Privacy Policy

The controller of the personal data processed in the Services is Ultimate Drift, responsible for running the championship and its associated digital products. For any question about privacy and data protection, contact us at suporteapp@ultimatedrift.com.br.

2.1 Data you provide to us

• Sign-up: name, email, phone number, date of birth and profile photo.
• Verified phone number: when you validate your number by SMS, we store the phone number linked to your account. Validation unlocks features such as the event credential.
• Driver profile (where applicable): nickname, tax ID (CPF), ID document (RG), competition number, category, vehicle details (make, model, year, builder), sponsors, social media, address, emergency contact and information required by the technical committee of the CBA (Brazilian Motorsport Confederation).
• Technical inspections (CBA): checklist answers, vehicle photos and the digital signature captured on the device screen.
• Content you submit: images, videos and messages you share through the Services, including photos taken with the camera or picked from your gallery by an explicit action of yours.
• Participation in promotions and in the Dorikin League: line-ups, predictions, answers and raffle entry data.
• Ticket purchases (once the feature is available): buyer name, email and phone number, plus order details. We do not store credit card data — payments, once enabled, are processed by specialized payment providers.

2.2 Data collected automatically

• Device identifiers: Firebase installation ID, push notification token and session identifiers.
• Technical data: device model, operating system and version, app version, language, time zone, IP address and network connectivity.
• Usage data: screens and pages visited, time spent, actions taken in the app, session recordings of your interactions on screen (no keystroke capture), and error, crash and performance events.

2.3 Location

The app may collect your approximate location while it is in use, to show your position on the event map, help you navigate the circuit and understand crowd presence at each round. This collection depends on two conditions, always cumulative:

• you grant the location permission to your device's operating system; and
• you accept the consent request shown by the app before the system permission, explaining the purpose.

When both conditions are met, we record location points in your profile history, with a minimum interval between captures. We do not track your location in the background or while the app is closed. You can revoke the permission at any time in your device settings without losing access to the other features.

2.4 Data we do not collect

We do not access your address book, read your messages, collect biometric data, record audio, or capture photos from your gallery without an explicit action of yours. We also do not collect credit card or bank account data.

• Directly from you, when you create your account, fill in forms, submit content or interact with the Services.
• From your sign-in provider, when you choose to sign in with Google or Apple — we receive only the essential account data (name, email and, where available, photo).
• Automatically, when you use the app or browse the websites, through the SDKs and tools listed in section 7.
• From the championship organization, in the case of drivers, judges, teams and credentialed staff registered for a round.

• Authenticating you in the Services and keeping your account active;
• Managing entries, qualifying, battles, inspections and results of the Ultimate Drift championship;
• Publicly displaying drivers' sporting information (name or nickname, category, number, photo, team, sponsors and results), as expected of a competition platform;
• Allowing judges to score runs and the organization to follow the competition in real time;
• Issuing and validating credentials and tickets, including QR code scanning with the device camera;
• Running the Dorikin League, promotions and raffles;
• Sending notifications and emails about the championship (schedule, results, announcements) and, with your consent, promotional communications;
• Showing your position on the event map and understanding crowd presence at each round, when you authorize location;
• Monitoring performance, preventing fraud and abuse, diagnosing failures and improving the Services;
• Complying with legal and regulatory obligations, including before the CBA.

We process your personal data under the legal bases set out in the Brazilian General Data Protection Law (Law No. 13,709/2018), in particular:

• Performance of a contract — to provide the Services you requested when creating your account;
• Consent — for location collection, promotional communications and public display of images;
• Compliance with a legal obligation — to meet requirements from authorities, the CBA and other regulatory bodies;
• Legitimate interest — for platform security, fraud prevention, audience measurement and continuous improvement of the Services, always respecting your rights and freedoms.

We may share your data with:

• Infrastructure and tooling providers that host, support and process data on our behalf, always under our instruction (see section 7);
• The Brazilian Motorsport Confederation (CBA) and its technical committees, regarding entries, inspections and official results;
• Broadcast and media partners, strictly for sporting information intended for public release (name, nickname, number, photo, team, sponsors and result);
• Public authorities, when required by law, by court order or to protect rights.

