What happens to your data
Five companies receive something when you use this site. Here is each one, what reaches them, and why.
Last revised
This describes what vertel.cc actually does, not what a site like it might do. If a line here does not match what the site does, that is a defect worth reporting.
Who is responsible
The operator of vertel.cc is the controller for everything below. Contact details are on the imprint.
What leaves your browser
Ordered by how many visitors it touches: everyone, then everyone who opens the map, then the few who send feedback or play a video.
Vercel
Hosting, and the servers that answer every request
Your IP address and the request itself — which page, when, which browser — in ordinary server logs.
Needed to send you the page, and used to diagnose outages and abuse.
- Where
- Vercel Inc., United States; served from European edge locations
- Basis
- Legitimate interests (art. 6(1)(f))
- Transfer
- EU–U.S. Data Privacy Framework, and the 2021 standard contractual clauses
Vercel Analytics
Counting visits
One ping per page view: the page, where you arrived from, the approximate location of your IP address down to the city, your operating system, browser and device type. No cookie. Vercel groups a day’s views using a hash computed from the request, and discards it after 24 hours.
To see which races get read. It stores nothing on your device and keeps no identifier beyond the day.
- Where
- Vercel Inc., United States
- Basis
- Legitimate interests (art. 6(1)(f))
- Transfer
- EU–U.S. Data Privacy Framework, and the 2021 standard contractual clauses
Mapbox
The map itself — tiles, terrain and cartography
Your IP address and which pieces of map you asked for. The map library also reports its own usage back to Mapbox, which it does not let us turn off. Your browser fetches all of this directly from Mapbox rather than through this site.
The map is the site.
- Where
- Mapbox, Inc., United States
- Basis
- Legitimate interests (art. 6(1)(f))
- Transfer
- EU–U.S. Data Privacy Framework, and the 2021 standard contractual clauses
Resend
Delivering the feedback form
Only if you send feedback
Your message, an optional reply address, and a short block of context: the race, stage and story point you were looking at, your filters, the page address, your theme and window size. The form shows you that block before you send it.
It becomes one email to one inbox. The context is what makes “this stage is wrong” fixable without a reply. This site has no database, so nothing is stored here.
- Where
- Resend, Inc., United States
- Basis
- Legitimate interests (art. 6(1)(f)) — handling correspondence you chose to send
- Transfer
- EU–U.S. Data Privacy Framework, and standard contractual clauses
YouTube
Race highlights, embedded rather than hosted
Only if you play a video
Whatever the YouTube player collects once it loads. Nothing is requested until you press play, and the embed uses youtube-nocookie.com.
Four of 109 races have a highlights video. The rest never contact YouTube.
- Where
- Google Ireland Ltd. / Google LLC, United States
- Basis
- Consent (art. 6(1)(a)), given by pressing play — nothing loads before that
- Transfer
- EU–U.S. Data Privacy Framework
What never happens
Each of these is true because of a decision in the code, and each would have to be deliberately reversed for it to stop being true.
No cookies.
None, from this site or from anyone else while you are on it.
Three settings, kept on your device.
The site remembers your theme, whether you dismissed the hint, and whether you collapsed the elevation strip. They stay in your browser, are never sent anywhere, and clearing your browser data removes them.
No accounts, no login, no database.
There is nowhere here to keep anything about you.
No fonts loaded from Google.
The typefaces are built into the site and served from this domain, so your browser never contacts Google to draw text.
Your location never leaves your device.
"Find a route near me" asks your browser for your coordinates, with your permission, each time you use it. They are compared against race routes in your browser and then discarded. They are never sent anywhere.
Nothing is sold, and there is no advertising.
No ad network, no tracker, and nobody paying for any of this.
Leaving the EEA
All five recipients are United States companies, so using this site sends data to the United States. Vercel, Mapbox, Resend and Google are each certified under the EU–U.S. Data Privacy Framework, and the first three also rely on the European Commission’s 2021 standard contractual clauses. Their own terms, linked above, are the authoritative statement of what each relies on. This site adds no safeguards of its own on top of theirs.
How long anything is kept
This site keeps nothing: there is no database and no log store of our own. What retention exists is each recipient’s — Vercel’s server and analytics records under their terms, the analytics hash discarded after 24 hours, and a feedback email that sits in one inbox until it is deleted.
Your rights
Under the GDPR you can ask for access to your personal data, its correction or erasure, restriction of its processing, a copy in portable form, and you can object to processing based on legitimate interests. Write to the address on the imprint and you will get an answer.
Worth knowing: apart from a feedback message you sent, this site holds nothing that identifies you and cannot link a request to a past visit.
Complaints
If you think this is being handled wrongly, you can complain to the Lithuanian supervisory authority, the Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate), L. Sapiegos g. 17, 10312 Vilnius. If you live elsewhere in the EU, you can complain to the authority where you live.
When this changes
The revision date at the top of this sheet is the only claim made about how current it is. When the site starts or stops doing something on this page, the page changes in the same release.