched advertising cookies on yourself ("Accept all", or the advertising switch and "Save choices"), never just because they are on by default where you are: when you press pay at a checkout, request our free guide or create an account, our server also reports that step to Meta, so Meta can tell us which of our ads led to it. The report carries your email address in hashed form (for a new account, also your account number with us, hashed), your browser type, the address of the page, for a checkout the plan and its price, and, when we have them, your IP address, Meta's browser ID and its ad click ID. We keep those IDs, your IP address and your browser type for this in your session on our server (not in a cookie), only after that choice and for as long as the session lasts, and we delete them as soon as you switch advertising off. Without that choice we keep at most the fact that your visit came from a Meta ad, never the click ID, and we send it nowhere.
To learn which of our ads led to a sale. Whatever your cookie choice, our store at gitgudracing.com, which takes every payment, reports each purchase to Meta, subscription renewals included, through its Facebook for WooCommerce plugin, and to TikTok through its TikTok for WooCommerce plugin. Each report carries what you bought and what you paid, and your billing details (such as your email address, name and address) in hashed form. If you switched advertising cookies on yourself, we also pass the store your IP address, browser type, Meta's browser ID and its ad click ID, when we have them, for the Meta report, and the store keeps them with your order. Every order this site creates at the store also carries your advertising answer (switched on, switched off, or no choice made); the store's reports do not yet depend on it.
To remind you about an unfinished order. If you start a checkout and don't finish, we may send you up to three reminder emails over the following three days. Each one has an unsubscribe link, and they stop as soon as you complete your purchase.
To be able to show what you chose about cookies. The record of your cookie choice exists for one reason: so that we can show, to you or to a regulator, what you chose and when.
To communicate with you. Account and subscription emails, answers to support requests, and news and offers to the people listed under The emails we send.
To handle reports and moderate content. We use what a report and a moderation decision contain to review the report, decide on it, and tell the person who reported and the person who posted the content what we decided and why. The EU Digital Services Act (articles 16 and 17) requires us to do this, and our Terms of Service commit us to it. We never tell the person who posted the content who reported it, unless the law requires it or the person who reported agrees. How long we keep it is under How long we keep data.

We make no decision about you by automated means that has legal or similarly significant effects. The automatic checks we run (limits on sign-in attempts, one free trial per card, the check that stops a creator earning on their own purchase) only stop abuse, and a person reviews one on request.

The legal basis for each use

Data protection law lets us use personal data only for a stated purpose and on a legal basis. "Contract" means we need the data to give you what you asked for. "Legitimate interest" means we weighed our interest against your rights; you can object to it at any time (see "Your rights"). "Legal obligation" means a law makes us do it. "Consent" means we do it only because you said yes, and you can take that yes back at any time.

Your account, and delivering what you bought or asked for (memberships, passes, courses, the book, lap and racecraft reviews, coaching, the Academy Trials, the community pages, a free guide you requested, and the emails that go with them): contract, including the steps before one.
Payments, refunds, withdrawals and the records tax and accounting law require: contract and legal obligation (Romanian accounting and tax law).
The records of what you accepted, requested or chose (the order under our Terms, the request to start straight away, a withdrawal, your cookie choice, your email choices): legal obligation, because we must be able to show a consent or a request, and our legitimate interest in an accurate record if there is ever a dispute.
Security (sign-in sessions, limits on sign-in attempts and requests, the bot check on the sign-up form, one free trial per card) and finding and fixing errors: our legitimate interest in a safe, working service without fraud or abuse.
How you reached a checkout, pages opened from our ads and creator referral visits: our legitimate interest in knowing which of our own videos, guides, pages and ads bring members, and in paying creators correctly. The "gg_src" cookie is set only with your consent where we ask first; elsewhere it follows the default described under "Cookies".
Advertising (the Meta pixel, the Google Ads tag and the TikTok pixel): your consent in the European Union, the rest of the European Economic Area, the United Kingdom and Switzerland; elsewhere our legitimate interest in advertising, which you can stop at any time with "Cookie settings". What our server itself reports to Meta: always your consent, never the default. The store's purchase report: our legitimate interest in knowing which of our ads lead to sales.
News and offers by email: your consent; or, if you are a customer who did not say no at checkout, the rule that lets a business email its own customers about similar products as long as each email lets them stop (see "The emails we send").
Unfinished-checkout reminders: our legitimate interest in helping you finish a purchase you started; the unsubscribe link in each reminder stops them.
The follow-up emails after a free guide: your consent, given with the box on the form.
Garage 61 and iRacing data about other drivers, and members' mentions of other drivers: our legitimate interest in running fair, complete competitions and community pages.
Publishing members' feedback (see "Feedback we publish") and translating it: our legitimate interest in showing what drivers think of our coaching.
Alerts to our team about new orders, lap reviews and reports: our legitimate interest in answering quickly.
The affiliate programme: contract (the Affiliate Programme Agreement) and legal obligation (accounting).
Reports about content and moderation: legal obligation (EU Digital Services Act) and contract (our Terms).
Answering a request about your data: legal obligation.
Defending or bringing legal claims, and answering authorities: legal obligation and our legitimate interest in protecting our legal position.