We do not sell your personal data and we do not share it for third-party marketing purposes.

The Services integrate the SDKs and tools below. Each provider has its own privacy policy, which you can review through the links:

• Google Firebase (Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, Remote Config, App Check, Crashlytics and Analytics) — policy;
• Google Cloud Platform (hosting for the websites, the admin panel and competition data processing) — policy;
• Google Analytics (audience measurement for the websites and the app) — policy;
• Google Maps (event and circuit maps) — policy;
• Google Play Services and Sign in with Google — policy;
• Apple App Store, Apple Push Notification Service and Sign in with Apple — policy;
• Microsoft Clarity (usage analytics and session recording inside the app) — policy;
• Mautic (relationship and email automation) and Postal (email delivery) — both self-hosted on infrastructure under our control, with no sharing with third parties.

We keep your personal data only for as long as necessary for the purposes described in this Policy or to comply with legal obligations.

• Account data: while your account is active;
• After a deletion request: personal data is erased within 30 days (see section 11), except for records we must preserve by legal obligation;
• Location history: erased together with your profile, or earlier at your request;
• Technical and audit logs: up to 6 months;
• Official sporting results (competition name or nickname, number, category, round and placement) are kept indefinitely as part of the championship record, even after account deletion, on the grounds of legitimate sporting interest;
• Tax and financial records for tickets, for the period required by law.

We apply technical and administrative measures to protect your data, including encryption in transit (TLS), role-based access control, integrity verification of app requests (App Check), continuous monitoring and storage on infrastructure from established providers. Even so, no transmission over the internet is fully secure, and we cannot guarantee absolute security.

Under the LGPD, you may exercise the following rights at any time:

• Confirmation that processing takes place;
• Access to your data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or erasure of unnecessary data or data processed unlawfully;
• Data portability;
• Erasure of data processed on the basis of consent;
• Information about who we share your data with;
• Withdrawal of consent;
• Objection to processing carried out under a legal basis other than consent.

To exercise your rights, send an email to suporteapp@ultimatedrift.com.br with the subject “LGPD — data subject rights”. We will reply within the statutory deadline.

You can request the deletion of your account at any time, through two channels. The Account and data deletion page has the full walkthrough.

11.1 In the app

1. 1Open the Ultimate Drift app and sign in;
2. 2Go to Profile;
3. 3Tap Delete account;
4. 4Choose the scope: your entire account, profile data, location history and/or driver and competition data;
5. 5Tap Request deletion to confirm.

When you confirm, we register your request and process it within 30 days. Nothing is erased at the moment of confirmation.

11.2 By email

Without access to the app, send a message to suporteapp@ultimatedrift.com.br with the subject “Account deletion”, stating the email registered on your account. We process the request within the same 30-day deadline.

11.3 What is deleted and what is retained

• Deleted: authentication account, profile (name, email, phone number, date of birth and preferences), profile photo, location history, device identifiers and content you submitted.
• Retained: official sporting results (competition name or nickname, number, category and placement per round), anonymized where applicable, plus records required by law and audit logs, for the periods in section 8.

The Services are not intended for children under 13. We do not knowingly collect personal data from children. If you are a parent or guardian and find that we collected data from a child without proper consent, contact us at suporteapp@ultimatedrift.com.br so we can delete the information.

Drivers aged 13 to 17 may only compete with authorization from their legal guardian, as required by the CBA regulations.

The Services are operated from Brazil, but some of our providers (Google, Apple and Microsoft) may store and process data on servers located in other countries. Whenever that happens, we ensure the transfer meets LGPD requirements through contractual clauses and adequate protection standards.

We may update this Policy from time to time to reflect changes in the law, in the Services or in our practices. The current version will always be available at this address, with the last updated date at the top. Material changes will be announced prominently in the app and/or by email.

For any question, request or complaint about this Policy or the processing of your personal data:

• Email: suporteapp@ultimatedrift.com.br
• Website: ultimatedrift.com.br

You may also contact the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.