Skip to content
Legal

Privacy and Cookie Policy

Last updated: August 23, 2026

This notice describes how your Personal Data is processed when you use the GPKingdom News mobile application ("App") and the website app.gpkingdom.it ("Website"), hereinafter collectively referred to as the "Service".

1. Data Controller

The Data Controller is:

No Data Protection Officer (DPO) has been appointed, as the conditions set out in Art. 37 GDPR are not met.

2. Types of Personal Data Collected

2.1 Data provided voluntarily by the User

IMPORTANT: The App does NOT collect name, surname, email address, phone number, profile picture, date of birth, or any other directly identifiable personal data. No registration with personal data is required.

2.2 Data collected automatically

2.3 Identifiers used

Identifier Type Where used Persistence
Anonymous Supabase UUID Internal User ID (UUID v4) automatically generated at launch, without any registration Supabase, PostHog, Firebase Analytics, Sentry Persistent (anonymous session)
Expo Push Token Device token Push notification registration on Supabase Until uninstallation
IDFA / GAID Advertising identifiers Not collected directly by the App — managed by advertising networks (Google AdMob, Unity Ads, Meta Audience Network, AppLovin) only with prior consent via Google UMP Managed by Google

The Service does not require access to the camera, microphone, address book, photo gallery, or Bluetooth.

3. Purposes of Processing and Legal Basis

Purpose Data processed Legal basis
Service Provision — Delivery of news, race calendar, standings, motorsport statistics Usage data, device data, preferences, anonymous UUID Performance of a contract (Art. 6(1)(b))
Subscription Management — Processing purchases via App Store and Google Play Anonymous UUID, transaction data (managed by Apple/Google via RevenueCat) Performance of a contract (Art. 6(1)(b))
App Store refund request management — Transmission to Apple, via RevenueCat, of aggregated App usage data when the User requests a refund Aggregated App usage data (e.g. duration of use, degree of consumption of the purchased content, refund history), transmitted exclusively for the assessment of the refund request Performance of a contract (Art. 6(1)(b))
Service push notifications — Sending breaking news, race results, editorial updates Push token, notification preferences, language Performance of a contract (Art. 6(1)(b))
Product analytics — Aggregate analysis of App usage to improve the Service Anonymous UUID, UI events, screens visited, device data Legitimate interest (Art. 6(1)(f))
Crash reporting and diagnostics — Identification and resolution of technical errors Anonymous UUID, crash data, device data, IP address, screen screenshot Legitimate interest (Art. 6(1)(f))
Personalised advertising — Displaying personalised ads via Google AdMob and mediation partners (Unity Ads, Meta Audience Network, AppLovin) Advertising identifiers (IDFA/GAID), device data, IP Consent (Art. 6(1)(a))
Firebase Analytics — Advanced in-App behaviour analysis Anonymous UUID, events, device data Consent (Art. 6(1)(a))
GPS Location — Showing events and news near the User's location GPS location Consent (Art. 6(1)(a))
Legal obligations — Retention of tax data related to purchases Transaction data Legal obligation (Art. 6(1)(c))

For processing based on legitimate interest, the Controller has assessed that its legitimate interest in improving the Service and ensuring its technical stability does not override the fundamental rights and freedoms of the User, considering that the processed data is pseudonymised (anonymous UUID) and not directly identifiable.

4. Third-Party Services

4.1 Backend and Hosting

4.2 Payments

4.3 Advertising

All advertising SDKs are activated exclusively after the User's explicit consent via the Google UMP framework (IAB TCF 2.0). Subscribed users (PRO or ad-free) do not see advertisements.

4.4 Analytics

4.5 Crash Reporting

4.6 Push Notifications

4.7 Maps

4.8 Artificial Intelligence

4.9 Editorial Content

4.10 Website install flow

The /install route uses the browser language to select the localized download section of the Website. Where automatic mobile-store routing is active, it also uses the broad device type (iOS/iPadOS, Android, or other) to select the App Store, Google Play, or the Website fallback. This information is used for routing; when server-side measurement is active, it may also be used to produce aggregate statistics about requests and store links. The route does not prove that the App was installed.

When server-side measurement is active, the Website may send limited request and store-link information from its server to PostHog, hosted in the European Union, to produce aggregate statistics. When active, this measurement relies on the Controller’s legitimate interest in checking that the links work and improving the Service’s distribution. When campaign-parameter forwarding is active, valid UTM parameters describe only general campaigns or distribution placements and must not contain data referring to an individual recipient; they may be forwarded to Apple or Google when a store link is followed. The flow does not use cookies, local or session storage, browser analytics tools, session-recording tools, or persistent browser identifiers, and it does not create personal profiles. If the browser communicates a global privacy preference, measurement and parameter forwarding are not performed.