The emails we send

Service emails belong to your account or a purchase: order and payment confirmations, the confirmation of your contract, withdrawal and cancellation confirmations, "your review is ready", sign-in links and security notices, and notices about changes to our Terms or this policy. You receive them while you have an account or a contract with us, because they are part of it.

News and offers are everything else: Academy news, offers, race announcements, perk reminders, Academy Trials updates and the follow-ups after a free guide. Every one of them has a one-click unsubscribe link, and one click stops all of them. We send them to:

customers who bought a membership, a pass, a course or the book from us, unless they ticked "Don't send me offers." at checkout or unsubscribed since;
anyone who ticked "Academy news, offers and race announcements" in Account → Settings, or said yes when we asked them by email; if we asked you once whether to keep emailing you, we stop on the date that email names unless you said yes;
for the follow-ups after a free guide, only people who ticked the box asking for them on the guide form.

You can change your choice in Account → Settings at any time; turning news off never stops service emails.

Unfinished checkouts. If you start a checkout and do not finish, we may send you up to three reminders over three days; the checkout page tells you so, and we do not ask first. They stop as soon as you buy, withdraw or unsubscribe. If you unsubscribe, we keep just your email address, so that we never remind you again.

Feedback we publish

After a lap review you can rate it and add a comment. Your rating goes to your coach and counts in the average on our public reviews page. A comment you write may be published on that page anonymised to the car, the track and the month, with your name removed, and translated automatically into the site's other languages; the rating card tells you this before you send it. If you would rather a comment of yours were not published, write to us and we take it down.

Some reviews on our site are messages drivers posted in our Discord server; we show them word for word, with the name they posted under and the month. If one is yours and you want it taken down or your name removed, write to us.

We do not sell personal data. We share data with these processors, each for the purpose stated:

Railway — hosting (EU region).
Cloudflare — DNS for our domains.
Google (Google Workspace) — hosting of our mailbox, support@gitgudracing.com, which receives the messages you send us and our own service alerts.
Resend — transactional email delivery.
Sentry — error monitoring. When something breaks, the error report carries your account number if you are signed in (never your email address, name or IP address), the address of the page without any email address or name in it, and your browser type; no cookies, and not the form data sent with the request. Email and IP addresses that turn up in an error message are masked before it is sent.
Cloudflare R2 — file storage. Lap-review and racecraft uploads and Driver's Log images are kept private and shown only through links that expire. Your profile photo, if you add one, is stored at a public web address that does not expire, so anyone who has that address can open it; we show it beside your name on the site.
Cloudflare Turnstile — the check on our sign-up form that tells people from bots: Cloudflare receives your IP address and details of your browser while the form is open.
Anthropic — automatic translation of the comment you write when you rate a lap review (into the site's other languages) and of the subtitles of coach review videos, and, when you use the Lap Consistency Analyzer, reading the lap times from the screenshot you give it and writing its notes on the stint. We send Anthropic only that text, or that screenshot and the stint's figures; we never add the name or email address on your account, though a name can appear in the text or screenshot itself (for example on a results screen, or where your coach says your name).
Cal.com — the booking pages for 1-on-1 coaching (see "1-on-1 coaching bookings").
Our store's hosting company — our store at gitgudracing.com, which takes every payment, is a WordPress and WooCommerce site on a hosting company's servers: the orders, subscriptions and billing details the store keeps are stored there.
Mailchimp — the email service connected to our store at gitgudracing.com, which keeps the store's own mailing list.
Discord — when you sign in with Discord, you authorise sharing your Discord profile with us; we keep only what "What we collect" lists.

