Privacy Policy

PURPL runs on your driving data, so it is worth being exact about what that means. This page says what we collect, why we are allowed to, who else touches it, and how to get it back or have it deleted.

1. Who is responsible for your data

The data controller is Solox LTD. (Single-member limited liability company (EOOD)), registration number (UIC) 206020638, Bulgarian Commercial Register (Registry Agency), registered at 27 William Gladstone Str., Triaditsa, 1000 Sofia, Bulgaria. PURPL is its trading name.

For anything on this page — a copy of your data, a correction, an erasure, or just a question — email info@purpl.app. A person reads it.

2. What we collect, and why

Account data

Your email address, name and profile picture, received from Google when you sign in. We ask Google for your email address and basic profile only — nothing else in your Google account is visible to us. Legal basis: performance of our contract with you (Art. 6(1)(b)) — you cannot have an account without it.

Your telemetry and sessions

The files you upload from your data logger and everything derived from them: lap and sector times, GPS traces, speed, RPM, temperatures, accelerometer data, plus the track, driver, kart and class names you enter yourself. Also the analysis built on top — corner deltas, theoretical-best laps, session scores — and the AI coaching reports. Legal basis: performance of our contract with you (Art. 6(1)(b)).

Driver names are personal data. If you enter a name that is not yours — a team-mate's, or your child's — you are responsible for it being fair to do so.

Billing data

Your plan, your subscription status, and the customer and subscription references Stripe gives us. We never receive your card number. Stripe collects and holds payment details directly. Legal basis: performance of our contract (Art. 6(1)(b)), and our legal obligation to keep accounting and tax records (Art. 6(1)(c)).

Product events

A short, fixed list of nine events — a file was parsed, sign-in started, sign-up completed, a report was requested, a paywall was shown, a share link was created, checkout was opened, an upload failed, an anonymous session was viewed. The list is closed on purpose and does not grow with every feature. When you are signed in these are recorded against your account id; when you are not, they carry no identifier. They tell us whether the product works, not what you drove. Legal basis: our legitimate interest in understanding and fixing our own product (Art. 6(1)(f)).

Support correspondence

Emails you send us and our replies. Legal basis: performance of our contract, and our legitimate interest in answering you (Art. 6(1)(b) and (f)).

Technical logs and error reports

Standard server request logs from our host, and crash reports from our error monitor. The error monitor is configured to strip IP addresses, email addresses, cookies, request headers and request bodies before anything leaves your browser, and it does not record your screen. Legal basis: our legitimate interest in keeping the service secure and working (Art. 6(1)(f)).

Analytics on these marketing pages

The public pages at purpl.app (this one included) load Google Analytics on the production site. That is separate from the product events above and uses cookies.

3. Who processes your data for us

We use a small number of service providers. They act on our instructions and may not use your data for their own purposes. We do not sell your data to anyone, and we do not use your telemetry or your coaching reports to train AI models.

4. AI coaching, specifically

When you ask for a coaching report or use the coach chat, the relevant parts of your session — lap and corner data, the numbers the report is about — are sent to Anthropic's API to generate the answer. This happens on our servers; your browser never talks to Anthropic and never holds an API key. The generated report is stored on your account so you can read it again.

Anthropic processes it as our provider under its commercial API terms and does not train models on it.

5. Transfers outside the EU

Some of the providers above are based in, or route data through, the United States. Where that happens, the transfer relies on the European Commission's standard contractual clauses or an adequacy decision, together with the provider's own safeguards.

6. How long we keep it

Your account, sessions and reports are kept for as long as your account is open. You can delete individual sessions in the product yourself at any time. When you ask us to delete your account, we delete your account data and your sessions.

Invoices and payment records are kept for as long as tax and accounting law requires us to, even after an account is closed.

7. Your rights

Under the GDPR you can ask us to:

• Give you a copy of the personal data we hold about you (access).
• Correct anything that is wrong (rectification).
• Delete it (erasure) — subject to records we are legally required to keep, such as invoices.
• Restrict or object to processing we do on the basis of legitimate interest, including the product events described above.
• Take it with you in a portable, machine-readable form (portability).
• Withdraw consent where we relied on it, without affecting what happened before.

Portability is not something you have to ask for. PURPL has a one-click export built in: from the app you can download everything as JSON, or as CSV for a spreadsheet. It is on every plan, it is free, and it keeps working after you cancel. Taking your data out is not a feature you buy back.

For anything else, email info@purpl.app from the address on your account. We answer within one month, as the GDPR requires, and usually much sooner. There is no charge.

8. Cookies and local storage

The product app stores your sign-in session in your browser's local storage — without it you would be signed out on every page load. It also remembers interface preferences locally. These are necessary for the service to work.

These marketing pages additionally load Google Analytics on the production site, which sets its own cookies. See the note in section 2.

9. Children

Karting starts young. Accounts are for adults: a minor's data should be in PURPL only under an account held by a parent or guardian, who is responsible for it. If you believe a child has an account of their own, email info@purpl.app and we will deal with it.

10. Security

Your data is isolated per account at the database level, every read of your own data is authenticated as you, and secrets — payment keys, AI keys — exist only server-side and never in the browser. No system is perfect; if you find a hole, email info@purpl.app and we will take it seriously.

11. Complaints

If you think we have handled your data badly, tell us first — info@purpl.app. You also have the right to complain to a data protection authority. Ours is the Commission for Personal Data Protection (CPDP), Bulgaria, and you can equally complain to the authority in the EU country where you live.

12. Changes to this policy

If this policy changes, the date at the top changes with it. If a change matters to you — a new processor, a new purpose — we will tell you rather than quietly re-dating the page.