Privacy Policy

1. Overview

This Privacy Policy describes how PodiumBase (‘we’, ‘us’) collects, uses, and shares information about you when you use podiumbase.io (the ‘Platform’).

2. Information We Collect

Account information: name, email address, and password hash. For Providers: business name and payout onboarding information handled by Stripe; we receive only the references Stripe returns to us. Transaction information: purchases, refunds, licenses, and order support records. Photographs and matching data: Providers upload race photographs, and the Platform may compute face-detection or face-matching data to help Athletes find photos of themselves. Athletes may use a one-time selfie search for a specific race, or may separately enroll a selfie vault for ongoing matching where available. Usage information: pages visited, features used, device and browser metadata, support messages, and consent or audit records.

3. How We Use Information

To provide and operate the Platform, including race-photo matching, purchases, downloads, messaging, support, and account administration. To process payments via Stripe. To detect and prevent fraud and abuse. To honor privacy choices, data exports, and consent revocations. To comply with tax, accounting, dispute, safety, and legal obligations.

With Stripe for payment processing and payout onboarding. With Resend for transactional email delivery. With Supabase for hosted database, authentication, and storage infrastructure. With Amazon Web Services, including Amazon Rekognition, when face matching is available and you have consented to that matching flow. With Sentry for error monitoring. With PostHog and Vercel Analytics only as configured for product analytics; browser PostHog capture is consent-gated, and server-side PostHog capture fails closed unless a backend route has explicit analytics-consent proof. With Twilio, Meta, or WhatsApp providers when you use supported messaging features. We do NOT sell personal information.

5. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your personal information. Registered users can request a JSON data export in the privacy center. Automated account deletion is temporarily paused while our erasure map is under legal review; contact privacy@podiumbase.io or /legal/contact for a verified manual deletion request. EU/UK residents: you have rights under the GDPR. California residents: you have rights under the CCPA / CPRA.

Face matching is opt-in and is disabled where the Platform does not have a known supported jurisdiction for the race. A race-page one-time selfie search compares your uploaded selfie against that race and deletes the uploaded selfie after the search. A separate enrolled selfie-vault flow may store a biometric template for ongoing matching while your biometric consent remains active. You may revoke biometric consent at any time in the privacy center; revocation records a new consent-revoked row and queues deletion of active enrolled biometric templates. Some operational audit records are retained without selfie images or face vectors.

7. Data Retention

Account and transaction records are retained as required for tax, accounting, fraud, safety, and dispute purposes, often up to 7 years depending on the record. One-time selfie uploads are not stored after processing. Enrolled biometric templates remain only while the relevant consent and lifecycle record allow them, then are queued for purge. Data-export archives are temporary signed links and may expire.

8. Children

The Platform is not directed to children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

9. International Transfers

Your information may be processed in the United States and other countries where our service providers operate. We rely on appropriate transfer mechanisms (Standard Contractual Clauses where applicable).

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified to registered users via email or in-Platform notification.

11. Contact

Privacy questions: contact us via /legal/contact.

Last revised: June 21, 2026