Privacy Policy
Sportscar Tours (the “App”). Last updated: 20 July 2026.
1. Data Controller
The controller under the EU General Data Protection Regulation (GDPR) is:
Stefan Zechmeister Loidoldgasse 4 Top 10 1080 Vienna, Austria Email: admin@sportscartour.com
2. General
2.1 Scope of processing
As a rule we process personal data only to the extent necessary to provide a functional App and the features it offers.
2.2 Legal bases
Depending on the purpose, the legal bases are Art. 6(1)(a) GDPR (consent), (b) (performance of a contract / pre-contractual steps) and (f) GDPR (legitimate interest).
2.3 Retention and deletion
Personal data is deleted as soon as the purpose for storing it no longer applies — in particular when you delete your account — unless statutory retention obligations require otherwise.
2.4 No tracking, no advertising
The App uses no advertising, no app tracking, and no third-party analytics/tracking services, and makes no automated decisions with legal effect. The App is free of charge; no payment processing takes place.
3. Data you enter and upload in the App
3.1 Scope
- Account data: email address and password (the password is stored only in encrypted/hashed form by our authentication provider, see section 6) and your display name.
- Profile data: name, a short self-description, and car details (make, model, power, colour) plus — optionally — a profile photo and a car photo.
- Tour content: tours, days, stops, hotels, sponsors, GPX route files and an optional WhatsApp group link created by organisers; your participation in tours and your votes on stops.
- Invitations: when an organiser creates an invitation, the email address they enter for the invited person is stored so that person can be granted access to the relevant tour.
3.2 Legal basis
Art. 6(1)(b) GDPR (performance of the usage agreement); for uploading photos, additionally Art. 6(1)(a) GDPR (consent, given by actively uploading them).
3.3 Purpose
Authenticating your account, providing the App’s features, and displaying your profile and tour content to the other participants of the relevant tour.
3.4 Retention and objection
The data is stored until you delete your account. You can delete your account directly in the App at any time (Profile → Delete account); this permanently removes your profile, the tours you organise, and your votes and memberships. Alternatively, a message to the contact details in section 1 is sufficient.
4. Photos and images
When you upload a profile or car photo (and, in future, tour photos), those images are stored in our storage (see section 6) and shown to the participants of the relevant tour. Images may contain technical metadata (e.g. capture time) before upload. Please only upload images you have the necessary rights to and — where people are depicted — for which you have their consent. On iOS the App uses the system photo picker to select images; we only receive the specific images you choose.
5. Provision of the App and server log files
When you use the App, technically necessary connection data is processed, in particular the IP address, the date and time of the request and status information. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing, stabilising and securing the App). These logs are stored only briefly and then deleted.
6. Hosting and data processing (Supabase)
The App’s backend, database, authentication and file storage are operated via Supabase (Supabase, Inc., USA). The data described here is stored and processed in the region selected for our project EU – Frankfurt, Germany. A data processing agreement (Art. 28 GDPR) is in place with Supabase. As Supabase, Inc. is headquartered in the USA, access from a third country in the context of maintenance and support cannot be fully excluded; any such access is safeguarded by appropriate measures within the meaning of Art. 46 GDPR (EU Standard Contractual Clauses). The legal basis is Art. 6(1)(b) and (f) GDPR.
7. Distribution via the App Store (Apple)
Downloading and updating the App, as well as beta distribution, take place via Apple (App Store and TestFlight, Apple Inc.). The data processed by Apple in this context (e.g. Apple ID, download information) is Apple’s responsibility; Apple’s privacy policy applies.
8. WhatsApp group link
Individual tours may include a link to a WhatsApp group. If you tap this link you leave the App and are taken to WhatsApp (Meta Platforms Ireland Ltd.); the privacy policy of WhatsApp/Meta applies to any processing there. Use is voluntary.
9. Provision of the website
When you visit the website sportscartour.com, the hosting provider processes technically necessary access data (e.g. browser type, operating system, IP address, date/time of access) in server log files. The legal basis is Art. 6(1)(f) GDPR; the data is stored only briefly to ensure operation and security.
10. Your rights
You have the following rights regarding your personal data vis-à-vis the controller:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to withdraw a given consent with effect for the future (Art. 7(3) GDPR)
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
To exercise your rights, a message to the contact details in section 1 is sufficient.
11. Changes to this Privacy Policy
We will update this Privacy Policy whenever changes to the App or the legal situation make it necessary. The current version published on this page always applies.