Race Result

This is a translation. In case of divergence, the Portuguese text prevails. Read the official text in Portuguese

Privacy Policy

How the Race Result platform processes the personal data of athletes, guardians, buyers and organizers of sports events.

Version 1 · effective since October 21, 2026

1. Who we are

The Race Result platform (raceresult.app) is operated by Ayan Labs, registered in Brazil under CNPJ no. 66.418.458/0001-73, based in Belo Horizonte/MG, Brazil ("Ayan Labs" or "we"). Through the platform, organizers of sports races publish events, receive registrations and payments, run the timing and publish the results.

This policy explains which personal data we process, for what purposes, with whom we share it, how long we keep it and how you exercise your rights, under the Brazilian General Data Protection Law (Law no. 13.709/2018, "LGPD"). It applies to athletes, to anyone who registers another person (buyer), to the legal guardians of athletes under the age of majority, to organizers and to the members of their teams.

Channel for privacy matters, for exercising data subject rights and for contacting the person in charge of personal data processing (data protection officer): contato@raceresult.com.br.

2. Who decides about the data: the organizer and Ayan Labs

For the registration, the timing and the publication of the results of an event, the controller of the data is the event organizer: the organizer defines the event, the rules, what the registration asks for and how the list of entrants is used. In these activities, Ayan Labs acts as a processor: it processes the data on behalf of the organizer, following the organizer's instructions and the platform's Terms of Use.

Ayan Labs is a controller when it processes data for its own purposes: the platform access account; security and the prevention of fraud and abuse; the athlete's sports history, which links results from different events through the RACE_ID identifier; the platform's own communications; and compliance with its legal and regulatory obligations.

For matters about the data of a specific event, you may also contact the organizer of that event. When a request reaches us and concerns data for which the organizer is the controller, we forward it to the organizer and support the response.

3. Which data we process

Event registration. About the athlete: name; date of birth; sex or gender, according to the options of the event's country (including "Prefer not to say"); nationality and country of residence; identity document according to the rule of the event's country (in Brazil, the CPF; for foreigners, a passport or national identity document), and a child may be registered without their own document, with the guardian's document; contact email and mobile phone; team; and whatever the event asks for, such as course, category, bicycle type, shirt size and discount coupon. The registration receives a bib number and may receive the code of a timing chip.

Guardian of an athlete under the age of majority: full name, relationship (parent, legal guardian or authorized adult), mobile phone, email and, when the event's country requires it, identity document (in Brazil, the CPF; for foreigners, a passport or national identity document).

Team members (Fitness Race): in a team registration, the athlete of the registration is member 1, and whoever registers provides the team name, the full name of each of the other members and, if they wish, the email of each one (used only to send them the result). This is third-party data provided by whoever registers, who declares that all members know the event rules and are 18 or older or, if under the age of majority, that their legal guardian authorized their participation and the publication of their full name in the result; members do not provide an age, a date of birth or a document. The event organizer may correct or replace the members.

Acceptances and acknowledgment: the documents accepted in the registration (rules, liability waiver and guardian authorization) and the acknowledgment of this policy, each with the version of the document and the cryptographic digest (hash) of the text, who confirmed it (the athlete, the guardian, the person who made the registration or the organizer), the date and time and the language.

Registration made by the organizer: when the organizer enters a registration manually or by spreadsheet, the data comes from the organizer, who declares having collected the acceptances.

Payment: amounts, payment method (card or Pix), payment status, refunds and payouts. Card details are entered on Stripe's payment page: the platform neither receives nor stores the card number, expiry date or security code. The Pix charge does not carry the payer's name or document, and the platform does not store the payer data reported by the bank.

Timing and results: the passing records (time, point on the course and the device that recorded it), the times, the race status (for example, did not start, did not finish or disqualified), penalties, rankings and the record of the race kit pickup.

Access account: email, name, preferred language, password (stored only as an irreversible code, never the password text), the Google account identifier and its email, if you sign in with Google, the open sessions (with a description of the browser and system, without the IP address) and the account's links to athletes (yourself or your dependents under the age of majority).

Organizer: public name, country, mobile phone, logo and, when provided (they are required for paid sales), full name or legal name and CPF or CNPJ; the payout account at Stripe and the type of Pix key for payouts; and, for the people who operate the organizer and its events, the account, the role (for example, timing or check-in) and the actions recorded in the audit log. To create the payout account, the platform sends Stripe the organizer's country, full name or legal name and CPF or CNPJ, to pre-fill the registration; the address, date of birth and bank details requested for this account are provided by the organizer directly to Stripe.