Each processor handles only the minimum data needed for their role and is bound by their own data-processing agreement.

These companies receive data from us or from you and use it under their own terms and privacy policies:

Stripe — card payments on this site's checkout, with Apple Pay, Google Pay, Link and Alipay, and on the coaching booking pages: your card or wallet details go from your browser straight to Stripe.
PayPal — if you pay with PayPal.
Garage 61 and iRacing — we read the Academy Trials team's roster and laps from Garage 61, and league results from iRacing (see "Information we receive from others"); we send them nothing about you beyond the request itself.
Vimeo and YouTube — the video players on our pages (see "Videos" under "Cookies"). A coach's response video is a YouTube video on our own channel, shown on your review page.

Inside our team, the coach who reviews your lap or coaches you sees your review or your booking; Adrian Kulleseid coaches for us as a contractor from Norway. We give authorities and courts only what a legal duty requires, and our professional advisers only what a dispute needs.

For our books and taxes: our accountant receives what bookkeeping and our tax filings need (invoices, payments, refunds and, for partners in our affiliate programme, payouts); our bank and PayPal receive what a payment, a refund or a payout needs; and the Romanian tax authority (ANAF) receives what the law makes us report.

We also share data with Meta (Facebook and Instagram), to measure our ads and to show them to people who visited us, with Google, to count the purchases our ads lead to and to show our ads on YouTube and Google to people who visited us, and with TikTok, to count the memberships our ads lead to and to show our ads on TikTok to people who visited us, as described under "Why we collect it" and "Cookies". This site shares it with Meta, Google and TikTok only while advertising cookies are on for you: in the European Union, the rest of the European Economic Area, the United Kingdom and Switzerland that is only after you switch them on; everywhere else they are on unless you switch them off. What our server itself sends to Meta, and what it passes our store for its report, goes only after you switched advertising on yourself, never on the default. The one exception is the purchase report our store sends to Meta and TikTok for every order, whatever your cookie choice. Meta, Google and TikTok use this data under their own terms; Google's are in its privacy policy.

Transfers outside the European Economic Area

Several of the companies above are in the United States or elsewhere outside the European Economic Area, or reach your data from there. Where a company is certified under the EU–US Data Privacy Framework, the transfer relies on the European Commission's decision that the Framework protects your data adequately; otherwise it relies on the European Commission's standard contractual clauses in that company's data-processing or business terms. Ask us at support@gitgudracing.com which safeguard applies to a given company, and for a copy of it. Adrian Kulleseid works from Norway, which is in the European Economic Area.

How long we keep data

We keep personal data only for as long as its purpose needs, then delete it. These are the periods our deletion jobs apply:

