Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how PitPath UG (haftungsbeschränkt) ("we", "our", "us") collects, uses, stores and protects personal data when you visit pitpath.net.

If you have questions about this Privacy Policy or how we process personal data, you can contact us at:

1. Who We Are

PitPath is a German software company developing tools, infrastructure and products for sim racing and virtual motorsport. This website presents our company, products and projects and provides a way to contact us.

For the purposes of the General Data Protection Regulation ("GDPR"), we are the controller of the personal data processed in connection with this website.

2. Personal Data We Collect

We collect and process personal data only where necessary to operate and secure this website and to respond to inquiries.

2.1 Technical and Security Data

When you visit the website, your browser automatically sends information to our hosting infrastructure. This may include:

• IP address
• Browser type and version
• Device and operating-system information
• Date and time of access
• Referrer information
• Server and error logs

We use this data to deliver the website, ensure its security and stability, troubleshoot errors and investigate unlawful attacks where necessary. Log data is retained only for a limited period.

Website delivery and content delivery (Cloudflare). All traffic to our website and services is routed through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare provides domain name resolution (DNS) for us, hosts this website using Cloudflare Workers Static Assets, delivers content through a global content delivery network, stores files (Cloudflare R2, with storage restricted to the EU using Cloudflare's EU jurisdiction setting), runs program code at the network edge (Cloudflare Workers, used to deliver our website and content delivery network) and protects our services against attacks. In doing so, Cloudflare processes in particular your IP address, the date and time of access, the requested URL, browser and device information and the transmitted content. The legal basis is our legitimate interest in providing our services securely, quickly and reliably (Art. 6(1)(f) GDPR). Cloudflare processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Processing may also take place in data centres outside the EU, in particular in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); EU standard contractual clauses (Art. 46(2)(c) GDPR) apply in addition. More information: cloudflare.com/privacypolicy.

2.2 Analytics Data

We use PostHog Cloud EU (PostHog Inc.) to understand how visitors interact with the website and to improve its content and usability. Analytics data is stored in PostHog's EU region. Requests are sent to our subdomain k.pitpath.net, a reverse proxy operated by PostHog in the EU on Cloudflare infrastructure, which forwards them to PostHog Cloud EU. Depending on how you use the site, analytics data may include:

• Pages visited
• Clicks and interactions, including the text and attributes of the clicked page element (not the content of form fields)
• Referrer information
• Approximate browser and device information
• Approximate location (country/city), derived from your IP address
• Session or event identifiers
• Error reports (error message, stack trace and page URL) if a technical error occurs on the page

Your IP address is used only to derive the approximate location and is then discarded; it is not stored with analytics events. We do not use session recording, heatmaps or surveys.

PostHog is not initialized and no analytics request is made unless you accept analytics in the consent banner. You can withdraw your consent at any time via "Cookie settings" in the site footer; analytics then stop immediately and PostHog's cookies and local storage entries are removed. You can also contact us. We do not use analytics to sell personal data or to make automated decisions that have legal or similarly significant effects.

2.3 Contact Data

If you contact us through the contact form, by email or by phone, we process the data you provide. The contact form asks for your first name, last name, email address, subject and message. We use this data to respond to and process your inquiry.

Contact-form submissions are sent to our backend and protected against automated abuse using Cloudflare Turnstile. Turnstile is only loaded once you start filling in the form. It may process technical data such as your IP address, browser and device signals to determine whether the request is made by a person. The form data is sent over an encrypted connection (HTTPS) to our backend at api.pitpath.net, which stores it in a database on a server operated by netcup GmbH in Germany. We send you a confirmation email via Resend. Our team is notified of new inquiries without your details being included in the notification.

3. Legal Bases for Processing

• Legitimate interests (Art. 6(1)(f) GDPR): delivering and securing the website, preventing abuse, maintaining stable operation and processing general inquiries.
• Pre-contractual measures (Art. 6(1)(b) GDPR): responding to inquiries made in preparation for a possible contract.
• Consent (Art. 6(1)(a) GDPR): analytics through PostHog, which is only initialized after you accept. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Legal obligations (Art. 6(1)(c) GDPR): retaining or disclosing data where applicable law requires us to do so.

4. Data Sharing and Processors

We do not sell your personal data. We may share data with service providers that help us operate the website and communicate with you, including:

• Hosting and infrastructure providers, including netcup GmbH (Germany) for our backend server and database
• PostHog Inc. (PostHog Cloud EU, including its EU reverse proxy on Cloudflare infrastructure), for analytics where you have given consent, under a data processing agreement
• Cloudflare, Inc. (USA), for DNS, content delivery, file storage, edge computing, attack protection and Turnstile spam protection
• Resend (Resend Inc., USA), for sending contact-form emails

Where required, these providers process personal data on our behalf under appropriate contractual safeguards. We may also disclose data where required by law, to enforce our rights or to defend against legal claims.

5. International Data Transfers

We aim to store and process personal data within the European Union or European Economic Area where possible. PostHog Cloud EU stores analytics data in the EU. PostHog Inc. is based in the United States; where PostHog or its sub-processors may access data from outside the EU, this is covered by the standard contractual clauses in PostHog's data processing agreement. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; EU standard contractual clauses apply in addition. Some service providers may process data in other countries. Where personal data is transferred outside the EU or EEA, we rely on an applicable adequacy decision or appropriate safeguards such as standard contractual clauses.

6. Data Security

We use appropriate technical and organizational measures to protect personal data, including encrypted transmission using HTTPS/TLS, access controls and review of our security measures. No online service can guarantee absolute security.

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

• Technical and security logs are kept only as long as reasonably necessary for security and troubleshooting.
• Analytics data, including error reports, is stored for the retention period of our PostHog plan, currently one year. If you withdraw consent, no further analytics data is collected; you can ask us to delete analytics data already collected.
• Contact inquiries are deleted from our database automatically six months after receipt, or earlier on request. Correspondence that leads to a contract may be kept longer where legal retention obligations apply.

8. Your Rights

Subject to the conditions and limits under applicable law, you have the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent where processing is based on consent
• Right to lodge a complaint with a supervisory authority

Contact office@pitpath.net to exercise your rights. We may need to verify your identity before processing your request and will respond within the time limits required by law.

9. Cookies and Similar Technologies

We use local storage to remember your analytics-consent choice. If you accept analytics, PostHog may use cookies or similar technologies to distinguish sessions and visitors. No non-essential analytics technology is activated before you consent. Cloudflare Turnstile may use cookies or similar technical mechanisms that are necessary to provide spam and abuse protection for the contact form.

10. External Links

This website links to third-party websites and social networks. When you follow an external link, the provider of that service processes data under its own privacy policy. We do not control those services or their data-processing practices.

11. Children

This website is not directed at children under 16. We do not knowingly collect personal data from children under 16.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the date at the top of this page.

13. Contact