Security: to protect the platform against abuse (such as repeated attempts to sign in, sign up or register), we use the IP address and the email typed only as codes derived with a secret key, without storing the IP address or the email in clear in these records. The country of origin of the connection, reported by Cloudflare, may be used to choose the language of the home page. When there are too many attempts, the registration may ask for an anti-bot check (Cloudflare Turnstile).

Strava (optional): if you connect your Strava account, the data processed, the purposes and the retention periods are on the Strava integration page (raceresult.app/en/legal/strava/v1), which is part of this policy.

What we do not collect: the platform does not ask for health data, does not collect photos or videos of athletes and does not collect the location of your device.

4. Why we use the data and on which legal basis

  1. Making and managing the registration, issuing the ticket, charging, checking the race kit pickup, timing the race, calculating the result and sending you the registration emails (for example, confirmation, ticket, pending payment, cancellation, refund and result): performance of a contract (art. 7, V, of the LGPD), the registration contract with the organizer.
  2. Using the document to identify the athlete and avoid duplicate records or confusion between different people: performance of a contract (art. 7, V) and legitimate interest (art. 7, IX). The document is kept encrypted, and the comparison is made through a derived code (blind index), without opening the document. When a registration is linked by the document to a record that already existed, the confirmation also goes to that record's main email, with the "it wasn't me" link to dispute it; and, when someone tries to register again an athlete who is already registered, the notice of the existing registration goes to that registration's contact email and to the record's main email, also with this link.
  3. Publishing the race result: legitimate interest (art. 7, IX) of the organizer and of the sports community in publishing the result, with the safeguards of section 6 (no date of birth, age, document or contact details, and the name of a registered athlete under the age of majority shown only as initials).
  4. Keeping the athlete's sports history, which links results from different events to the same RACE_ID: legitimate interest (art. 7, IX) of Ayan Labs, for an indefinite period. You may object, and the objection is met by anonymization (section 9).
  5. Processing the data of team members (name and, if provided, email) for the registration, the timing and the result of the race they take part in: the same bases as the registration (performance of a contract, art. 7, V) and the publication of the result (legitimate interest, art. 7, IX); the member's email is used only to send them the result email, with the link to the result page and, when available, to the card.
  6. Accounts, sign-in, security, prevention of fraud and abuse and auditing of actions on the platform: performance of a contract (art. 7, V) and legitimate interest (art. 7, IX).
  7. Payments, refunds, payouts to organizers, tax invoices and financial records: performance of a contract (art. 7, V) and compliance with a legal or regulatory obligation (art. 7, II).
  8. Emails from the organizer about its next editions and other events: legitimate interest (art. 7, IX), with a notice in the registration and, in every message, a link to stop receiving them.
  9. Promotion, by the platform, of events of other organizers, offers from the sponsors of the organizer's events and WhatsApp messages about the organizer's next editions and other events: consent (art. 7, I), given in the optional boxes of the registration, which are unchecked by default. Sponsors do not receive your data. You may withdraw your consent at any time, without affecting the registration.
  10. Complying with legal obligations and exercising rights in judicial, administrative or arbitral proceedings: art. 7, II and VI.

Today the platform does not yet send marketing communications: the choices made in the registration are recorded, with the version of the text shown, for when sending exists. Nor do we send WhatsApp or SMS messages today. If we start sending registration notices via WhatsApp, this will depend on a separate option, and this policy will be updated beforehand.

5. Athletes under the age of majority

An athlete is under the age of majority when, on the date of the event, they are younger than the age of majority of the event's country (18 in Brazil). The registration of a minor requires the details of a guardian and the Guardian Authorization (raceresult.app/en/legal/guardian/v1), and the registration acceptances are given by the guardian. We process the data of children and adolescents in their best interest (art. 14 of the LGPD).

On the public pages (results, live results, results screen, mobile version and the public list of entrants), the name of a registered athlete who is under the age of majority appears only as initials (for example, "A. M. S."); in a team, this rule applies to the athlete of the registration (member 1), and, if they are under the age of majority, all members appear only as initials. The other team members (2 to 4) do not provide an age and appear with their full name, as typed in the registration: whoever registers declares that they are 18 or older or, if under the age of majority, that their legal guardian authorized their participation and the publication of their name. Today there is no option to show the minor's full name; if it is created, it will only apply with the guardian's express choice in the registration. No athlete's date of birth or age is published.

The event organizer sees the minor's full name and the guardian's details, as controller, to run the event. At the race kit pickup, the check-in team sees the guardian's name and mobile phone.

