Privacy Policy

1. Who We Are

Flagstand is a commercial software-as-a-service platform for iRacing league management, operated by Fulcrum Ventures LLC D.B.A. School of Sim Racing, doing business as Flagstand (“we,” “us,” or “our”). This policy describes how we collect, use, and protect personal data in connection with the Service at flagstand.app and its subdomains.

2. Who This Policy Covers

Flagstand serves two types of people:

Tenant admins and stewards — representatives of racing organizations who create and manage a Flagstand account. They have authenticated accounts and direct relationships with us.

League member drivers — iRacing drivers whose race results, standings, and statistics appear in the Service because they participate in a Tenant's league. Drivers may optionally create a Flagstand account to claim their profile and access additional features, but they are present in the platform through their racing activity regardless.

3. What We Collect

3.1 Account Data (Tenant Admins and Stewards)

When you create a Flagstand account, we collect your email address and name via Clerk, our authentication provider.

3.2 Billing Data

When you subscribe to a paid plan, payment is processed by Stripe. We do not store credit card numbers or full payment details. We receive and store limited billing metadata from Stripe, including your subscription status, plan tier, and Stripe customer and subscription IDs.

3.3 iRacing Race Data

We collect race results, standings, roster data, schedules, lap times, finishing positions, driver statistics, and other race-related data from the iRacing API for leagues managed by Tenants on the platform. This data includes iRacing customer IDs (cust_id) and display names.

3.4 Discord Data

If you or your league members link a Discord account, we collect your Discord user ID and username to enable Discord integration features. This is optional.

3.5 Usage Data

We collect standard web analytics data via Google Analytics, including pages visited, session duration, and general location (city/country level). We do not use fingerprinting or cross-site tracking. Analytics apply to public-facing pages, including public league stats pages at tenant subdomains.

3.6 Communications

If you contact us via email, we retain those communications to respond to your inquiry and for record-keeping.

4. How We Use Your Data

We use the data we collect to:

• Provide, operate, and improve the Service;
• Display race results, standings, schedules, and driver profiles within the platform;
• Process and manage your subscription and billing;
• Send transactional notifications — including account emails (password resets, invites), protest and penalty notifications, and billing receipts;
• Post race results, standings updates, and notifications to configured Discord channels when Discord integration is enabled;
• Authenticate users and maintain account security;
• Understand how the platform is used and improve the product.

4.1 Aggregate and Platform-Level Data Use

We may use iRacing race data collected through the Service — including results, lap times, finishing positions, driver statistics, and participation records — in aggregate and anonymized form. Uses include platform-wide statistics, public reporting on platform growth and adoption, benchmarking, and product improvement. Aggregated data is not linked to identifiable individuals when shared externally and is not sold.

Individual driver data is scoped to the Tenant whose leagues generated it. We do not share one Tenant's driver data with another Tenant.

5. Data Isolation Between Tenants

Flagstand is a multi-tenant platform. Each Tenant's league data — driver records, results, configurations — is logically isolated and not accessible to other Tenants. Our staff may access data as needed to operate and support the platform.

6. What We Don't Do

We do not sell your personal data. We do not use your data for advertising. We do not share your personal data with third parties except as described in this policy or as required by law.

7. Third-Party Services

We rely on the following third-party providers to operate the Service:

Each of these providers has its own privacy policy governing data they process. We encourage you to review those policies.

7.1 iRacing Credential Handling

To sync race data on behalf of Tenants, the Service uses iRacing API credentials. These credentials are used solely for data retrieval and are not shared with other Tenants or third parties.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service and maintain accurate league records.

Following cancellation or account termination, your organization's data is retained for 90 days to allow for reactivation or export. After 90 days, data may be permanently deleted upon request or automatically purged.

Driver member data (race results, standings) derived from iRacing is retained as part of historical league records. You may request removal of personal identifiers associated with your driver record by contacting us.

9. Your Rights

Depending on your location, you may have rights regarding your personal data, including:

• Access — request a copy of the personal data we hold about you;
• Correction — request correction of inaccurate data;
• Deletion — request deletion of your personal data, subject to our need to maintain accurate league records;
• Portability — request an export of your data in a machine-readable format.

To exercise any of these rights, contact us at bruce@schoolofsimracing.net. We will respond within 30 days.

9.1 California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact bruce@schoolofsimracing.net.

9.2 European Users (GDPR)

If you are located in the European Union, European Economic Area, or United Kingdom, you have rights under the GDPR or equivalent local legislation, including the right to lodge a complaint with a supervisory authority. Our legal basis for processing your data is primarily contract performance (to provide the Service you subscribed to) and legitimate interests (platform improvement and security).

10. Security

We implement reasonable technical and organizational measures to protect your data against unauthorized access, disclosure, alteration, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, contact us at bruce@schoolofsimracing.net and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. We will note the updated date at the top of this page. For material changes, we will notify affected users via email or a notice within the Service.

13. Contact

For privacy-related questions, data requests, or concerns:

Email: bruce@schoolofsimracing.net
Website: flagstand.app