Privacy policy

1. Data controller

The data controller is JOH Consulting, EURL with €1,000 share capital, SIRET 949 441 257 00019, represented by Joevin Hermant. Contact: contact@tarmago.com.

2. Data collected

Tarmago collects the following data, necessary for the service:

• First and last name — account creation, identification on bookings
• Email address — account, confirmations, reminders
• Phone — organisers only, contact in case of an issue
• Booking data — history, credits, invoices
• Payment data — processed exclusively by Stripe (Tarmago stores no card data)
• Organiser KYC documents — ID and business proof, required to verify organiser accounts
• Organiser IBAN — transmitted to Stripe Connect for payouts, never stored permanently in clear text
• Telemetry sessions — GPS traces, laps and times from your lap-timer or app files, clipped around the circuit (the ride there is discarded); the ranked lap's GPS trace is visible to signed-in riders unless you hide it for that session. Exception: GoPro GPS traces are not shared.
• Telemetry files sent to the team — the file you choose to send us when Tarmago can't read it or can't read all its sensors, with the device and comment you provide
• Feedback on a session review or on the gearing review — the topic and comment you send to the team, with the session concerned and, for the gearing review, its text as you read it (including comparisons with your other circuits of the season); your “useful” or “not useful” answer under an AI-written review, with the session, the type of review (session or gearing), its mode, its version and a fingerprint of the text you judged
• Rankings — your best lap per layout and, if you share your sectors, your best time in each sector (between two lines on the map), with your first name followed by your last initial by default for new accounts (or your username if you prefer; previously saved choices are kept), photo, level, machine type and engine size, the year and the lap timer used; your best lap on each layout, with its date, the number of timed days on that layout and your position once 10 riders are ranked there, is also shown on your public profile if it is public; on by default, immediate opt-out from Account > Profile or session by session; signed-in riders can open the ranked lap's session and see what you share (lap times, sectors, speeds, and the ranked lap's GPS trace unless you hide it for that session); the AI-written review is never shared; your gender is asked to access them but never displayed, only the women's ranking makes it guessable; the flag of your country of residence is shown only if you turn it on (off by default); your full name and e-mail are never published; if you report another rider's lap, your report (reason, comment, date) is kept for the check and is never shown to that rider. GoPro exception: only the ranked lap, its season, source and GPS frequency are published with the usual ranking information, labelled “uncertified GPS lap time”. The lap can be reported, but other laps, their count, sectors, speeds and GPS trace are not shared, including for previously imported sessions. Sector rankings, public-profile records, distinctions and proof of attendance remain excluded for this source. GPS frequency does not certify the time or its accuracy. If your best ranked lap on a layout comes from a GoPro, no record for that layout is shown on your public profile, even if you have an older lap-timer time. No GoPro date is published and no older record is substituted.
• Signed liability waiver — name, date of birth, signed text, date and time, IP address and browser, PDF of the waiver (evidence of the electronic signature)
• Rider logbook — days ridden, conditions, bike used, proof (photo, video or PDF) and its digital fingerprint, used to verify attendance
• Public profile — username, display name, photo, bio, Instagram and Strava links, badges and verified days; on by default for accounts created since 27 September 2026 (older accounts keep their setting), can be turned off at any time, never offered to search engines
• Reviews — rating and comment published on an organiser's or circuit's page, under your public name, or without a name if your profile is private
• Garage, season and notes — bikes, components and maintenance, planned days, circuit notes and alerts: private, visible to you only
• Technical security data — IP address used temporarily to prevent abuse (request limits) and security logs
• Messages sent through the contact form: name, email address, subject, message and, if you provide them, your company and its website
• Tarmago+ subscription — plan, trial, payment and end dates, status, version of the accepted terms and consent dates, declared country of residence and card issuing country (applicable VAT); the card is entered at Stripe (Tarmago sees neither its number nor its security code)

Navigation data

Tarmago uses Vercel Analytics and Speed Insights, privacy-friendly audience measurement tools that drop no cookies, collect no personal data and do not track users across sites. These tools are exempt from consent under CNIL recommendations.