A contact that belongs only to the minor never receives marketing communications: the communication choices in a minor's registration apply to the guardian's email. We do not profile children and adolescents or target advertising at them. If we start sending registration notices via WhatsApp, those of a minor will go to the guardian's mobile phone, never to the minor's.

The guardian's account is linked to the minor as guardian when the guardian, signed in to their account, registers for the first time a minor who did not yet have a record, or when they request the link in the Athlete area (Add dependent), proving that the account's email is verified in the minor's record or was the guardian email in one of the minor's registrations; this link ends automatically when the minor reaches the age of majority.

Races sanctioned by a federation: the platform does not publish the athletes' dates of birth. When the federation's rules require the full list of participants, it is the organizer, as controller, who sends it to the federation.

6. What is public

Event page: the event information and, about the organizer, the public name, the logo and, if the organizer chooses, a public contact email and phone.

Results (result pages, live results, results screen, mobile version, public results lookup and the result image the athlete can download; in the Fitness Race, also the detail page and the comparison between athletes or teams): name (for a registered athlete under the age of majority, only the initials; in a team, the full name of each member, as provided in the registration, or all only as initials, if the athlete of the registration is under the age of majority), bib number, team, course, category, gender used in the ranking, bicycle type (when provided in the registration), stage or segment times and total time, position (including per segment), pace and comparisons with the other participants, race status, penalty added to the time and, during the race, the segment the athlete or team is in. Never published: date of birth, age, document, email, phone, guardian details, payment details and the reason for a penalty or disqualification.

Public list of entrants: only shown if the organizer turns it on, with name (for an athlete under the age of majority, only the initials), course, category, team and bib number.

The public pages of events and of official results may be found by search engines.

The ticket is opened through a secret link sent by email (raceresult.app/t/…). Anyone who has the link can see the ticket: do not share it.

7. With whom we share data

With the event organizer: the registration data of its event, including the details of the minor's guardian, the team members and the acceptances, through the dashboard and the spreadsheet export (the document appears only with its last two characters). The members of the organizer's team see what their role allows: the check-in team sees name, number, category, whether the athlete is a minor and the guardian's name and mobile phone, without email or document.

With the suppliers that help us operate the platform, as processors, only as needed for each service:

  1. Cloudflare: hosting, database, files, queues, protection against attacks, anti-bot check (Turnstile) and access control for the administrative team;
  2. Stripe: card payments and the organizers' payout accounts (Stripe Connect). For a payment, it receives the amount, the description of the purchase and the contact email, to pre-fill the payment; card details are entered directly on Stripe, which may send its own receipt to the email provided. For the payout account, it receives from the platform the organizer's country, full name or legal name and CPF or CNPJ, to pre-fill the registration, and the rest is provided by the organizer directly to Stripe;
  3. Banco Inter: Pix charges (without the payer's name or document) and payouts to organizers through their Pix key (CPF or CNPJ);
  4. Resend: sending the platform's emails (the destination address and the content of the message);
  5. Google: sign-in with a Google account. The sign-in page loads Google's button for anyone who opens it, and Google may receive technical data about the connection, under its own policy; the Google account and its email only reach the platform if you choose to sign in that way;
  6. Strava: only if you connect your account (section 3).

With public authorities, when required by law or by a court order, and to exercise rights in proceedings.

We do not sell personal data, and sponsors do not receive the list of entrants.

Access by the Ayan Labs team: the administrative team, with restricted access and its own authentication, may consult and process the data needed to approve and block organizers, provide support, ensure security, merge duplicate records, respond to data subject requests and operate the platform's finances (approve and record payouts, make the refunds that fall to the platform and check payments with the providers). An athlete's full document and the organizer's CPF or CNPJ (the latter, to send the payout by Pix) are only revealed for a recorded reason, with an audit log.

Support to the organizer: to solve a problem reported by the organizer, the team may access the organizer's dashboard through a temporary support session (up to 8 hours). In this session, the team may do what the organizer would do in the dashboard and in the account's Athlete area (with the athletes and dependents linked to it), including seeing the registration data and the financial screens, but it does not change the payout accounts (Stripe, Pix), does not request payouts and does not make refunds. The start and end of the session, each change made in it and the spreadsheet exports are recorded (who accessed, when and what was done); consultations are not recorded one by one. The session appears in the organizer's list of sessions, and the organizer can end it.

