Privacy Policy
Last updated: August 5, 2026
1. Controller
Martin KünstlingMenckestraße 3904155 LeipzigGermanyEmail: hello@racelume.com2. Hosting and website delivery
This website is hosted and delivered through Lovable. When the website is accessed, the hosting infrastructure may technically process connection information such as IP address, time of the request, requested resource, browser information and operating system information.
This processing is necessary to provide the website securely and reliably. It is based on Article 6(1)(f) GDPR (legitimate interest in secure and stable operation).
3. Local processing of result files and images
Result files (CSV, XLS, XLSX) and uploaded images are processed locally in the visitor's browser.
This can include participant names, bib numbers, clubs, categories, rankings, finish times, event logos, sponsor logos and background images.
RaceLume does not intentionally transmit these files to its own database and does not permanently store them. Closing or refreshing the application can remove temporary data.
Event organizers and other uploaders remain responsible for ensuring that they have a lawful basis for using participant data and images.
4. Accounts and sign-in
The editor can be used without an account. An account is only required to purchase the Organizer Pass and to download watermark-free files.
Accounts, sign-in and session handling use Lovable Cloud backend infrastructure (technically operated on Supabase). The data processed includes your email address, a password hash or the identifier of the sign-in provider used, registration and sign-in timestamps and technical session data.
If you choose “Continue with Google”, sign-in takes place through Google. Google learns that a sign-in to RaceLume is occurring; RaceLume receives your email address and an account identifier from Google.
The legal basis is Article 6(1)(b) GDPR (performance of the user agreement) and Article 6(1)(f) GDPR for account security.
At sign-up and at purchase we additionally store which version of these Terms of Service you accepted and when. The legal basis is Article 6(1)(b) and (f) GDPR (evidence of the contractual basis).
5. Payments and Merchant of Record (Paddle)
The RaceLume 30-Day Organizer Pass is sold through Paddle. The relevant Paddle entity acts as Merchant of Record. The contracting Paddle entity depends on the buyer's location, as described in Paddle's current Buyer Terms. Paddle conducts the order process, is your counterparty for payment, and handles tax remittance, invoicing and refunds.
Payment data (for example card or PayPal details, billing address, tax and location information) is collected and processed directly by Paddle. RaceLume does not receive complete payment details.
RaceLume transmits your email address and an internal user identifier to Paddle so that the purchase can be attributed to your account. From Paddle, RaceLume receives the transaction identifier, status, timestamp and amount of the payment.
The legal basis is Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (statutory retention and tax obligations).
6. Access entitlement
After a confirmed payment, RaceLume stores an entitlement record containing your user identifier, the payment provider's transaction identifier, the purchase timestamp and the start and end of the 30-day access period.
This record is necessary to provide you with watermark-free downloads. It contains no payment instrument data.
If a payment is refunded, reversed or charged back, the associated access is revoked.
7. Browser storage
Result files, uploaded images, branding and event details are processed locally and kept only in the page's volatile memory; they are lost when the tab is reloaded or closed.
For sign-in, a session token is stored in browser storage (localStorage) so that you stay signed in. When signing in via a redirect, the current editing state may be briefly saved in sessionStorage so your work is not lost; that snapshot is removed once you return.
An interface-language preference was previously stored in localStorage (key “racelume-interface-language”, formerly “finishframe-interface-language”). The interface is now English only, so these keys are removed once on start-up and never written again.
No storage is used for advertising, analytics or user profiling.
8. Technically necessary security cookie (Cloudflare)
The Lovable hosting infrastructure uses Cloudflare, which may set the cookie “__cf_bm”. It is used for bot detection and to protect the website against automated abuse.
RaceLume does not use this cookie for advertising and does not use it to build visitor profiles. According to Cloudflare it expires after approximately 30 minutes of continuous inactivity.
The legal basis is Article 6(1)(f) GDPR (legitimate interest in secure operation). No consent banner is used for technically necessary security storage.
9. Email contact
When you contact RaceLume at hello@racelume.com, your email address, the content of your message and any voluntarily supplied information are processed in order to answer your inquiry.
The legal basis is Article 6(1)(b) GDPR for contractual and pre-contractual communication, and Article 6(1)(f) GDPR for other legitimate business inquiries.
Messages are retained only as long as required to process the inquiry and to comply with applicable legal retention obligations.
Email forwarding for this address is provided through Spaceship, and the destination mailbox is operated through Google/Gmail. These providers may process data outside the EU or EEA. Details concerning their processing and the safeguards they apply can be found in their respective privacy policies.
10. No analytics or advertising
The current version of RaceLume does not use:
- analytics
- advertising trackers
- newsletter tracking
- automated profiling
- automated decision-making
- AI services
- a server-side participant database
11. Retention
RaceLume does not define a server-side retention period for locally processed result files and images, because they are not intentionally received or stored by RaceLume.
Account and entitlement data is stored for as long as the account exists. After account deletion it is removed unless statutory retention obligations apply; purchase-related records may be retained for up to ten years.
Emails are deleted once the inquiry has been completed and no legal retention obligations apply any longer. Where such obligations exist, immediate deletion is not possible.
12. Your rights
Under the GDPR you have the right to:
- access (Article 15 GDPR)
- rectification (Article 16 GDPR)
- erasure (Article 17 GDPR)
- restriction of processing (Article 18 GDPR)
- data portability (Article 20 GDPR)
- object to processing (Article 21 GDPR)
- withdraw consent where processing is based on consent (Article 7(3) GDPR)
- lodge a complaint with a supervisory authority (Article 77 GDPR)