PrivacyPolicy

The controller of personal data is Connexa Studios, based in Italy. For any privacy-related request you can write to privacy@telos.connexastudios.com.

We collect the following categories of data:

• Registration data: first name, last name, email address, password (hashed with bcrypt)
• Social sign-in data: if you use Google OAuth, we receive the name, email and profile photo provided by Google
• Game and prediction data: your race picks, Gridle results, league memberships, referral codes and the preferences you set (favourite driver, alerts)
• Questions to the AI assistant: the text you type into Ask or the AI analyst, so it can answer you
• Usage data: pages visited, events (for example a click on a plan), a session identifier, referrer, approximate country and browser user agent. It is collected by our own first-party tracker; the IP address is stored only as a one-way hash
• Technical data: IP address, browser type, operating system (for security and abuse prevention)
• Push notification data: if you enable notifications, the technical endpoint your browser gives us
• Messages you send us: the content of emails you write to our support addresses

TELOS Sim Bridge (desktop app for EA SPORTS F1 25), only if you use it and connect it to your account:

• Lap telemetry: speed, throttle, brake, gear and position along each valid lap, with the session, circuit and the racing name you choose. Uploaded laps can appear on the weekly hotlap boards and on your public driver card under that name
• Voice questions: when you hold the push-to-talk button with "Talk freely to your engineer" on, the recording made while you hold it is sent to us and to Groq to be transcribed and answered, together with numbers about your current race. The audio is not stored
• Live sharing: if you turn on "Share my races live", your race state (map position, timing, radio lines) is visible to anyone with your link; it is deleted within 2 hours. Messages and predictions viewers send are filtered and kept only with that live session
• App health: every 5 minutes the app sends its version, whether it receives game data, the game's telemetry settings and which features are on, so we can help when it doesn't work. Crash reports are anonymous and can be switched off in the app
• Everything else (race recordings, highlight videos, your per-circuit history and the coach) stays on your PC

We don't collect or store card numbers. Payments are handled by Stripe; we receive only your plan status, a Stripe customer reference and the outcome of the payment.

Your data is used to:

• Create and manage your account on the platform
• Provide you with the Service's features (dashboard, telemetry, calendar)
• Send you service communications (verification, password reset, receipts, important updates)
• Send the alerts and emails you ask for, such as pick reminders, race briefings and the weekly digest; each has an unsubscribe link or a setting
• Grade predictions and run leaderboards, leagues and referral rewards
• Answer your questions through the AI assistant
• Improve the platform through aggregated, anonymized analysis
• Prevent fraud and ensure the security of the Service

We don't use your data for third-party advertising.

The processing of your data is based on:

• Performance of a contract (Art. 6.1.b GDPR) — necessary to provide you with the Service
• Consent (Art. 6.1.a GDPR) — for optional communications such as the newsletter, and for push notifications
• Legitimate interest (Art. 6.1.f GDPR) — for security, fraud prevention and first-party measurement of how the product is used
• Legal obligation (Art. 6.1.c GDPR) — for accounting and tax records of any payment

What the site stores in your browser:

• Session cookie: keeps you signed in and protects forms against forgery. Necessary, no consent required
• Referral cookie (telos_ref): remembers who invited you until you register
• Layout cookie (telos_ia): remembers which version of the site navigation you see, up to 180 days
• Consent choice (telos_cookie_consent, in local storage): remembers your answer to the cookie banner
• Session identifier (in session storage, cleared when the tab closes): lets our first-party tracker stitch one visit together

Our analytics is first-party: it sends events only to our own server and uses no cookie and no third-party script. Stripe may set its own cookies on its checkout page.

We don't use third-party advertising-profiling cookies.

Your data is retained for the entire duration of your account and for a maximum period of 12 months after deletion, except where legal obligations require longer retention.

Security and access logs are deleted after 90 days.

We don't sell your data. We may share it exclusively with:

• Hostinger — hosting, database and the mailbox service that sends our emails
• Stripe — payments and the billing portal (Stripe's Privacy Policy)
• Google LLC — Google sign-in and Google Fonts, which displays the site's typefaces (Google's Privacy Policy)
• Groq, Inc. — the AI provider that processes the text of your questions to the AI assistant and, in the TELOS Sim Bridge, the voice questions you ask your race engineer (audio transcribed and not stored by us). Don't type or say personal or sensitive information
• Browser push services (such as Google, Apple, Mozilla) — to deliver the notifications you enabled
• Competent authorities — only if required by law

Transfers outside the EEA. Some of these providers are based in the United States. Where that happens we rely on the safeguards they offer, such as the EU–US Data Privacy Framework or Standard Contractual Clauses.

As a user you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — the "right to be forgotten" — remove your account and all associated data
• Portability — receive your data in a readable format (JSON/CSV)
• Objection — object to processing based on legitimate interest
• Withdrawal of consent — at any time for consent-based processing

To exercise these rights write to privacy@telos.connexastudios.com. We will respond within 30 days. You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.

We adopt technical and organizational measures to protect your data:

• Encrypted connections via HTTPS/TLS
• Passwords hashed with bcrypt (never in plain text)
• Database access limited to authorized personnel
• Regular backups of the database

We may update this policy to reflect changes to the Service or to regulations. In case of significant changes we will send you an email notification at least 15 days before they take effect.