LDX Rally privacy notice

Effective October 26, 2026 · Version 2026-10-26-v1

Operator: LDX Allied Tech, using LDX Sports as the rally-service brand. Contact: [email protected].

Who operates the service

LDX Allied Tech operates the LDX Rally scoring application and Rider Portal under the LDX Sports brand. Questions about this service or your information should go to [email protected]. Corporate and non-motorcycle development work is a separate contact function; it does not replace the rally support address.

Information we process

We process the information needed to provide an account and administer a rally:

• Your name, preferred name, email, phone and country; optional address/profile information you provide; and any membership or finisher numbers you claim.
• Rally enrollments, rider numbers, motorcycle details, check-in/out and odometer records, submitted answers/notes and evidence files such as photos, audio or video when the relevant rally feature supports them.
• Original evidence metadata, including available capture/submission times, camera/EXIF details, OCR output, precise location and accuracy, odometer/timer information, revisions, scoring outcomes and corrections.
• Tracking points collected during an authorized rally tracking window after you start tracking and grant the required device permissions. Points can be stored on the phone while offline and uploaded later. Supported background tracking may continue with the screen locked until stopped or the tracking window ends.
• Account verification, password hashes, sessions, device/push registrations, support/recovery records, and operational diagnostics such as device/app versions, event times, error codes and related record identifiers.

Claiming an IBA or IBR number does not itself verify membership or grant access to someone else’s history. The account uses its own permanent internal identity.

Why we use it and who can see it

We use this information to authenticate users, keep rally history associated with the correct person, accept and review evidence, calculate or correct scores, provide tracking/safety operations, deliver service messages, investigate issues, prevent abuse, and fulfill support and data requests.

Your Rider Portal history and downloads require authentication. Authorized rally staff can access information needed for their rally duties; restricted identity resolution and recovery decisions are reserved for the designated owner.

Rally results and any organizer-enabled public display are distinct from private account access. Some rally configurations support a delayed public rider map with rider labels and delayed positions. Account registration alone does not enable a public map. The particular rally’s display settings will be explained before riders provide tracking for that purpose.

Service providers and optional external services

The service uses hosting/database/private object-storage infrastructure and transactional email. Current deployment uses DigitalOcean infrastructure and Brevo for transactional email; business support mail uses Google Workspace. Device push notifications use Firebase when enabled. Maps, address lookup, weather, speed-analysis and external navigation features may contact the configured provider with the information that feature needs, including relevant coordinates. Those providers may receive ordinary network/device information.

Compromised-password screening uses Have I Been Pwned’s range lookup: only the first five characters of a SHA-1 password hash are sent, with the matching suffix comparison performed locally. The password and complete hash are not sent to that service. Account passwords are stored as password hashes, not plaintext.

The current native OCR path uses device text recognition. The shared OCR service referenced in development documentation is not an implemented cloud integration or permission to upload evidence to a new OCR provider. Any future provider or materially different evidence use needs its own implementation and notice review.

We do not sell or rent personal data, use rider evidence for unrelated advertising, or permit unrelated model training. Required service-provider processing and a rider’s own export are separate uses.

Retention, exports and preservation

Our operating targets are:

• Rally evidence files: five years after confirmed rally closure.
• Detailed rally GPS: one year after confirmed rally closure.
• Essential results and identity/history links: long-term.
• Sensitive recovery attachments, if collected: 90 days after case closure unless an unresolved matter requires preservation. Current assisted-recovery forms store restricted evidence references rather than accepting attachments.

These are operating targets, not a claim that a particular law requires those periods. Original-record deletion is not currently active. Before introducing it, we will implement advance notices, handling for failed/unconfirmed delivery, preservation holds and audited deletion controls. We will provide at least 60 days of advance notice before source deletion. An unresolved preservation hold prevents deletion of its covered records.

You can download server-received rally photos and a multipart rally archive from the Rider Portal. The archive includes manifests, relevant submission/checkpoint records and tracking CSV/GPX. Download every ZIP part and check for missing-file warnings. Unsynced phone work, account portraits, staff/reference assets and external provider histories are outside that rally archive. Generated ZIP access expires after seven days; this does not delete the original rally records.

Your choices and requests

You can update supported profile fields, request exports, stop optional tracking, and control device permissions. Some functions cannot work without the necessary information or permissions; permission changes do not erase data already stored.

Contact [email protected] to request access, correction, preservation or deletion, or to raise a privacy concern. We verify identity and authority before disclosing information or changing account access. Ordinary authenticated email changes use the verified self-service flow. If you cannot sign in or receive mail at the old address, owner-assisted recovery requires independent review.

We may need to preserve essential results, security/audit history or records for an unresolved matter. We will explain applicable limits rather than promise that an account request erases every historical record. Additional rights may apply where you live; contact us to exercise them or question a request decision.

Security, intended audience and updates

We use access controls, encrypted transport, password hashing and restricted administrative access. No service can guarantee uninterrupted availability or absolute security. Do not send passwords, verification codes or authenticator keys in a support message. Use the protected account forms.

The rally service is intended for motorcycle-event participants and staff, not directed to children under 13. Contact support if you believe a child has provided information. Event eligibility remains governed by the particular rally’s rules.

We will identify the approved notice version/effective date and explain material changes before applying a materially different use to existing information.