Your account. Account data is kept for as long as your account exists. We do not close accounts for inactivity: your account stays until you delete it (Account → Settings, "Delete my account") or ask us to delete it.
Orders and what you accepted. Orders, invoices and payment records are kept for as long as Romanian accounting law requires, and the record of what you accepted, requested or withdrew is kept with them as evidence; both stay after you delete your account, without your email address (see "Your rights").
Review recordings. Lap-review videos and racecraft replays you upload to us are deleted 90 days after the review is completed, and a recording you replaced while answering your coach 90 days after you replaced it. A recording on a review that was never completed (still waiting for a coach, or for your answer) is deleted 180 days after the review's last activity. Only the file is deleted: the review itself (the track, the car, your notes, your coach's notes, your rating and the messages) stays with your account. A YouTube link you pasted is not a file we keep; that video stays under your control on YouTube. You can ask us to delete a recording earlier at any time.
Your coach's notes and response video. Kept for as long as your account exists, as part of the coaching you received, and deleted with your account.
Driver's Log images. Kept for as long as you keep the entry. The stored image is deleted as soon as you replace or remove it, delete the session or stint, or delete your account.
Reports about content and moderation decisions. A report about content, our decision on it, the statement of reasons, any complaint, and a copy of content we hid or deleted are kept for 12 months after the case closes, so that a complaint can be reviewed and a decision reversed. Then the record is anonymised: who reported, who posted and what was written are removed, and only the kind of report, the measure taken and the dates stay. A review we took off the public Reviews page is not deleted: it stays part of your lap review, visible to you and your coach, and is never published again.
IP addresses and browser types kept for security. The IP address a sign-in link or a gift pass was used from, the browser type sent with an issue report, and the IP address and browser type sent with an application form are removed 30 days after they were recorded. The rest of each record stays.
IP address with a checkout acceptance or a trial consent. If an IP address was recorded when you accepted our Terms at a checkout, it is removed 396 days (about 13 months) after the checkout; if one was recorded with your consent to a free trial, it is removed 396 days (about 13 months) after you gave it, the period in which a card payment can still be disputed. What you accepted, and when, stays with your order.
Unfinished checkouts. Checkout reminder records, including our log of the reminders we sent, are deleted 90 days after you started the checkout. If you unsubscribe, we keep just your email address after that, so that we never send you another reminder.
How you reached a checkout. Records of how a checkout visit came about are deleted 90 days after the visit; for a completed purchase, how you reached the checkout is kept with the order record.
Creator referral visits. Each visit record is deleted 90 days after the click. After that, each creator keeps only two numbers: how many visits their links ever brought and how many led to a purchase, with nothing about any visitor. The commission record of a purchase stays with the order.
Free-guide requests. Deleted 730 days (about 24 months) after the last email we sent you, the guide or a follow-up, or after your request if none went out. Our log of the follow-up emails loses your address after the same period. If you unsubscribed, we keep just your email address after that, with the date you first asked and the kind of page you asked from (for example our homepage or a guide), so that we never email you again.
Trials drivers with no account here. A driver of our Trials team no account here is linked to is deleted, with their lap times, once they have been out of the team and have not driven a Trials lap for 90 days.
League results of drivers with no account here. The whole result row iRacing sent is deleted 90 days after the round; the result itself (the iRacing display name and customer ID, positions, laps, lap times, incidents, iRating and Safety Rating changes and points) stays with the league's results.
Cookie choices. The record of a cookie choice is deleted 730 days after you made it.
Signing in. A sign-in session expires 45 days after it was last renewed, and expired sessions are deleted every hour. A sign-in link we email you (for example after a purchase) works once, within 7 days.
Error reports and logs. Error reports are kept by Sentry, and our application logs by our host Railway, for the period each of them sets, then deleted.

Your rights

You can, free of charge:

Access a copy of your personal data.
Correct any inaccurate data via your profile page or by emailing support.
Delete your account and the data linked to it.
Export your data in a machine-readable format.
Withdraw consent for optional processing (e.g. marketing emails) at any time.
Object to any use that rests on our legitimate interest (see "The legal basis for each use"): we then stop unless we have compelling reasons that override yours, and we always stop emailing news and offers when you object to them.
Ask us to pause using your data while we check that it is correct or whether your objection holds.

Download your data. Signed in, open Account → Settings and press "Download my data": you get a file straight away with your profile, purchases and subscriptions, lap and racecraft reviews, coach questions and answers, challenge results, consent records and the rest of the data we hold about you, in a machine-readable format (JSON). Links to your own recordings in it work for 7 days. Your orders and invoices from our store, gitgudracing.com, are not in it: ask us for those.

Delete your account. In Account → Settings, press "Delete my account" and confirm with your email address. You are signed out and your account is deactivated straight away, and we email you a link to undo it, which works for 14 days. After that we delete your name, email address, Discord link, profile and photo, your lap and racecraft reviews and their videos, your coach questions, Driver's Log, notes and progress. If you have an active membership, it is cancelled first and your account is deleted once that is done. We keep what the law requires: invoices and payment records for 10 years, as Romanian accounting law requires, and the records of the terms you accepted, your consent choices and any cancellation, as legal evidence, without your email address in our records. A star rating you gave a lap review stays in the public average without your words, and your league results, challenge lap times and Stewarding posts stay without your name. The same month we also erase your details from our store at gitgudracing.com; that part is done by hand.

You can also email support@gitgudracing.com from the address on your account, for these or any other right. We respond within one month.

Writing from the address on your account is how we know a request is yours; if you write from another address, we ask you to confirm from that one. If a request is complex we may need up to two more months, and we tell you why within the first month.

Complaints to the authority. You can complain to the Romanian data protection authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania, www.dataprotection.ro, or to the data protection authority of the country in the European Economic Area where you live or work. You do not need to write to us first, but if you do, we will try to put things right.

Children

Our services are not for anyone under 16. We do not knowingly collect personal data from children under 16; if you believe a child has given us data, write to support@gitgudracing.com and we will delete it.

