Privacy Policy

The website exr-racing.co.il and the services are operated by EXR Racing Team and School ("EXR", "we"). For any privacy question or request under this policy, contact us by email at info@exr-racing.co.il or by phone at 03-6860005.

• What you give us: your name and phone number and, depending on the form, a preferred date, car and track, number of participants, company name, type of event, email address and a free-text message. The same applies to the content of WhatsApp messages, emails and phone calls with us.
• What a booking and the activity require: details of the participants and drivers, ID number, date of birth, driving licence details (sometimes a photo of the licence), a health and fitness declaration, for a minor the details of a parent or guardian, and a digital signature on the agreement and on the driver declaration.
• Payment: card payments are processed by the payment provider. We do not keep the full card number: we keep only the last four digits, the card type, the expiry date and a token issued by the payment provider, so that a charge agreed with you can be made.
• Collected automatically on the website: the pages you visited, device and browser type, language, the site you came from and campaign parameters (such as utm parameters and Google, Meta and TikTok click IDs). For every visit we keep a visit record with those parameters and a one-way hash of your IP address, not the address itself.
• Phone calls with the business may be recorded for service, quality control and record keeping.

• To get back to you and answer your inquiry.
• To schedule, book and run the experience, including the agreement, the driver declaration and safety.
• To take payment and issue receipts and invoices.
• Customer service: reminders before the activity and a feedback request after it.
• To send news and offers, only to people who agreed to receive them. You can stop at any time (section 8).
• To measure and improve the website and our advertising, and to know which channel or ad brought the inquiry.
• To meet our legal obligations.

• Google Analytics and Google Ads: measuring visits, inquiries and conversions, using Google cookies.
• Our own cookie, exr_attr: keeps for up to 90 days where you came to the website from (source, campaign, landing page), so the inquiry is attributed to the right campaign.
• A cookie named exr_internal: set only in our own team's browsers, through an internal link, marking for a year that no measurement is sent from that device. Visitors never get it.
• A cookie named exr_bot: set for 24 hours when a visit arrives from a paid social-media link and from a country other than Israel, as our server reads it; our ads run in Israel only, and such a visit is normally the ad platform's own automated review tool. While it exists no measurement is sent from that browser. It holds nothing about the visitor and is never set by our team.
• Microsoft Clarity: records how a page is used (scrolling, clicks, cursor movement) and builds heatmaps, so we can see where the site is unclear. What you type into a form is masked in the recording, no name or phone number is captured, and the tool uses the _clck and _clsk cookies. It does not run on our own team's devices.
• The Meta pixel (Facebook and Instagram), the TikTok pixel and the OpenAI measurement pixel (ads in ChatGPT), when enabled: measure page views, taps on WhatsApp or phone and form submissions, to measure and improve our ads and to show ads to people who already visited the website. When you send a form we also report the inquiry to Meta, TikTok and OpenAI from our server, with your phone number as a one-way hash, so the platform can attribute the inquiry to the ad. The platform does not receive the number itself from us. The OpenAI pixel uses the __oppref cookie (the click reference of an ad in ChatGPT, 30 days) and the __obref cookie (a random browser reference, one year). Our own exr_uid cookie holds a random browser id for a year; OpenAI receives it only as a one-way hash, with the events of the pixel and with the server report of a form, and when you send a form the pixel also receives your phone number and name as one-way hashes.

You can block or delete cookies in your browser settings, install the Google Analytics opt-out add-on (tools.google.com/dlpage/gaoptout), and manage your ad preferences on Meta (facebook.com/adpreferences) and in the TikTok privacy settings.

We do not sell personal information. It goes only to the providers that run the service for us, and only as far as they need it:

• Website and back-office hosting: Vercel, and the Supabase database (servers in the European Union, in Frankfurt).
• Google: Analytics and Ads for measurement and advertising, Gmail and Google Calendar for email and scheduling.
• Meta: WhatsApp for messaging, and the Meta pixel and ads when enabled.
• TikTok: pixel and ads when enabled.
• OpenAI: ads in ChatGPT and their measurement pixel, when enabled.
• Microsoft: Clarity for usage recordings and heatmaps.
• HYP for card payments, and EZcount for receipts and invoices.
• Omnitelecom: the phone system and call recordings.
• When the service is enabled: Anthropic (Claude) for AI assistance in summarising calls and drafting and translating messages, and a transcription provider for call recordings.
• Authorities, where the law requires it, and professional advisers (accountant, lawyer) as needed.

Some providers store or process information outside Israel, in the European Union and in the United States. Transfers are made to provide the service and in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

We keep information for as long as it is needed for the purposes it was collected for, and for the period the law requires (for example, accounting records).

• To review your information (section 13 of the Privacy Protection Law, 5741-1981), and to ask us to correct or delete information that is not correct, complete, clear or up to date (section 14).
• To stop marketing messages at any time: reply "STOP" on WhatsApp, or contact us. Stopping marketing messages does not stop service messages about an existing booking.
• To contact us with any question or request: info@exr-racing.co.il or by phone at 03-6860005. We handle requests as the law requires.
• If you give us the details of another person (for example a participant you booked for), make sure they know and agree.

We take reasonable measures to protect information: an encrypted connection (HTTPS), a back office open only to authorised staff with personal accounts and role-based permissions, and a record of the actions taken in it. No system is completely immune.

We may update this policy from time to time. The binding version is the one on this page, with the date of the last update at the top.