Privacy Policy

1. Introduction

MX Tracks ("we", "us", "our"), operated via themxtracks.com, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our platform, in compliance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and Italian data protection law (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018).

2. Data Controller

The data controller is MX Tracks, reachable at the contact details provided at the bottom of this page. For any privacy-related enquiries, please contact us using the details in Section 12.

3. Data We Collect

We collect the following categories of personal data:

• Account data: email address, name, and profile picture when you sign in via Google OAuth.
• Review data: name, email address, review text, and ratings when you submit a track review.
• Contact form data: name, email address, company (if provided), and message content.
• Usage data: pages visited, actions taken on the platform, device type, and browser information — collected via PostHog (in cookieless mode) and Vercel Analytics.
• Favourites: stored locally in your browser (localStorage) and not transmitted to our servers.
• Technical data: IP address, browser type, and device information — processed for security, rate limiting, and bot protection.

4. Legal Basis for Processing

We process your personal data under the following legal bases (GDPR Article 6):

• Consent (Art. 6(1)(a)): for analytics tracking via PostHog and Vercel Analytics, managed through the Axeptio cookie consent banner. You may withdraw consent at any time.
• Contractual necessity (Art. 6(1)(b)): to provide the platform services you request, including account creation and review submission.
• Legitimate interest (Art. 6(1)(f)): for platform security, fraud prevention, rate limiting, and bot protection via Cloudflare Turnstile and Upstash Redis.
• Legal obligation (Art. 6(1)(c)): to comply with applicable laws and regulations.

5. Third-Party Services

We use the following third-party services that may process your data:

• PostHog — analytics and event tracking (cookieless mode, data stored in EU/US). Used to understand how riders use the platform.
• Vercel — hosting, web analytics, and speed insights. Processes technical data for performance monitoring.
• Supabase — authentication (Google OAuth) and database storage. Stores account data, reviews, and track information.
• Resend — transactional email delivery. Processes name and email when you submit the contact form.
• Upstash Redis — rate limiting on contact forms and review submissions. Processes IP-based identifiers temporarily.
• Cloudflare Turnstile — bot protection. Processes browser fingerprint data to verify human users.
• Axeptio — cookie consent management. Stores your consent preferences.
• OpenStreetMap / Leaflet — map display. Tile requests expose your IP address to OpenStreetMap servers.

6. Cookies and Tracking

We use cookies and similar technologies as follows:

• Essential cookies: Supabase authentication session cookies — required for account functionality. These do not require consent.
• Analytics: PostHog operates in cookieless mode (persistence: 'memory') but still processes page view and event data. Vercel Analytics and Speed Insights collect performance metrics. Both require your consent, managed via Axeptio.
• Consent management: Axeptio stores your cookie preferences. You can change your preferences at any time by clicking the cookie settings button on the website.
• Security: Cloudflare Turnstile and Upstash rate limiting process data for bot protection and abuse prevention — classified as strictly necessary.

7. Data Retention

Account data is retained for as long as your account is active. Review data is retained for as long as the review is published. Contact form submissions are retained for up to 12 months. Analytics data is retained according to PostHog and Vercel's retention policies. Rate limiting data is temporary and expires automatically.

8. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate data.
• Right to erasure: request deletion of your personal data.
• Right to restriction: request that we limit processing of your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest.
• Right to withdraw consent: withdraw your consent for analytics at any time via the Axeptio cookie banner.

To exercise any of these rights, contact us using the details in Section 12. We will respond within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption, Content Security Policy headers, input validation and sanitisation, rate limiting, and access controls. However, no method of transmission over the Internet is 100% secure.

10. International Data Transfers

Some of our third-party service providers (PostHog, Vercel, Supabase, Resend) may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions, in accordance with GDPR Chapter V.

11. Children's Privacy

Our platform is not directed at children under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete such data.

12. Contact

For privacy-related enquiries, data subject access requests, or to exercise your rights, please contact us at:

Email: themxtracks@gmail.com

Or use our contact form at themxtracks.com/contact

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically. Your continued use of the platform after changes constitutes your acceptance of the revised policy.

14. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) at gpdp.it.