Cookies

We use a small number of first-party cookies, plus two kinds of optional cookies, analytics and advertising, which you can choose together or separately. Whether the optional ones are on depends on where you are and on what you choose:

Where we ask first. In the European Union, the rest of the European Economic Area (Iceland, Liechtenstein and Norway), the United Kingdom and Switzerland, we ask you to choose "Accept all" or "Decline" before any optional cookie is used. Until you switch them on, the optional cookies are off: none of them is loaded or set (not the Meta pixel, not the Google Ads tag, not the TikTok pixel, not "gg_src"), and this site sends nothing about you to Meta or TikTok.
Choosing each kind separately. "Customise", shown with those two buttons, opens a switch for analytics and a switch for advertising, and "Save choices" keeps exactly what you set. Where we ask first, both switches start off. "Accept all" switches both on, "Decline" switches both off. Necessary cookies (sign-in, checkout, security) are always on and are not part of the choice.
Everywhere else. The optional cookies are on from your first visit, and we don't ask. You can switch them off at any time: "Cookie settings" opens the same choice, and "Decline" there switches them off, exactly as it does where we ask first; "Customise" there switches off just one kind. Our server does not treat that default as your consent to advertising: until you switch advertising on yourself, it sends nothing about you to Meta and passes nothing about your visit to our store for its report.
Global Privacy Control. If your browser sends the Global Privacy Control signal, we treat it as "Decline" wherever you are, unless you switch a kind on yourself.
If you declined before. If you chose "Decline" before the choices changed on September 30, 2026, we ask you once more, wherever you are, because analytics and advertising can now be chosen separately, unless your browser sends the Global Privacy Control signal (then we don't ask, and "Cookie settings" is the way to change your choice). Until you answer, your "Decline" stands and the optional cookies stay off; whatever you answer, we don't ask again.
If you switched advertising on before we added Google or TikTok. A choice made before this policy named Google does not cover the Google Ads tag, and one made before it named TikTok does not cover the TikTok pixel: each stays off for you until you choose again with "Cookie settings". The rest of your choice stands.
How we tell where you are. From your browser's time zone (for example "Europe/Berlin"), checked by the page in your browser. If the time zone doesn't place you clearly outside the countries where we ask first, we ask first. We don't store your time zone for this.

You can change or withdraw your choice at any time: this Cookie settings link opens the choice again, and so does the same link at the bottom of our homepage, guides and other public pages, under the pay button on a checkout page, and in the menu when you are signed in. The cookies themselves:

Essential. A session cookie keeps you signed in, a CSRF cookie protects form submissions, and a consent cookie ("cookie_consent") remembers your cookie choice, with "gg_consent_v" beside it noting which version of this policy the choice was made under, so that we know not to ask you again and whether your choice was made before we added Google or TikTok. Where the optional cookies are on by default, the consent cookie records that instead, together with "gg_region", which notes only that your browser is outside the countries where we ask first; it lasts 30 minutes and is renewed while you browse. These are needed for the site to work, so they are not part of the choice above.
Referral attribution. If you arrive through a creator's referral link, we set "gg_ref" — a signed first-party cookie recording which creator referred you, kept for up to 30 days so a later purchase is credited to them — and "gg_vid", an anonymous identifier used to avoid counting your repeat clicks as multiple visits, kept for 30 days. Each click on a creator's link renews both. They are not part of the cookie choice.
Analytics (optional). Helps us see which pages work, by remembering where your visit came from. Only while analytics cookies are on do we set "gg_src", a signed first-party cookie recording how you first arrived on the site: the name of the website that sent you, the page you landed on and any campaign tags in that link. It is kept for 30 days and never overwritten, so a later purchase is credited to the channel that first brought you. Only our server reads it, and it is shared with no one: no other company's script runs under analytics. (Pages opened from our ads are counted whatever your choice, as described above.)
Advertising (optional). Lets us show you our ads on Facebook, Instagram, YouTube, TikTok and Google, and count the sales they lead to. Only while advertising cookies are on do we load the Meta pixel (to measure our ads and to show them on Facebook and Instagram to people who visited our site; its cookies are "_fbp" and "_fbc"), the Google Ads tag (to count purchases and to show our ads on YouTube and Google to people who visited our site; its cookies on this site start with "_gcl_", such as "_gcl_au") and the TikTok pixel (to count memberships and to show our ads on TikTok to people who visited our site; its cookies are "_ttp", "_tt_enable_cookie", "ttclid" and the "ttcsid" ones). Only once you switched advertising on yourself do we also report the steps listed under "Why we collect it" to Meta from our server, and pass our store the details listed there for its purchase report.
While a kind is off. A kind is off when you chose "Decline", when you saved it switched off, when you have not answered where we ask first, or when your browser sends Global Privacy Control and you have made no choice. Nothing of that kind is then loaded or set, and while advertising is off this site sends nothing about you to Meta and does not load the Google Ads tag or the TikTok pixel; if you buy, our store still reports the purchase to Meta and TikTok, as described under "Why we collect it". If a kind was on and you switch it off, it is not loaded again from the next page you open, and the cookies it set on this site are deleted: "gg_src" for analytics, "_fbp", "_fbc", the "_gcl_" cookies and TikTok's "_ttp", "_tt_enable_cookie", "ttclid" and "ttcsid" cookies for advertising. The other kind is left as it is.
Videos. Our videos play in Vimeo's or YouTube's player, whatever your cookie choice, because a video cannot play otherwise. YouTube videos play in YouTube's privacy-enhanced mode (youtube-nocookie.com), and our Vimeo players load with Vimeo's "do not track" setting, which asks the player not to track your viewing. Where a video shows a cover with a play button, as on our homepage and our lap-review and coaching pages, nothing is loaded from Vimeo or YouTube until you press play; a page that shows the player straight away, such as a lesson, a drill or a guide, loads it when the page opens. Once a player loads, Vimeo or Google receives your IP address and browser details, as it does wherever its player is shown, and the player may store data in your browser. That is YouTube's player, not the Google Ads tag: it is not told what you buy. Some pages also show video thumbnails served by YouTube or Vimeo, which receive your IP address and browser details in the same way.