3. Legal bases for processing

Data processing is based on the following legal grounds:

• Performance of the contract (art. 6.1.b GDPR) — managing bookings, payments, credits, invoicing, transactional communication
• Legitimate interest (art. 6.1.f GDPR) — fraud prevention, platform security, organiser identity verification (KYC), service improvement, post-trackday recap and review request emails (can be stopped in one click), per-layout rankings and public profile (on by default, can be turned off at any time without giving a reason)
• Legal obligation (art. 6.1.c GDPR) — keeping invoices and accounting data (Commercial Code), verifying professional identities
• Consent (Art. 6(1)(a) GDPR) — newsletter (opt-in at sign-up) and published reviews, turned on by you and revocable at any time

4. Use of data

Your data is used exclusively for:

• Managing your bookings, credits and invoices
• Sending transactional emails (confirmation, D-7 reminder, cancellation, invoice)
• Post-trackday emails (legitimate interest): a recap the next day (the day joins your track logbook; for a guest, an invitation to create an account), then, for members, a review request about the organiser and the circuit. You can stop them in one click from each of these emails, without an account, or from Account > Notifications & preferences
• Sending the Tarmago newsletter (only if you consented)
• Verifying organiser identity and activity (KYC process)
• Processing payments and payouts to organisers via Stripe Connect
• Improving the Tarmago service and anonymously analysing usage
• Analysing your sessions (laps, sectors, review), per-layout rankings and improving circuit maps from uploaded GPS traces — the latter in aggregate and without identifying the rider (legitimate interest)
• Telemetry files you send us are used only to add support for their format or sensors; they are never published or shared (consent, given when sending)
• Your feedback on session and gearing reviews is used only to fix and improve the analyses; it is read by the Tarmago team, which may view the session concerned, and is never published or shown to other riders (legitimate interest). Your “useful” or “not useful” answer under an AI-written review is kept with the session and deleted with it or with your account; the team only sees totals.
• Contact form messages are only used to reply to you: they are forwarded by email to the Tarmago team and are not stored in the site's database (legitimate interest)
• Managing the Tarmago+ subscription (trial, payments, invoices, cancellation, withdrawal) and the related emails: contract confirmation, failed payment, cancellation, withdrawal, reminder before renewal (performance of the contract; legal obligation for the renewal reminder and the cancellation confirmation)
• One free trial per card: Tarmago keeps a fingerprint (SHA-256 hash) of the card identifier provided by Stripe, which cannot be used to recover the card number, in order to refuse a second trial with the same card (legitimate interest: preventing abuse)

5. Retention periods

Data is kept for the following durations:

• Account data (name, email) — account lifetime + 30 days after deletion
• Booking data and invoices — 10 years (accounting obligation, Commercial Code art. L123-22)
• Organiser KYC documents — duration of the contractual relationship + 5 years (vigilance obligation)
• Organiser IBAN — removed from our servers as soon as transmitted to Stripe Connect
• Credits — 12 months from creation, then archived
• Newsletter consent — until consent is withdrawn
• Opt-out from post-trackday emails — a hash of your address (not the address itself), kept for as long as your choice stands, including after your account is deleted, so that it keeps being honoured; erased if you turn these emails back on in your preferences
• Signed waivers — 5 years (evidence in the event of a dispute about the day)
• Logbook proof — the file is deleted 90 days after it is approved or rejected; only its digital fingerprint is kept, to prevent the same proof from being reused
• Telemetry sessions — kept until you delete them; deleting a session or your account also erases its GPS traces. A file uploaded but never imported is erased within 48 hours
• Telemetry files sent to the team — deleted at the latest 12 months after sending, or earlier on request; deleting your account also erases them
• Feedback on a session review or on the gearing review — deleted 12 months after sending; deleting the session or your account also erases it
• “Useful” or “not useful” answers under an AI-written review — kept with the session; deleting the session or your account erases them
• Contact form messages: kept in our mailbox for the duration of the exchange, then at most 3 years after the last contact
• Tarmago+ subscription — for as long as the account exists; invoices are kept for 10 years (accounting obligation)
• Free-trial card fingerprint — kept for 3 years after the trial, unlinked from the account once it is deleted, then deleted automatically
• Tarmago+ withdrawals (statement, date and time of receipt, confirmation address, amounts refunded) — 5 years after receipt (evidence in case of dispute), then deleted automatically
• Request-limit data — deleted about one hour after the end of the check period

Upon account deletion, booking data is anonymised (name replaced by « Deleted user ») but kept for accounting purposes.