8. International transfer

Cloudflare, Stripe, Resend, Google and Strava may process personal data on servers outside Brazil, including in the United States. These transfers rely on art. 33 of the LGPD, with the standard contractual clauses approved by the ANPD, the Brazilian Data Protection Authority (Resolution CD/ANPD no. 19/2024), or equivalent safeguards offered by the supplier.

9. How long we keep data and how we delete it

  1. Payments, refunds, payouts and ledger: at least 5 years (tax and accounting obligations). These records do not keep name, contact details or document: they are linked to the registration by internal identifiers.
  2. Details of the minor's guardian: anonymized 3 years after the event (the limitation period for civil liability claims), by a monthly automatic routine. The document of an athlete under the age of majority is deleted 3 years after the last event they registered for as a minor; if they register again, the document remains in use.
  3. Registration data (contact details, shirt, coupon and the other form data) and its acceptances: up to 5 years after the event; afterwards, they are deleted or anonymized, keeping the sports result and the financial records.
  4. Email of team members: deleted 3 years after the event, by the same monthly automatic routine; the name follows the registration and the result.
  5. Result and sports history (RACE_ID): no time limit, except in case of objection or deletion (below).
  6. Authentication records (sign-in, sign-up and password reset attempts, without email or IP address in clear): 180 days. Closed or expired sessions, password reset codes and activation links: deleted 30 days after being used or expiring.
  7. Events received from payment providers: 90 days after being processed.
  8. Access account and organizer data: for as long as the account or the organizer exists and, afterwards, for the period of the legal obligations.
  9. Strava: the periods on the Strava integration page.

Deletion: the request can be made in the Athlete area (raceresult.app/en/me), on the page of each athlete, or by email to contato@raceresult.com.br. The request is reviewed by the Ayan Labs team, which anonymizes the athlete's name, contact details and document. What remains is the RACE_ID, the result under the name "Anonymous athlete" (the positions of the other athletes do not change) and the financial records required by law. A request made in the Athlete area disconnects Strava immediately. After the deletion, we may keep only an irreversible code derived from your email, without the email itself, to make sure you do not receive marketing communications again.

10. Your rights

Under the LGPD (art. 18), you may request: confirmation that we process your data and access to it; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law; portability; deletion of data processed with your consent; information about with whom we share the data; information about the possibility of not giving consent and its consequences; and withdrawal of consent. You may also object to processing based on legitimate interest.

In the Athlete area (raceresult.app/en/me) you can already: see the athletes and registrations of your account; correct name and contact details (date of birth, gender and document can be corrected while there is no race already held; afterwards, through support, because they would change published results); export the data (record, contact details, registrations and acceptances, in a JSON file); and request deletion. Other requests, including those of team members (who do not make the registration), are handled through the email contato@raceresult.com.br, within the periods of the LGPD. We may ask for information to confirm your identity before responding.

You may also file a complaint with the Brazilian Data Protection Authority (ANPD).

11. Security

The identity document is never stored as plain text: it is encrypted, and searches are made through a code derived with a secret key. The password is stored only as an irreversible code. The connection to the platform is encrypted (HTTPS), the session cookie is protected against access by scripts, and the platform's technical logs do not carry name, email, phone, document or date of birth. The administrative area requires additional authentication.

No system is completely invulnerable. If a security incident occurs that may cause relevant risk or harm to data subjects, we will notify the ANPD and the affected data subjects, as required by the LGPD.

12. Cookies and browser storage

We only use cookies that are necessary for the platform to work, with no advertising cookies and no third-party analytics tools:

  1. __Host-rr_session: keeps you signed in (at most 30 days, or 7 days without use);
  2. __Host-rr_gnonce: protects sign-in with Google (10 minutes);
  3. rr_locale: stores the language you chose (1 year);
  4. __Host-rr_tv_ followed by the event code: unlocks the organizer's results screen on the TV device (for the validity of the results screen link).

The timing app used by the organizer's team stores the timing records on the device itself, so that it works without internet until they are sent. The sign-in page loads Google's sign-in button, and the registration may load Cloudflare's anti-bot check; these services follow their own policies.

13. Changes to this policy

When this policy changes, the new version will receive a new number and an effective date, and the previous versions will remain available at their own address (for example, raceresult.app/en/legal/privacy/v1). Relevant changes will be announced on the platform or by email.

14. Contact and language

Ayan Labs, CNPJ 66.418.458/0001-73, Belo Horizonte/MG, Brazil. Privacy, data subject rights and data protection officer: contato@raceresult.com.br.

This document is drafted in Portuguese. The English version is a translation; in case of divergence, the Portuguese version prevails.