Privacy Policy - LMU BoP Tourism

1. Who We Are

LMU BoP Tourism is a website that aggregates lap time data for Le Mans Ultimate and presents a Balance of Performance (BoP) comparison tool. This site is operated independently by sim racing enthusiasts and analysts, and is not affiliated with Studio 397, Le Mans Ultimate, or any official racing organisation.

For privacy-related enquiries, contact: [email protected]

2. Data We Collect

2.1 Server logs

Our web server automatically records standard access log entries for every request: your IP address, the page requested, HTTP status code, browser user agent, and timestamp. These logs are used solely for debugging and security purposes and are not shared with third parties. Logs are retained for a maximum of 30 days.

2.2 Consent preferences

Your cookie choices are stored in a first-party cookie named zaraz-consent, set by Cloudflare Zaraz. This cookie records which categories you accepted or declined so the banner does not reappear on subsequent visits. See Cloudflare's privacy policy for details of their own data processing.

2.3 Performance analytics (Cloudflare RUM)

This site uses Cloudflare Real User Measurements (RUM), a cookieless performance monitoring service. When you visit a page, a small beacon script (beacon.min.js) loaded from static.cloudflareinsights.com sends anonymous performance metrics (page load timing, resource timing) to Cloudflare at cloudflareinsights.com. No cookies are set and no persistent identifier is stored on your device. Cloudflare may record your IP address to derive approximate location (country level) and to prevent abuse; it is not stored in the RUM dataset. See Cloudflare's privacy policy.

2.4 Analytics - Google Analytics 4 (with your consent)

If you consent to the Analytics category, page view and session data is forwarded to Google Analytics 4 via Cloudflare Zaraz's server-side proxy. A first-party session cookie named cfz_zaraz-analytics is set in your browser to associate page views within a single visit. No personal profile is built from this data and it is not used for advertising. Analytics data is retained according to our GA4 property settings (14 months by default). Google's processing is governed by Google's Privacy Policy.

2.5 Discord Bot

LMU BoP Tourism operates a Discord bot that provides BoP data commands in Discord servers. When you use a bot command, the following data is stored in our database:

Discord User ID: your numeric Discord account identifier, stored on first command use to track your access tier (free / plus / pro).
Discord Guild (Server) ID: the numeric identifier of the server in which the command was used, stored when a server-level tier is active or an alert channel is configured.
Server information: we may store limited server information, such as server name, member count, and bot configuration settings, to provide and maintain the bot's features. We may store aggregate server statistics, such as member count, but we do not use this data to identify individual users.
Tier assignment: your access tier and its expiry date, used only to determine which bot features are available to you.
Alert channel ID: if a server administrator enables BoP-change alerts, the target channel's numeric ID is stored for that server.

We do not collect your Discord username, avatar, email address, or any message content. Command parameters (car class, track name) are written to our server logs alongside your User ID for debugging purposes and are subject to the 30-day log retention described in section 2.1.

Your User ID and associated tier data are retained until you request deletion by contacting [email protected]. Discord's own Privacy Policy governs all data held by Discord itself.

2.6 One-time purchase records

When you make a one-time purchase through Discord's in-app store, our system records an audit event for each lifecycle stage of that entitlement. The following data is stored in our database:

Discord Entitlement ID: Discord's unique identifier for your purchase, used to match webhook events and prevent double-consumption.
Discord User ID: the account that made the purchase (see section 2.4).
Event type and timestamp: one of purchased, consumed, consume_failed, or deleted (refund / Discord cleanup), together with when it occurred.
Usage context (consumed events only): the parameters of the bot command for which the purchase was spent. This is used for support and dispute resolution.

We do not receive or store any payment card details; all payment processing is handled by Discord. These records are retained for 24 months from the date of the last event on the entitlement, after which they are deleted. To request earlier deletion, contact [email protected].

2.7 Advertising - Google AdSense & Google Ads (with your consent)

If you consent to the Advertising category, two Google advertising services become active:

Google AdSense (publisher ID ca-pub-1793490668355527): serves display advertisements directly on this site. The AdSense script is loaded in your browser from Google's servers. Google may set advertising cookies (__gads, __gpi, NID) directly on your device for ad frequency capping and personalisation.
Google Ads conversion tracking & remarketing: runs via Cloudflare Zaraz's server-side proxy. An audience pixel (ga-audiences) may fire to build remarketing audience lists. No additional browser cookies are set by this component.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to this site and/or other sites on the internet.

You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of a third-party vendor's use of cookies for personalised advertising by visiting aboutads.info. Within the EEA/UK, you can decline the Advertising category in our .

All Google advertising data is processed by Google under their Privacy Policy and Ads Policy. If you do not consent, neither service activates and no advertising data is sent.

3. Third-Party Services

This site uses the following services and resources. Where a third-party transfer happens, it is subject to that party's privacy policy:

Cloudflare Zaraz - our consent management platform and tag delivery gateway. Zaraz records your consent choices and implements Google Consent Mode v2. Third-party tools are only loaded after the relevant consent state allows them. Cloudflare privacy policy.
Local fonts and scripts - the main site serves its fonts, HTMX, and application JavaScript from this domain. These assets do not create third-party requests by themselves.
Cloudflare RUM (static.cloudflareinsights.com, cloudflareinsights.com) - a cookieless performance monitoring beacon loaded on every page. Collects page load timing data; sets no cookies and stores no persistent device identifier. Cloudflare privacy policy.
Google advertising services - may be enabled through Zaraz after advertising approval; serves personalised or non-personalised ads depending on your consent.
Discord (discord.com) - our bot runs on the Discord platform. Discord processes all message routing and command interactions. We receive only the User ID and Guild ID needed to respond; all other interaction data is handled by Discord under their Privacy Policy and Terms of Service.

4. Legal Basis for Processing

Server logs: Legitimate interest (GDPR Art. 6(1)(f)) - necessary for security and service operation.
Consent cookie (zaraz-consent): Legitimate interest (GDPR Art. 6(1)(f)) - necessary to record and honour your consent choices.
Cloudflare RUM: Legitimate interest (GDPR Art. 6(1)(f)) - cookieless, anonymous performance monitoring necessary to maintain site quality.
Cloudflare Zaraz: Legitimate interest for tag delivery and consent enforcement; consent where a configured tool requires it.
Analytics (GA4, cfz_zaraz-analytics cookie): Consent (GDPR Art. 6(1)(a)) - only active when you accept the Analytics category.
Advertising (Google AdSense & Google Ads): Consent (GDPR Art. 6(1)(a)) - only active when you accept the Advertising category.
Discord Bot data (User ID, Guild ID, tier): Legitimate interest (GDPR Art. 6(1)(f)) - necessary to deliver the bot service and enforce tiered access controls.
One-time purchase records: Performance of a contract (GDPR Art. 6(1)(b)) - necessary to deliver the paid feature, prevent double-consumption, and handle refund requests.

5. Your Rights

Under GDPR and applicable data protection laws you have the right to:

Access the personal data we hold about you
Rectification of inaccurate data
Erasure of your data ("right to be forgotten")
Restrict or object to processing
Withdraw consent at any time via the link in the footer
Lodge a complaint with your local supervisory authority

To exercise any right, contact: [email protected]

6. Data Transfers

Third-party services (Cloudflare, Google advertising services when enabled, and Discord) may transfer data to servers outside the European Economic Area. These providers use transfer safeguards such as Standard Contractual Clauses and, where applicable, participation in the EU-US Data Privacy Framework.

7. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. The "last updated" date at the top of this page will change when we do so.