6. Sub-processors and recipients

Your data may be transmitted to the following sub-processors, strictly within the purposes described:

• Stripe Payments Europe, Ltd. (Dublin, Ireland) — payment and payout processing
• Supabase Inc. (Singapore, hosted in the EU — Ireland) — database, file storage and authentication
• Vercel Inc. (USA) — website and API hosting
• Resend Inc. (USA) — email sending
• Anthropic PBC (USA) — writing of the AI telemetry reviews (session and gearing), from session metrics only (no GPS point, no name, no date). These reviews remain linked to your Tarmago account.
• Vercel Inc. (USA) — anonymous audience measurement (Vercel Analytics + Speed Insights), cookie-free
• Google Ireland Ltd (Dublin, Ireland) — sign-in with a Google account, only if you choose this sign-in method
• Esri (Environmental Systems Research Institute, Inc., United States) — provision of ArcGIS basemaps, including satellite views of circuits. When the map loads, your browser sends your IP address and the displayed area (coordinates of the requested tiles) to Esri to display these basemaps.

7. Transfers outside the EU

Some sub-processors (Vercel, Resend, Anthropic) are located in the United States. These transfers are governed by the European Commission's Standard Contractual Clauses (SCC) and/or the EU-US Data Privacy Framework, in line with GDPR articles 44 to 49.

Loading Esri/ArcGIS basemaps also involves a transfer outside the EU, to Esri in the United States.

8. Data security

Your data is protected by the following measures: encryption in transit (TLS/SSL) and at rest, secure authentication (password hashing, 3D Secure for payments), restricted data access (Row Level Security on all tables), KYC documents stored in a private bucket with temporary signed URLs (1h). Tarmago does not store any card data — all payments are handled by Stripe (PCI DSS Level 1 certified).

9. Cookies

Tarmago only uses strictly necessary technical cookies (Supabase authentication session and language preference). These cookies are exempt from consent under article 82 of the French Data Protection Act. Tarmago uses no tracking, advertising or profiling cookies.

The i18n_redirected cookie is strictly necessary to remember your browsing language. It is retained for 1 year.

We use Vercel Analytics and Speed Insights to measure traffic, performance and usability on Tarmago. We count filter usage, the start of the registration form and additions to the cart as aggregate statistics. These events contain no names, email addresses, account or booking identifiers, or form contents. URL parameters and fragments are removed, detail page addresses are grouped, and personal areas are excluded from collection. These measurements are not used for targeted advertising or linked to your account. We respect your browser’s Do Not Track and Global Privacy Control signals.

10. Your rights (GDPR)

Under articles 15 to 22 of GDPR, you have the following rights:

• Right of access — obtain a copy of your personal data
• Right of rectification — correct your data from your profile or by contacting us
• Right to erasure — delete your account from Account > Profile (accounting data is anonymised but kept)
• Right to portability — receive your data in a structured format (JSON)
• Right to object — object to your data processing for legitimate reasons; for rankings, session sharing and the public profile, without giving a reason and with immediate effect, from Account > Profile and from each session; for post-trackday emails (recap and review request), in one click from each of them, even without an account
• Right to restriction — request a temporary suspension of processing
• Right to withdraw consent — withdraw your newsletter consent at any time from Account > Preferences

To exercise these rights, contact us at contact@tarmago.com. We respond within 30 days under GDPR.

11. Complaint to the CNIL

If you consider that the processing of your data does not comply with regulations, you have the right to file a complaint with the CNIL (French Data Protection Authority): cnil.fr or by post at CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

12. Minors

Tarmago does not knowingly collect data from people under 18. Registration and booking are reserved for adults. If a minor provided personal data without parental consent, the legal guardian can request deletion at contact@tarmago.com.

13. Contact

For any question about your personal data or this privacy policy: contact@tarmago.com