Privacy Policy

Last updated 2 October 2026

Who we are

Sector is a product and trading name of Hill Capital Limited, a company registered in New Zealand (we, us). This policy explains how we collect, use, share and protect personal information when you use the Sector website, web app, desktop app and APIs (the Service). We follow the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). If you are in the United Kingdom or European Union, the section on UK and EU privacy law also applies.

Our privacy officer can be contacted at legal@sectorapp.net.

Information we collect

Account information

Username, email address, role and team.
Your password, stored only as a one-way (bcrypt) hash. We cannot see your password.
Who invited or created your account, and account verification requests.

Billing information

Plan, subscription status, billing email, and Stripe customer and subscription identifiers. Card details are collected and held by Stripe. We do not see or store full card numbers.

Team content

Telemetry and log files (for example MoTeC .ld and VBOX .vbo), which can include a driver's name or code, vehicle, venue, session, date and GPS positions.
Onboard video and audio, which can show people's faces and record their voices.
Timing data, which can include competitor names, numbers and lap times, plus schedules, sector definitions, notes and other content your team adds.

Security, logs and support

An audit log of significant actions (for example who changed a user, team or file), including the username, role and time.
IP addresses, used to limit repeated sign-in attempts and in short-lived server logs to keep the Service secure.
Bug reports sent from the desktop app: your description, an optional contact email, any attachment you choose to include, the app version and your IP address.
Emails and messages you send us.

Information stored on your device

The web app keeps you signed in with a secure, httpOnly session cookie, and stores your username, role, team and selected event in your browser's local storage. The desktop app stores similar sign-in details, your settings, an optional Google Maps API key you enter, and a local cache of files you open.
We do not use advertising cookies or third-party advertising trackers.

Location

If you choose to use your location to find nearby circuits, your browser shares your coordinates with the Service to find tracks near you. Venue coordinates are used to fetch weather and track outlines.

How we use information

To provide the Service: sign-in, team workspaces, timing, analysis, file storage and playback.
To bill subscriptions and manage plans.
To send service emails, such as invitations and password set-up or reset links.
To provide support, investigate bugs and keep the Service secure.
To meet legal obligations.

We do not sell personal information. We do not use team content to train artificial intelligence models unless the team has opted in in writing.

Information about people who are not users (IPP 3A)

Some personal information reaches us indirectly. Telemetry files, onboard video and timing data uploaded by a team can contain the names, driver codes, images or voices of drivers and other people who do not have a Sector account. We receive this information from the team that uploads it. We hold it only to provide the Service to that team, store it with the team's other content, and do not share it with other teams. Teams are responsible for telling the people concerned and for having their consent where needed (see our Terms). If you think we hold information about you, contact us at legal@sectorapp.net. You can ask to see or correct it.

Who we share information with

Other users in your team, according to their role.
Service providers who host or process data for us (sub-processors), such as hosting, storage, email and payments. See the sub-processor list.
Professional advisers, and authorities where the law requires it.
A buyer or successor of the Service, who must protect the information in the same way.

Overseas storage and transfers (IPP 12)

Several of our sub-processors are based in, or store data in, countries outside New Zealand, including the United States and the European Union. When we send personal information overseas, we take reasonable steps to make sure it is protected in a way that is comparable to the New Zealand Privacy Act, for example through contract terms with the provider.

Security

Data is sent over encrypted connections (HTTPS). Passwords are stored as one-way hashes. Access to team data is limited by team and role. No system is perfectly secure. If a privacy breach is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, as Part 6 of the Privacy Act requires.

How long we keep information

Account information: while the account is active, then deleted within 90 days of closure.
Team content: until the team deletes it, or within 90 days after the team's account ends.
Desktop bug reports: up to 12 months.
Audit logs: up to 24 months.
Backups: rolling, up to 35 days.
Billing records: as long as tax law requires (generally 7 years in New Zealand).

Your rights (IPP 6 and IPP 7)

You can ask for access to the personal information we hold about you and ask us to correct it. Email legal@sectorapp.net. We will respond within 20 working days. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner.

UK and EU privacy law

If the UK GDPR or EU GDPR applies to you:

For team content, the team is the controller and we act as its processor. We process it only on the team's instructions. A data processing agreement is available on request.
For account, billing, security and support information, we are the controller. Our lawful bases are performing our contract with you, our legitimate interests in running and securing the Service, and compliance with legal obligations.
You have the right to access, correct, erase, restrict, object to processing of, and receive a portable copy of your personal information, and to withdraw consent where we rely on it.
New Zealand has an EU adequacy decision. Transfers to providers in other countries, such as the United States, rely on safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum or the EU-US Data Privacy Framework.
You can complain to your local data protection authority, such as the ICO in the UK.

Children

The Service is for teams and businesses and is not directed at children. Where a team uploads data about a junior driver, the team is responsible for having a parent or guardian's consent.

Changes

We will post changes to this policy on this page and update the date above. For significant changes we will also tell account administrators by email or in the Service.

Contact

Privacy officer, Hill Capital Limited, New Zealand. Email legal@sectorapp.net.