Cloudflare processes the technical data needed to deliver the request. After the redirect, Apple and Google may process data under their own notices and settings.

To exercise rights, including the right to object to processing based on legitimate interest where applicable, use the Controller’s existing contact path in this notice: info@razehub.it, Raze S.R.L., Via IV Novembre 84, 23868 Valmadrera (LC), Italy.

5. International Data Transfers

The User's personal data may be transferred to countries outside the European Economic Area (EEA), particularly to the United States, in connection with the third-party services listed above.

Such transfers are based on:

PostHog and Sentry host data entirely within the European Union (eu.i.posthog.com and ingest.de.sentry.io respectively), therefore no extra-EU transfer occurs for these services.

6. Data Retention Periods

Data category Retention period
Anonymous session and UUID For the duration of App use. Deleted upon uninstallation or after a prolonged period of inactivity.
User preferences (categories, notifications, favourites, theme) For the duration of App use
Transaction and billing data 10 years from the transaction (Italian tax obligation ex Art. 2220 Civil Code)
Analytics (PostHog) The project currently reports 84 months of event retention. This value must be re-verified at each release and does not, by itself, determine the legally applicable retention period.
Crash reporting (Sentry) 90 days
Firebase Analytics Raw data: maximum 14 months (Google Analytics 4 setting)
Advertising data (AdMob, Unity Ads, Meta, AppLovin) According to Google's retention policy
Push token Until notification deactivation or App uninstallation

7. Data Subject Rights

Under Articles 15-22 of the GDPR, the User has the right to:

The Controller undertakes to respond to requests within 30 days of receipt, extendable by a further 60 days in case of particular complexity (Art. 12(3) GDPR).

Important notice (Art. 11 GDPR): As the App does not require registration and uses exclusively anonymous identifiers (UUID), the Controller may not be able to identify the Data Subject. In such cases, the rights under Articles 15-20 do not apply, unless the Data Subject provides additional information enabling their identification.

To withdraw consent for personalised advertising:

Complaint to the Supervisory Authority: The User has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali): Piazza Venezia 11, 00187 Rome — email: protocollo@gpdp.it — website: https://www.garanteprivacy.it

8. Cookies and Tracking Technologies

Website (app.gpkingdom.it): The Website uses only technical cookies necessary for operation (Cloudflare). No profiling cookies, third-party advertising cookies, or browser analytics tools are used on website pages. The /install route uses the browser language and, where automatic mobile-store routing is active, the broad device type, without cookies or identifiers stored on the device; when server-side measurement is active, it may send limited server-side request and store-link information to produce aggregate statistics; when campaign-parameter forwarding is active, it may forward valid, general UTM parameters when a store link is followed.

Mobile App: The App does not use cookies. Tracking SDKs (Firebase Analytics, Google AdMob) are activated exclusively after the User's explicit consent through the Google User Messaging Platform (UMP) framework, compliant with the IAB Transparency & Consent Framework (TCF) 2.0. Firebase Analytics data collection is disabled by default (analytics_auto_collection_enabled: false) and is enabled only after obtaining consent.

9. Push Notifications

The App may send push notifications via the Expo Notifications service. Notifications are exclusively editorial and service-related:

No promotional or marketing notifications are sent.

The User can customise the notification priority level (all, important, urgent) from the App settings. Notifications can be deactivated at any time from the device settings.

10. Children

The App is rated 4+ on the Apple and Google stores. It does not knowingly collect directly identifiable personal data from children under 14, as it does not require any registration with personal data.

Should the Controller become aware that it has collected personal data from minors without adequate consent, it will promptly delete such data.

11. Nature of Data Provision

The App does not require mandatory personal data for its basic use. The following permissions are entirely optional:

Refusal to grant these permissions does not affect access to the App's core features.

12. Data Security

The Controller adopts appropriate technical and organisational measures to protect Personal Data (Art. 32 GDPR):

13. Changes to this Policy

The Controller reserves the right to make changes to this notice at any time. Changes will be published on this page with an updated date. In the event of substantial changes, the Controller will notify Users through the App or the Website.

14. Contact Information

For any request regarding the processing of personal data:

Raze S.R.L.
Via IV Novembre 84, 23868 Valmadrera (LC), Italy
Email: info@razehub.it

15. Definitions

This notice is drafted pursuant to Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.