Privacy Policy

Effective date: 2026-10-26 · Last updated: 2026-10-26

This Privacy Policy explains how OAT — Overcut Academy Telemetry (“OAT”, “the App”), a desktop telemetry application and its supporting online services, published by Nogueira Driver Development LTDA, a company registered in Brazil and doing business as Overcut Academy (“we”, “us”, “our”), handles your information. We are the controller of the personal data described here. Questions? Contact support@overcutacademy.com.

1. Information we collect and why

Your account

• Email address, full name and password — OAT requires a free account. You sign up inside the App; the account is created through Overcut Academy’s licence server and held by our authentication provider, Supabase. Your password is handled by Supabase’s authentication service; we never see it in readable form. We send a confirmation email to check the address is yours.
• Existing Vault accounts — if you already have an account on Overcut Academy’s Vault (vault.overcutacademy.com), you can sign in to OAT with it. Both use the same account, so we also know your Vault role (for example, coach or driver), which decides whether Pro is included.

We use your account to sign you in, decide which plan you are on, send service emails (confirmation, billing and trial notices, replies to support) and, only if you opted in, marketing email (see section 5).

Your consent record

When you sign up we store, with your account, the version of the Terms of Service and Privacy Policy you accepted (one version number covers both documents) and the time you accepted them, and whether you opted in to marketing email and when. This is how we can show what you agreed to and honour your email choice.

Pro subscription and payment

Pro is bought from inside OAT. Payments are processed by Stripe; you enter your card on Stripe’s checkout page and we never see or store your card number. Stripe shares with us your email, the plan you chose, your subscription status (for example trialing, active, past due or cancelled) and your renewal or trial-end date, which we store with your account so the App knows you are on Pro. Stripe also gives us a card fingerprint — a code that identifies a card without revealing its number — which we use only to enforce one free trial per card. See Stripe’s Privacy Policy.

Machine licences

If you use a machine licence key, OAT checks it with our licence server. The check sends your licence key and a one-way hashed identifier of your computer (a code derived from it, not the raw hardware details). When you first activate a computer, OAT also sends that computer’s name (hostname) and operating-system version, so you can tell your activated computers apart. We use this to enforce how many computers your licence allows.

Update checks

OAT asks our licence server whether a newer version of OAT is available, at launch and periodically while it runs. The request identifies the app (OAT); the comparison with the version you have installed happens on your computer. Like any web request, it carries your IP address, which appears in our standard server logs.

Bug reports and suggestions

If you send a report from Settings → Help, we receive the message you write, the reply email you give (if any), and basic diagnostics (OAT version, operating system and whether it is the installed app). The report is emailed to our support inbox and used only to answer you and fix the problem.

AI Coach

OAT’s built-in coach runs entirely on your computer. When you choose to run a hosted AI analysis, OAT sends a summary of the session’s lap and corner data — measured numbers such as lap times, corner speeds and braking points, not your raw telemetry file — together with your sign-in token to Overcut Academy’s server, which passes the summary to an AI model through OpenRouter and returns the written analysis. We keep your credit balance and a usage record for each run (the kind of analysis, the model used, the credits spent and the size of the request) for billing; we do not keep the summary, your questions or the coach’s answers on our server. See OpenRouter’s Privacy Policy.

Ask the coach. If you type a follow-up question to the hosted coach, OAT sends the question you write (up to 500 characters), the earlier questions and answers in that conversation and the coach’s current report for the session, together with the same session summary, through our server to the AI model via OpenRouter. This is free text you write yourself, so anything you put in it — names, health details or other personal information — is sent too. Please don’t include personal information the coach does not need.

Vault publishing and team sync (coach and Pro features)

If you publish a report to Vault, the report (a page with the drivers’ names, lap data, charts and coaching notes it contains) is stored in Overcut Academy’s Supabase project and shown to the people Vault allows to see it. If you turn on team sync, the dyno comments and annotations you share with your team are stored there too. Nothing is published or synced unless you use these features.

Weather

To show the conditions for a session, OAT sends the session’s GPS coordinates and date to Open-Meteo, a weather service, and stores the answer on your computer. For the forecast on the Home page, OAT uses your computer’s location if you allow it, or otherwise asks ip-api.com for an approximate location (city level) based on your IP address, and sends those coordinates to Open-Meteo.

Maps and track search

The track maps show satellite imagery loaded from Google Maps, Microsoft Bing Maps or Esri, depending on the map you pick, so those providers receive requests for the map area you are viewing. If you search for a track that is not in OAT’s built-in track list, the name you type is sent to OpenStreetMap’s Nominatim service to find it.