Necessary

Referral

Analytics (optional)

Advertising (optional)

Payment (checkout pages only)

Our own scripts also keep a few things in your browser's storage. They stay on your device and are never sent to us:

An unsent comment you are writing on a lesson, so it survives a reload (local storage, under "gg-lesson-note-draft-"; until you post it or empty the box).
Where you are in a book in the library, so you can carry on reading (local storage, under "gg-book-pos-"; until you clear your browser's storage).
Your scores and settings in the reaction-time, race-start and peripheral-vision trainers (local storage, under "gitgud.dpl."; until you clear your browser's storage).
A note that a checkout page reloaded itself once after it went stale, so it does not reload again and can tell you why (session storage, under "gg.checkout."; until you close the tab).

Security

Everything between your browser and this site is encrypted (HTTPS, which browsers are told to always use). Passwords are stored only in hashed form. Review uploads and Driver's Log images are kept in private storage and shown through links that expire. Sign-in attempts are limited, so a password cannot be guessed by trying over and over.

Unless a breach of personal data is unlikely to put anyone at risk, we report it to the ANSPDCP within 72 hours of learning about it; if the risk to you is high, we also tell you directly, without undue delay.

If you are in the United Kingdom or outside the EEA

United Kingdom. The UK's data protection law gives you the same rights as "Your rights" above, and we ask you first about optional cookies. You can also complain to the Information Commissioner's Office (ico.org.uk).

Everywhere else. You have the rights the law of your country gives you; write to us and we will honour them. We do not sell personal data, and we honour the Global Privacy Control signal wherever you are (see "Cookies").

Changes to this policy

We change this policy when the law, our services or the companies we work with change. For a change that affects what we do with your data, we email a summary of what changes at least 30 days before it takes effect to every account with a confirmed email address that has a membership, a pass or a purchase with us, or has signed in during the last 12 months. Minor changes, such as clarifications and corrections, take effect when we publish them.

The date at the top of this page is the policy's version, and each record of a cookie choice is stamped with it. If you would like an earlier version, ask us at support@gitgudracing.com and we will send it to you. Using the site after a change does not count as agreeing to it; where a change needs your consent, we ask for it.

Contact and complaints

Questions or complaints about this policy can be sent to support@gitgudracing.com, by post to BROAD TESTING CONSORT S.R.L., Sat Scorțeni, Comuna Scorțeni, Str. Unirii nr. 18, 107525 Prahova, Romania, or by phone on +40 724 963 908.

We confirm that we received a complaint within 2 working days and answer it within 14 days. A request to use one of your rights is answered within one month (see "Your rights"). You can also complain to the ANSPDCP, www.dataprotection.ro. A complaint about a purchase follows our Terms of Service.