Google Drive

Only if you connect a Google Drive folder as a source, OAT signs in to Google with your permission and reads the files in that folder. The access tokens Google issues are stored on your computer, not on our servers.

Operational logs

Our servers keep standard logs (timestamps, IP addresses, which endpoint was called) to run and secure the service.

2. What stays on your computer

Apart from the features above, your telemetry stays on your computer. The .xrk, .uni, CSV and other session files you open, the sessions OAT downloads from your dashes over your local network, your onboard videos, your local reports and OAT’s own database are read and stored on your machine and are not sent to us.

3. What we don’t do

• We do not sell or rent your personal data.
• We show no ads and do no ad tracking.
• The App contains no third-party analytics or usage tracking.

4. Legal bases

We process your account, subscription, licence and support data to provide the service you asked for (performance of a contract); server logs and fraud prevention, including the one-trial-per-card rule, on our legitimate interest in running a secure, fair service; billing records to meet legal obligations; and marketing email only with your consent.

5. Marketing email

We send marketing email (news, offers, new features) only if you opted in when you signed up. The box is unticked by default. You can withdraw at any time by using the unsubscribe link in any marketing email or by emailing support@overcutacademy.com. Withdrawing does not affect service emails about your account or subscription.

6. Service providers

We use a small set of processors to run OAT:

• Stripe — payment processing and subscription billing (privacy).
• Render — hosting for the licence server (privacy).
• Supabase — accounts and sign-in, subscription and credit records, the AI Coach server function, Vault reports and team sync (privacy).
• Resend — transactional email delivery (privacy).
• Cloudflare — DNS, TLS and app download delivery (privacy).
• OpenRouter — routes hosted AI Coach requests to the AI model provider (privacy).
• Open-Meteo — weather data (terms & privacy).
• Google — Google Drive access you connect, and satellite map imagery (privacy).

When you use the map or forecast features, OAT also contacts Microsoft Bing Maps, Esri, OpenStreetMap Nominatim and ip-api.com as described in section 1.

7. International transfers

Some of these providers process data outside Brazil and outside your country, including in the United States and the European Union. Where the law requires it, we rely on the providers’ standard contractual clauses or other safeguards recognised under the LGPD and the GDPR.

8. How long we keep it

We keep your account, consent record and subscription records for as long as your account is active, and afterwards only as long as needed for legal, tax, accounting and support obligations. The trial record for a card fingerprint is kept so the one-free-trial rule keeps working. Bug reports are kept as long as needed to resolve them. You can ask us to delete your account at any time (see below); some billing records may be retained where the law requires.

9. Your rights

Under Brazil’s General Data Protection Law (LGPD, Lei nº 13.709/2018) and, where it applies to you, the EU General Data Protection Regulation (GDPR), you have the right to:

• access the personal data we hold about you and confirm that we process it;
• correct data that is incomplete, inaccurate or out of date;
• delete your data, including your account;
• portability — receive your data in a commonly used format;
• object to processing based on our legitimate interests, and ask for processing to be restricted;
• withdraw consent at any time, for example to marketing email, without affecting processing before you withdrew;
• know which third parties we share data with, and lodge a complaint with your data-protection authority (in Brazil, the ANPD).

Email support@overcutacademy.com from the address on your account and we’ll respond within the time the law allows. To stop billing, cancel your subscription (see our Terms of Service).

10. Security

Data travels between the App, our servers and our providers over encrypted connections (HTTPS/TLS), with one exception: the approximate-location lookup to ip-api.com for the Home-page forecast uses a plain, unencrypted HTTP request, so your IP address and the returned city-level location are not encrypted in transit. Account and subscription records are kept in a managed database with access controls. No system is perfectly secure, but we limit what leaves your computer specifically to reduce risk.

11. Children

OAT is used in youth karting, but accounts are meant to be created and held by adults. A driver under 18 should use OAT through an account held by a parent, guardian or coach. We do not knowingly create accounts for children under 13; if you believe one has been created, contact us and we will delete it.

12. Changes

If we make material changes, we’ll update the “Last updated” date above, post the new version at this URL and, where the change affects what you agreed to, ask you again in the App or by email.

13. Contact

Nogueira Driver Development LTDA (Overcut Academy)
Rua Taquari 418, Belo Horizonte, MG, 31130-370, Brazil
Questions about this Privacy Policy or requests about your data: support@overcutacademy.com · See also our Terms of Service.